From b5c188c1854a6ea99ba308704847673955cbe5de Mon Sep 17 00:00:00 2001
From: render <zjcrender@gmail.com>
Date: Wed, 23 Sep 2026 16:21:32 +0800
Subject: [PATCH] fix(ci): verify public release target

---
 .gitea/actions/curio-source/main.mjs | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/.gitea/actions/curio-source/main.mjs b/.gitea/actions/curio-source/main.mjs
index 5c1ebbe..0ae99a8 100644
--- a/.gitea/actions/curio-source/main.mjs
+++ b/.gitea/actions/curio-source/main.mjs
@@ -579,15 +579,6 @@ async function validatePullRequest() {
     console.log("Scheduled merge after required checks succeed.");
   }
 }
-async function releaseCommit(client, repository, tag) {
-  const refs = await client.api(`/repos/${repositoryPath(repository)}/git/refs/tags/${encodeURIComponent(tag)}`);
-  let object = (Array.isArray(refs) ? refs.find((ref) => ref.ref === `refs/tags/${tag}`) : refs)?.object;
-  for (let depth = 0; object?.type === "tag" && depth < 5; depth++) {
-    object = (await client.api(`/repos/${repositoryPath(repository)}/git/tags/${object.sha}`)).object;
-  }
-  if (object?.type !== "commit") throw new Error("Release tag does not resolve to a commit");
-  return object.sha;
-}
 async function verifyPublishedRelease(client, repository, tag, registry) {
   const release = await client.api(`/repos/${repositoryPath(repository)}/releases/tags/${encodeURIComponent(tag)}`);
   if (release.draft) throw new Error("Draft releases cannot enter the catalog");
@@ -595,7 +586,7 @@ async function verifyPublishedRelease(client, repository, tag, registry) {
   if (!descriptorAsset) throw new Error("Release has no trove-release.json attachment");
   const descriptor = validateDescriptor(await client.json(descriptorAsset.browser_download_url), registry);
   if (descriptor.repository !== repository || descriptor.tag !== tag) throw new Error("Release identity differs from its descriptor");
-  if (descriptor.commit !== await releaseCommit(client, repository, tag)) throw new Error("Release tag differs from the descriptor commit");
+  if (descriptor.commit !== release.target_commitish) throw new Error("Release target differs from the descriptor commit");
   const assets = /* @__PURE__ */ new Map();
   for (const plugin of descriptor.plugins) {
     for (const artifact of plugin.artifacts) {
@@ -616,7 +607,7 @@ async function proposeRelease() {
   if (!tag) throw new Error("Release tag is required");
   if (repository.split("/")[0] !== trustedOwner) throw new Error(`${repository} is not an official Curio repository`);
   if (!process.env.CATALOG_TOKEN) throw new Error("Catalog write token is missing");
-  const sourceClient = new Gitea({ token: process.env.GITHUB_TOKEN });
+  const sourceClient = new Gitea({ token: "" });
   const catalogClient = new Gitea({ token: process.env.CATALOG_TOKEN });
   if (sourceClient.server !== catalogClient.server) throw new Error("Release and catalog must use the same Gitea server");
   const published = await verifyPublishedRelease(sourceClient, repository, tag, catalogRepository);