adrianbonpin/gridline
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

chore(release): push the Homebrew cask with a deploy key (#31)

Browse Source 
Replace the HOMEBREW_TAP_TOKEN PAT with HOMEBREW_TAP_DEPLOY_KEY, a
write-enabled SSH deploy key scoped to only AdrianBonpin/homebrew-gridline.
actions/checkout's `ssh-key` input wires the key into the SSH agent for the
job, so the cask push goes over SSH and no broadly-scoped personal access
token has to be stored as a repository secret.

Also drops the now-wrong claim that the job no-ops until the secret is set.
This commit is contained in:
adrianbonpin
2026-09-20 16:05:29 +08:00
committed by GitHub
parent f1d9fdae3a
commit c4dc1c1c83
2 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+12 -8
View File
@@ -24,7 +24,10 @@ name: Release
# #
# The cask bump runs only after the draft release is PUBLISHED (the GitHub # The cask bump runs only after the draft release is PUBLISHED (the GitHub
# releases/tags API does not serve drafts), so it is wired to the `release: # releases/tags API does not serve drafts), so it is wired to the `release:
# published` event rather than the tag push. It also needs HOMEBREW_TAP_TOKEN. # published` event rather than the tag push. It pushes with a write-enabled
# deploy key scoped to ONLY the tap repo (HOMEBREW_TAP_DEPLOY_KEY), so no
# broad personal access token is stored — the default GITHUB_TOKEN cannot
# push to a different repository.
on: on:
push: push:
@@ -421,9 +424,10 @@ jobs:
# render Casks/gridline.rb from the template, and push it. Users then get # render Casks/gridline.rb from the template, and push it. Users then get
# the new version via `brew upgrade --cask gridline`. # the new version via `brew upgrade --cask gridline`.
# #
# Requires the HOMEBREW_TAP_TOKEN secret (a PAT with `repo` scope on the tap # Requires the HOMEBREW_TAP_DEPLOY_KEY secret — a write-enabled SSH deploy
# repo — the default GITHUB_TOKEN cannot push to a different repo). The job # key on the tap repo (the default GITHUB_TOKEN cannot push to a different
# no-ops until that secret is set, so releases stay green before this is # repository, and a deploy key avoids storing a broad PAT). The job skips
# cleanly until that secret is set, so releases stay green before this is
# configured. # configured.
bump-cask: bump-cask:
# Triggered by `release: published`, NOT the tag push: the GitHub # Triggered by `release: published`, NOT the tag push: the GitHub
@@ -434,15 +438,15 @@ jobs:
permissions: permissions:
contents: read contents: read
steps: steps:
- name: Check for tap token - name: Check for tap deploy key
id: tap id: tap
shell: bash shell: bash
run: | run: |
if [ -n "${{ secrets.HOMEBREW_TAP_TOKEN }}" ]; then if [ -n "${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}" ]; then
echo "enabled=true" >> "$GITHUB_OUTPUT" echo "enabled=true" >> "$GITHUB_OUTPUT"
else else
echo "enabled=false" >> "$GITHUB_OUTPUT" echo "enabled=false" >> "$GITHUB_OUTPUT"
echo "::notice::HOMEBREW_TAP_TOKEN not set - skipping Homebrew cask bump." echo "::notice::HOMEBREW_TAP_DEPLOY_KEY not set - skipping Homebrew cask bump."
fi fi
- name: Checkout - name: Checkout
@@ -467,7 +471,7 @@ jobs:
uses: actions/checkout@v4 uses: actions/checkout@v4
with: with:
repository: AdrianBonpin/homebrew-gridline repository: AdrianBonpin/homebrew-gridline
token: ${{ secrets.HOMEBREW_TAP_TOKEN }} ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
path: tap path: tap
- name: Render and push cask - name: Render and push cask
README.md
+1 -1
View File
@@ -367,7 +367,7 @@ git tag v0.7.15
git push origin v0.7.15 git push origin v0.7.15
``` ```
GitHub Actions (`.github/workflows/release.yml`) builds the **macOS (Apple Silicon + Intel), Windows, and Linux** installers in parallel and opens a **draft release** on the [Releases](https://github.com/AdrianBonpin/gridline/releases) page. Review the draft and hit **Publish release** — publishing triggers a follow-up job that bumps the Homebrew cask in [`AdrianBonpin/homebrew-gridline`](https://github.com/AdrianBonpin/homebrew-gridline) (requires the `HOMEBREW_TAP_TOKEN` secret; skipped when unset). GitHub Actions (`.github/workflows/release.yml`) builds the **macOS (Apple Silicon + Intel), Windows, and Linux** installers in parallel and opens a **draft release** on the [Releases](https://github.com/AdrianBonpin/gridline/releases) page. Review the draft and hit **Publish release** — publishing triggers a follow-up job that bumps the Homebrew cask in [`AdrianBonpin/homebrew-gridline`](https://github.com/AdrianBonpin/homebrew-gridline) (pushed via a write-enabled deploy key on the tap, `HOMEBREW_TAP_DEPLOY_KEY`; skipped when unset).
The self-hosted Gitea mirror (`.gitea/workflows/release.yml`) still builds Linux and Windows for the Gitea release, and `scripts/release-mac.sh` can build macOS locally — both are kept as a fallback if GitHub is unavailable. The self-hosted Gitea mirror (`.gitea/workflows/release.yml`) still builds Linux and Windows for the Gitea release, and `scripts/release-mac.sh` can build macOS locally — both are kept as a fallback if GitHub is unavailable.