From 889f33c951947d8481c2f2416671b32f1e498eac Mon Sep 17 00:00:00 2001
From: "tuti." <tuti@tigera.io>
Date: Fri, 13 Dec 2024 08:56:14 -0800
Subject: [PATCH] [release tool] pass in GitHub token as flag for actual
 release (#9596)

* pass in GitHub token as flag for actual release

* CI fix
---
 release/cmd/flags.go                  |  6 ++++++
 release/cmd/release.go                |  3 +++
 release/pkg/manager/calico/manager.go | 10 +++-------
 release/pkg/manager/calico/options.go |  7 +++++++
 4 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/release/cmd/flags.go b/release/cmd/flags.go
index 89105390929..62133afd228 100644
--- a/release/cmd/flags.go
+++ b/release/cmd/flags.go
@@ -359,6 +359,12 @@ var (
 		Name:  "publish-github-release",
 		Usage: "Publish the release to GitHub",
 		Value: true,
+		Action: func(c *cli.Context, b bool) error {
+			if b && c.String(githubTokenFlag.Name) == "" {
+				return fmt.Errorf("GitHub token is required to publish release")
+			}
+			return nil
+		},
 	}
 )
 
diff --git a/release/cmd/release.go b/release/cmd/release.go
index ce1d71cfada..2328acc11a0 100644
--- a/release/cmd/release.go
+++ b/release/cmd/release.go
@@ -138,6 +138,7 @@ func releaseSubCommands(cfg *Config) []*cli.Command {
 					calico.WithPublishImages(c.Bool(publishImagesFlag.Name)),
 					calico.WithPublishGitTag(c.Bool(publishGitTagFlag.Name)),
 					calico.WithPublishGithubRelease(c.Bool(publishGitHubReleaseFlag.Name)),
+					calico.WithGithubToken(c.String(githubTokenFlag.Name)),
 				}
 				if reg := c.StringSlice(registryFlag.Name); len(reg) > 0 {
 					opts = append(opts, calico.WithImageRegistries(reg))
@@ -155,6 +156,7 @@ func releaseBuildFlags() []cli.Flag {
 		archFlag,
 		registryFlag,
 		buildImagesFlag,
+		githubTokenFlag,
 		skipValidationFlag)
 	return f
 }
@@ -166,6 +168,7 @@ func releasePublishFlags() []cli.Flag {
 		publishImagesFlag,
 		publishGitTagFlag,
 		publishGitHubReleaseFlag,
+		githubTokenFlag,
 		skipValidationFlag)
 	return f
 }
diff --git a/release/pkg/manager/calico/manager.go b/release/pkg/manager/calico/manager.go
index 59802ae2e81..f0a5353fb5f 100644
--- a/release/pkg/manager/calico/manager.go
+++ b/release/pkg/manager/calico/manager.go
@@ -203,6 +203,9 @@ type CalicoManager struct {
 	// image scanning configuration.
 	imageScanning       bool
 	imageScanningConfig imagescanner.Config
+
+	// external configuration.
+	githubToken string
 }
 
 func releaseImages(version, operatorVersion string) []string {
@@ -520,13 +523,6 @@ func (r *CalicoManager) releasePrereqs() error {
 		return fmt.Errorf("cannot cut release from branch: %s", branch)
 	}
 
-	// Make sure we have a github token - needed for publishing to GH.
-	// Strictly only needed for publishing, but we check during release anyway so
-	// that we don't get all the way through the build to find out we're missing it!
-	if token := os.Getenv("GITHUB_TOKEN"); token == "" {
-		return fmt.Errorf("no GITHUB_TOKEN present in environment")
-	}
-
 	// If we are releasing to projectcalico/calico, make sure we are releasing to the default registries.
 	if r.githubOrg == utils.ProjectCalicoOrg && r.repo == utils.CalicoRepoName {
 		if !reflect.DeepEqual(r.imageRegistries, defaultRegistries) {
diff --git a/release/pkg/manager/calico/options.go b/release/pkg/manager/calico/options.go
index bb43961a09f..8b69668a45d 100644
--- a/release/pkg/manager/calico/options.go
+++ b/release/pkg/manager/calico/options.go
@@ -164,3 +164,10 @@ func WithImageScanning(scanning bool, cfg imagescanner.Config) Option {
 		return nil
 	}
 }
+
+func WithGithubToken(token string) Option {
+	return func(r *CalicoManager) error {
+		r.githubToken = token
+		return nil
+	}
+}