From fef4292a5fa50e2188e4e57dede541fc42e222e1 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Tue, 15 Sep 2026 14:01:13 +0000
Subject: [PATCH] [#1046] Read the latest release with the workflow token, and fail the step when it comes back empty (#1047)

---
 .github/workflows/build.yml |   16 ++++++++++++++--
 1 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index aa484d4..ad914f0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -449,8 +449,14 @@
           name: ubuntu-latest-11
       - name: Get latest release version
         shell: bash
+        env:
+          # An anonymous call shares the 60-an-hour budget of the runner's address with every
+          # other job there; once it is spent the API answers with no release, the version comes
+          # out empty and buildx refuses the untagged push (run 34854564649).
+          GH_TOKEN: ${{ github.token }}
         run:   |
-          export git_version_last="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
+          export git_version_last="$(curl -i -o - --silent -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
+          [ -n "$git_version_last" ] || { echo "::error::The latest release of OpenIdentityPlatform/OpenDJ could not be read, so there is no version to tag the image with"; exit 1; }
           echo "release_version=$git_version_last" >> $GITHUB_ENV
           echo "image_repository=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
       - name: Docker meta
@@ -594,8 +600,14 @@
           name: ubuntu-latest-11
       - name: Get latest release version
         shell: bash
+        env:
+          # An anonymous call shares the 60-an-hour budget of the runner's address with every
+          # other job there; once it is spent the API answers with no release, the version comes
+          # out empty and buildx refuses the untagged push (run 34854564649).
+          GH_TOKEN: ${{ github.token }}
         run:   |
-          export git_version_last="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
+          export git_version_last="$(curl -i -o - --silent -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
+          [ -n "$git_version_last" ] || { echo "::error::The latest release of OpenIdentityPlatform/OpenDJ could not be read, so there is no version to tag the image with"; exit 1; }
           echo "release_version=$git_version_last" >> $GITHUB_ENV
           echo "image_repository=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
       - name: Docker meta 

--
Gitblit v1.10.0