From 67f3532938f3b4b3be7ffa740486173defe396be Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Fri, 4 Sep 2026 04:21:16 +0000
Subject: [PATCH] fix: release-mac.sh resolves tokens from the git credential
 store; fail fast (#24)

---
 scripts/release-mac.sh | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/scripts/release-mac.sh b/scripts/release-mac.sh
index e5fcdb3..ddc586d 100755
--- a/scripts/release-mac.sh
+++ b/scripts/release-mac.sh
@@ -45,8 +45,20 @@ get_token() {
       if [ -n "$tok" ]; then echo "$tok"; return; fi
     fi
   fi
-  read -rsp "Gitea personal access token (repo write): " GITEA_TOKEN
-  echo "$GITEA_TOKEN"
+  # Fall back to the git credential store: tea's OAuth login stores an access
+  # token as the password for every push to this remote, and Gitea accepts it
+  # for API auth (Authorization: token <access_token>).
+  local host cred
+  host="${GITEA_SERVER#*://}"
+  cred="$(printf 'protocol=https\nhost=%s\n\n' "$host" \
+    | git credential fill 2>/dev/null | sed -n 's/^password=//p' | head -1 || true)"
+  if [ -n "$cred" ]; then echo "$cred"; return; fi
+  # Fail fast — continuing without a token fails only at the upload step,
+  # after the whole build has run.
+  echo "error: no Gitea token found" >&2
+  echo "  set GITEA_TOKEN, or run 'tea login' / 'git push' once so the" >&2
+  echo "  credential store has an entry for $host" >&2
+  exit 1
 }
 
 GITEA_TOKEN="$(get_token)"