chore(ci): fix publish (#1607)

Author: staaldraad

scripts/release-canary.ts

@@ -24,9 +24,13 @@ import { execSync } from 'child_process'
   // token, because releasePublish wants a token that has the id_token: write permission
   // so that we can use OIDC for trusted publishing
 
-  const gh_token_bak = process.env.GITHUB_TOKEN
-  process.env.GITHUB_TOKEN = process.env.RELEASE_GITHUB_TOKEN
-
+  // backup original auth header
+  const originalAuth = execSync('git config --local http.https://github.com/.extraheader')
+    .toString()
+    .trim()
+  // switch the token used
+  const authHeader = `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${process.env.RELEASE_GITHUB_TOKEN}`).toString('base64')}`
+  execSync(`git config --local http.https://github.com/.extraheader "${authHeader}"`)
   await releaseChangelog({
     versionData: projectsVersionData,
     version: workspaceVersion,
@@ -36,7 +40,8 @@ import { execSync } from 'child_process'
   })
 
   // npm publish with OIDC
-  process.env.GITHUB_TOKEN = gh_token_bak
+  // not strictly necessary to restore the header but do it incase  we require it later
+  execSync(`git config --local http.https://github.com/.extraheader "${originalAuth}"`)
   const publishResult = await releasePublish({
     registry: 'https://registry.npmjs.org/',
     access: 'public',

scripts/release-stable.ts

@@ -62,8 +62,13 @@ if (!validSpecifiers.includes(versionSpecifier) && !isValidVersion) {
   // token, because releasePublish wants a token that has the id_token: write permission
   // so that we can use OIDC for trusted publishing
 
-  const gh_token_bak = process.env.GITHUB_TOKEN
-  process.env.GITHUB_TOKEN = process.env.RELEASE_GITHUB_TOKEN
+  // backup original auth header
+  const originalAuth = execSync('git config --local http.https://github.com/.extraheader')
+    .toString()
+    .trim()
+  // switch the token used
+  const authHeader = `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${process.env.RELEASE_GITHUB_TOKEN}`).toString('base64')}`
+  execSync(`git config --local http.https://github.com/.extraheader "${authHeader}"`)
 
   const result = await releaseChangelog({
     versionData: projectsVersionData,
@@ -74,7 +79,9 @@ if (!validSpecifiers.includes(versionSpecifier) && !isValidVersion) {
   })
 
   // npm publish with OIDC
-  process.env.GITHUB_TOKEN = gh_token_bak
+  // not strictly necessary to restore the header but do it incase  we require it later
+  execSync(`git config --local http.https://github.com/.extraheader "${originalAuth}"`)
+
   const publishResult = await releasePublish({
     registry: 'https://registry.npmjs.org/',
     access: 'public',