ci: field isolation matrix

Author: Alberto-Codes

.github/workflows/diag-expr.yml

@@ -11,43 +11,31 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - name: Compare the fallback expression against the secret alone
+      - name: Isolate which field triggers the 403
         env:
-          TOK_EXPR: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
-          TOK_DIRECT: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          TOK: ${{ secrets.RELEASE_PLEASE_TOKEN }}
         run: |
           set -u
-          echo "expr   len=${#TOK_EXPR} prefix=${TOK_EXPR%%_*}_"
-          echo "direct len=${#TOK_DIRECT} prefix=${TOK_DIRECT%%_*}_"
-          if [ "$TOK_EXPR" = "$TOK_DIRECT" ]; then echo "SAME token"; else echo "DIFFERENT token"; fi
-
-          echo "--- A: same payload but Authorization: Bearer ---"
-          curl -sS -o /tmp/b.json -w 'http=%{http_code}\n' \
-            -X POST -H "Authorization: Bearer $TOK_EXPR" \
-            -H "Accept: application/vnd.github+json" \
-            https://api.github.com/repos/${{ github.repository }}/releases \
-            -d '{"name":"v1.3.0-diagB","tag_name":"v1.3.0-diagB","body":"diag notes","draft":false,"prerelease":false,"target_commitish":"25403c7"}'
-          echo "BEARER result: $(jq -r '.message // "created"' /tmp/b.json)"
-          idb=$(jq -r '.id // empty' /tmp/b.json)
-          if [ -n "$idb" ]; then
-            curl -sS -o /dev/null -X DELETE -H "Authorization: Bearer $TOK_EXPR" \
-              https://api.github.com/repos/${{ github.repository }}/releases/$idb
-            curl -sS -o /dev/null -X DELETE -H "Authorization: Bearer $TOK_EXPR" \
-              https://api.github.com/repos/${{ github.repository }}/git/refs/tags/v1.3.0-diagB
-            echo "(bearer variant cleaned up)"
-          fi
-
-          echo "--- exact release-please payload, via the expression token ---"
-          curl -sS -o /tmp/a.json -w 'http=%{http_code}\n' \
-            -X POST -H "Authorization: token $TOK_EXPR" \
-            -H "Accept: application/vnd.github+json" \
-            https://api.github.com/repos/${{ github.repository }}/releases \
-            -d '{"name":"v1.3.0-diag","tag_name":"v1.3.0-diag","body":"diag notes","draft":false,"prerelease":false,"target_commitish":"25403c7"}'
-          echo "expr result: $(jq -r '.message // "created"' /tmp/a.json)"
-          ida=$(jq -r '.id // empty' /tmp/a.json)
-          if [ -n "$ida" ]; then
-            curl -sS -o /dev/null -w 'cleanup rel=%{http_code}\n' -X DELETE -H "Authorization: token $TOK_EXPR" \
-              https://api.github.com/repos/${{ github.repository }}/releases/$ida
-            curl -sS -o /dev/null -w 'cleanup tag=%{http_code}\n' -X DELETE -H "Authorization: token $TOK_EXPR" \
-              https://api.github.com/repos/${{ github.repository }}/git/refs/tags/v1.3.0-diag
-          fi
+          try() {
+            local label="$1"; local payload="$2"
+            code=$(curl -sS -o /tmp/o.json -w '%{http_code}' -X POST \
+              -H "Authorization: Bearer $TOK" -H "Accept: application/vnd.github+json" \
+              https://api.github.com/repos/${{ github.repository }}/releases -d "$payload")
+            msg=$(jq -r '.message // "created"' /tmp/o.json)
+            echo "RESULT $label http=$code msg=$msg"
+            id=$(jq -r '.id // empty' /tmp/o.json)
+            tag=$(jq -r '.tag_name // empty' /tmp/o.json)
+            if [ -n "$id" ]; then
+              curl -sS -o /dev/null -X DELETE -H "Authorization: Bearer $TOK" \
+                https://api.github.com/repos/${{ github.repository }}/releases/$id
+              curl -sS -o /dev/null -X DELETE -H "Authorization: Bearer $TOK" \
+                https://api.github.com/repos/${{ github.repository }}/git/refs/tags/$tag
+            fi
+          }
+          F=25403c779883dc808219e5cad581d33aea691220
+          try baseline-fullsha-notag-nobody '{"tag_name":"zz-v1","target_commitish":"'$F'","draft":false,"name":"n"}'
+          try plus-body                     '{"tag_name":"zz-v2","target_commitish":"'$F'","draft":false,"name":"n","body":"notes"}'
+          try plus-prerelease               '{"tag_name":"zz-v3","target_commitish":"'$F'","draft":false,"prerelease":false,"name":"n"}'
+          try short-sha                     '{"tag_name":"zz-v4","target_commitish":"25403c7","draft":false,"name":"n"}'
+          try vdot-tagname                  '{"tag_name":"v1.3.0-diagX","target_commitish":"'$F'","draft":false,"name":"n"}'
+          try exact-releaseplease           '{"name":"v1.3.0","tag_name":"v1.3.0-diagY","body":"notes","draft":false,"prerelease":false,"target_commitish":"'$F'"}'