From 7e12857e354a385fc67530170bfe32ea9664e1ee Mon Sep 17 00:00:00 2001
From: Edgar Babajanyan <bedgar2005@gmail.com>
Date: Sat, 4 Jul 2026 18:41:59 -0700
Subject: [PATCH] Fix release workflow: grant contents:write, replace archived
 create-release action
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The v0.4.0 tag run failed at Create Release with 'Resource not
accessible by integration' — the default GITHUB_TOKEN is read-only and
the workflow declared no permissions, so the release had to be created
manually. Grant contents:write, and swap the archived
actions/create-release@v1 (plus its brittle %0A body escaping) for gh
release create reading the CHANGELOG section from a file, skipping
cleanly when the release already exists.

Signed-off-by: Edgar Babajanyan <bedgar2005@gmail.com>
---
 .github/workflows/release.yml | 41 ++++++++++++++---------------------
 1 file changed, 16 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d8ff15f..29028cc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,10 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+# Creating a release needs contents:write; the default token is read-only.
+permissions:
+  contents: write
+
 jobs:
   create-release:
     name: Create GitHub Release
@@ -38,33 +42,20 @@ jobs:
       - name: Build release binaries
         run: cargo build --release -p compass
 
-      - name: Extract changelog section
-        id: changelog
-        run: |
-          # Extract changelog between tag and previous tag
-          VERSION="${{ steps.version.outputs.version }}"
-          PREV_TAG=$(git describe --tags --abbrev=0 $(git rev-list --tags --skip=1 -n1) 2>/dev/null || echo "HEAD")
-          
-          # Extract relevant section from CHANGELOG.md
-          CHANGELOG=$(sed -n "/## \[$VERSION\]/,/## \[/p" CHANGELOG.md | sed '$ d')
-          
-          # Escape for GitHub Actions
-          CHANGELOG="${CHANGELOG//'%'/'%25'}"
-          CHANGELOG="${CHANGELOG//$'\n'/'%0A'}"
-          CHANGELOG="${CHANGELOG//$'\r'/'%0D'}"
-          
-          echo "body=$CHANGELOG" >> $GITHUB_OUTPUT
-
       - name: Create Release
-        uses: actions/create-release@v1
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: Release v${{ steps.version.outputs.version }}
-          body: ${{ steps.changelog.outputs.body }}
-          draft: false
-          prerelease: false
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          # Release body = this version's CHANGELOG section, verbatim.
+          sed -n "/## \[$VERSION\]/,/## \[/p" CHANGELOG.md | sed '$ d' > /tmp/notes.md
+          if gh release view "v$VERSION" >/dev/null 2>&1; then
+            echo "release v$VERSION already exists — skipping creation"
+          else
+            gh release create "v$VERSION" \
+              --title "Release v$VERSION" \
+              --notes-file /tmp/notes.md
+          fi
 
   publish-crate:
     name: Publish to crates.io