From a4452530e00ea0154e03901bdaf8c2267d8ce381 Mon Sep 17 00:00:00 2001
From: Philip Peterson <1326208+philip-peterson@users.noreply.github.com>
Date: Fri, 30 Oct 2026 03:56:17 -0800
Subject: [PATCH] iso.yml: don't hand Forgejo's token to just's installer

The installer sends $GITHUB_TOKEN to GitHub; in a Forgejo job that's
Forgejo's own token, so GitHub refused the download (410).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .forgejo/workflows/iso.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/iso.yml b/.forgejo/workflows/iso.yml
index f1693c0..8c07043 100644
--- a/.forgejo/workflows/iso.yml
+++ b/.forgejo/workflows/iso.yml
@@ -43,7 +43,9 @@ jobs:
           curl -fsSL https://taskfile.dev/install.sh | sh -s -- -d -b "$HOME/.local/bin"
           # --force: on a host-mode runner $HOME outlives the job, and
           # just's installer won't overwrite the previous run's binary.
-          curl -fsSL https://just.systems/install.sh | bash -s -- --force --to "$HOME/.local/bin"
+          # env -u: the installer sends $GITHUB_TOKEN to GitHub, and here
+          # that's Forgejo's token, which GitHub rejects (401/410).
+          curl -fsSL https://just.systems/install.sh | env -u GITHUB_TOKEN bash -s -- --force --to "$HOME/.local/bin"
           curl -fsSL -o "$HOME/.local/bin/yq" https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
           curl -fsSL -o "$HOME/.local/bin/cosign" https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
           chmod +x "$HOME/.local/bin/yq" "$HOME/.local/bin/cosign"