From a0f8a14e5c06cd93f06b329549bd021900f7dcec Mon Sep 17 00:00:00 2001 From: Yurii Serhiichuk Date: Mon, 19 Oct 2026 18:09:24 +0200 Subject: [PATCH 1/3] Replace HOMEBREW_TAP_TOKEN with a GitHub App installation token. The tap update failed because the user PAT lacked CreatePullRequest. Mint a scoped App token for homebrew-tap instead (SRE-149). --- .github/workflows/release.yml | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 820f17c..2889d5a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -55,15 +55,30 @@ jobs: gh release upload "${{ github.event.release.tag_name }}" "$f" --repo "${{ github.repository }}" done + # GITHUB_TOKEN cannot write to dualentry/homebrew-tap. Mint an installation + # token from the dualentry-homebrew-tap App instead of a user PAT. + # Setup: Linear SRE-149. Pattern: github-actions PR assigner / aws-infra terraform-ci. update-tap: needs: upload runs-on: ubuntu-latest + permissions: {} steps: + - name: Create Homebrew tap App token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.HOMEBREW_TAP_APP_CLIENT_ID }} + private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: homebrew-tap + permission-contents: write + permission-pull-requests: write + - name: Update Homebrew tap - if: ${{ env.TAP_TOKEN != '' }} env: - TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | + set -euo pipefail VERSION="${GITHUB_REF_NAME#v}" BASE_URL="https://github.com/${{ github.repository }}/releases/download/${{ github.event.release.tag_name }}" @@ -112,12 +127,12 @@ jobs: sed -i "s|SHA_LINUX_PLACEHOLDER|$SHA_LINUX|g" /tmp/dualentry.rb sed -i 's/^ //' /tmp/dualentry.rb - git clone "https://x-access-token:${TAP_TOKEN}@github.com/dualentry/homebrew-tap.git" /tmp/tap + git clone "https://x-access-token:${GH_TOKEN}@github.com/dualentry/homebrew-tap.git" /tmp/tap mkdir -p /tmp/tap/Formula cp /tmp/dualentry.rb /tmp/tap/Formula/dualentry.rb cd /tmp/tap - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" + git config user.name "dualentry-homebrew-tap[bot]" + git config user.email "dualentry-homebrew-tap[bot]@users.noreply.github.com" BRANCH="update-dualentry-$VERSION" git checkout -b "$BRANCH" @@ -127,7 +142,6 @@ jobs: # main is a protected branch on the tap repo (PR required), so push a # branch and PR it instead of pushing straight to main. - export GH_TOKEN="$TAP_TOKEN" PR_URL=$(gh pr create --repo dualentry/homebrew-tap \ --title "Update dualentry to $VERSION" \ --body "Automated formula update for dualentry $VERSION." \ From fafc4d8f654c36739cbe0f4577e4d197c3e1655a Mon Sep 17 00:00:00 2001 From: Yurii Serhiichuk Date: Mon, 19 Oct 2026 18:20:46 +0200 Subject: [PATCH 2/3] Rename Homebrew tap App credentials to dualentry-ci. Use the shared dualentry-ci App client ID and private key names. --- .github/workflows/release.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2889d5a..645b1b9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,19 +56,18 @@ jobs: done # GITHUB_TOKEN cannot write to dualentry/homebrew-tap. Mint an installation - # token from the dualentry-homebrew-tap App instead of a user PAT. - # Setup: Linear SRE-149. Pattern: github-actions PR assigner / aws-infra terraform-ci. + # token from the dualentry-ci App instead of a user PAT (SRE-149). update-tap: needs: upload runs-on: ubuntu-latest permissions: {} steps: - - name: Create Homebrew tap App token + - name: Create dualentry-ci App token id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - client-id: ${{ vars.HOMEBREW_TAP_APP_CLIENT_ID }} - private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }} + client-id: ${{ vars.DUALENTRY_CI_APP_CLIENT_ID }} + private-key: ${{ secrets.DUALENTRY_CI_APP_PRIVATE_KEY }} owner: ${{ github.repository_owner }} repositories: homebrew-tap permission-contents: write @@ -131,8 +130,8 @@ jobs: mkdir -p /tmp/tap/Formula cp /tmp/dualentry.rb /tmp/tap/Formula/dualentry.rb cd /tmp/tap - git config user.name "dualentry-homebrew-tap[bot]" - git config user.email "dualentry-homebrew-tap[bot]@users.noreply.github.com" + git config user.name "dualentry-ci[bot]" + git config user.email "dualentry-ci[bot]@users.noreply.github.com" BRANCH="update-dualentry-$VERSION" git checkout -b "$BRANCH" From 52d0d6371dac128624bbcd000239d97e1ad63407 Mon Sep 17 00:00:00 2001 From: Yurii Serhiichuk Date: Mon, 19 Oct 2026 18:27:18 +0200 Subject: [PATCH 3/3] Use a GitHub App token to update the Homebrew tap on release. Replace the personal access token previously required for cross-repo writes. --- .github/workflows/release.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 645b1b9..5bd82c2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -55,14 +55,14 @@ jobs: gh release upload "${{ github.event.release.tag_name }}" "$f" --repo "${{ github.repository }}" done - # GITHUB_TOKEN cannot write to dualentry/homebrew-tap. Mint an installation - # token from the dualentry-ci App instead of a user PAT (SRE-149). + # GITHUB_TOKEN cannot write to another repository. Use a GitHub App + # installation token to update the Homebrew tap. update-tap: needs: upload runs-on: ubuntu-latest permissions: {} steps: - - name: Create dualentry-ci App token + - name: Create GitHub App token id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: @@ -130,8 +130,8 @@ jobs: mkdir -p /tmp/tap/Formula cp /tmp/dualentry.rb /tmp/tap/Formula/dualentry.rb cd /tmp/tap - git config user.name "dualentry-ci[bot]" - git config user.email "dualentry-ci[bot]@users.noreply.github.com" + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" BRANCH="update-dualentry-$VERSION" git checkout -b "$BRANCH" @@ -139,8 +139,7 @@ jobs: git commit -m "Update dualentry to $VERSION" git push origin "$BRANCH" - # main is a protected branch on the tap repo (PR required), so push a - # branch and PR it instead of pushing straight to main. + # Push a branch and open a PR; main may require review. PR_URL=$(gh pr create --repo dualentry/homebrew-tap \ --title "Update dualentry to $VERSION" \ --body "Automated formula update for dualentry $VERSION." \ @@ -154,3 +153,4 @@ jobs: else echo "::warning::Could not merge or enable auto-merge for $PR_URL — merge it manually." fi +