release.yml release lookup uses limit=50 with no pagination #11

New issue

Closed

opened 2026-10-16 21:07:24 -07:00 by eric · 0 comments

eric commented

2026-10-16 21:07:24 -07:00

Owner

Found during security audit run 3 (2026-10-16). This is a CI bug, not a security issue.

Problem

release.yml finds an existing release or draft for the tag with GET $API/releases?limit=50 (.forgejo/workflows/release.yml:218), with no pagination. Once the repo has more than 50 releases, a draft or UI-created release for the tag may not be on the first page. The job then tries to create a new one, which fails on the duplicate tag, and the release is never published.

Fix

Look the release up directly with GET $API/releases/tags/$TAG and handle the 404. Check whether this endpoint returns drafts on our Forgejo version. If it doesn't, fall back to a paginated list.
Or loop over page=N until a page returns empty.

Found during security audit run 3 (2026-10-16). This is a CI bug, not a security issue. ## Problem `release.yml` finds an existing release or draft for the tag with `GET $API/releases?limit=50` (`.forgejo/workflows/release.yml:218`), with no pagination. Once the repo has more than 50 releases, a draft or UI-created release for the tag may not be on the first page. The job then tries to create a new one, which fails on the duplicate tag, and the release is never published. ## Fix - Look the release up directly with `GET $API/releases/tags/$TAG` and handle the 404. Check whether this endpoint returns drafts on our Forgejo version. If it doesn't, fall back to a paginated list. - Or loop over `page=N` until a page returns empty.

eric added the

bug

label

2026-10-16 21:07:24 -07:00

eric referenced this issue from a commit

2026-10-16 22:09:53 -07:00

fix(ci): paginate the release lookup in release.yml

eric closed this issue

2026-10-16 22:09:53 -07:00