From 1556fd1deae0f6d84f31a2db4eb70a25d53eae06 Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Fri, 4 Sep 2026 12:21:06 +0800
Subject: [PATCH] fix: release-mac.sh resolves tokens from the git credential
 store; fail fast
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The token lookup only read PATs from tea's config — with tea's OAuth
login the config has no token, so the script silently continued with an
empty one and failed 30 minutes later at the upload step. Fall back to
the git credential store (the access token stored by every git push,
accepted by Gitea for API auth), and error out immediately when nothing
is found instead of burning a full build.
---
 scripts/release-mac.sh | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/scripts/release-mac.sh b/scripts/release-mac.sh
index e5fcdb3..ddc586d 100755
--- a/scripts/release-mac.sh
+++ b/scripts/release-mac.sh
@@ -45,8 +45,20 @@ get_token() {
       if [ -n "$tok" ]; then echo "$tok"; return; fi
     fi
   fi
-  read -rsp "Gitea personal access token (repo write): " GITEA_TOKEN
-  echo "$GITEA_TOKEN"
+  # Fall back to the git credential store: tea's OAuth login stores an access
+  # token as the password for every push to this remote, and Gitea accepts it
+  # for API auth (Authorization: token <access_token>).
+  local host cred
+  host="${GITEA_SERVER#*://}"
+  cred="$(printf 'protocol=https\nhost=%s\n\n' "$host" \
+    | git credential fill 2>/dev/null | sed -n 's/^password=//p' | head -1 || true)"
+  if [ -n "$cred" ]; then echo "$cred"; return; fi
+  # Fail fast — continuing without a token fails only at the upload step,
+  # after the whole build has run.
+  echo "error: no Gitea token found" >&2
+  echo "  set GITEA_TOKEN, or run 'tea login' / 'git push' once so the" >&2
+  echo "  credential store has an entry for $host" >&2
+  exit 1
 }
 
 GITEA_TOKEN="$(get_token)"
-- 
2.54.0