From 9ee397b6c8fa5a4363f55e845822a45a68bf48a4 Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 3 Aug 2026 12:33:13 +0300 Subject: [PATCH 1/3] fix(ci): use release bot for Homebrew tap --- .github/workflows/ci.yml | 18 +++++++++++++++--- docs/DISTRIBUTION.md | 4 ++-- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4f25f58..d379535 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -278,14 +278,26 @@ jobs: contents: read steps: + - name: Create Homebrew release bot token + id: homebrew-release-bot + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.PUTIO_RELEASE_BOT_CLIENT_ID }} + private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }} + owner: putdotio + repositories: | + putio-cli + homebrew-tap + permission-contents: write + - name: Release to Homebrew tap uses: Justintime50/homebrew-releaser@a62d7a359683bfc047cdb2431f53ee58241464d1 # v3 with: homebrew_owner: putdotio homebrew_tap: homebrew-tap - github_token: ${{ secrets.HOMEBREW_TAP_TOKEN }} - commit_owner: devsputio - commit_email: devs@put.io + github_token: ${{ steps.homebrew-release-bot.outputs.token }} + commit_owner: ${{ steps.homebrew-release-bot.outputs.app-slug }}[bot] + commit_email: ${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]@users.noreply.github.com branch: main formula_folder: Formula install: 'bin.install "putio"' diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index 540171e..978f242 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -20,13 +20,13 @@ Release jobs declare the protected GitHub Environment named `release`. Environment entries: -- secrets: `PUTIO_RELEASE_BOT_PRIVATE_KEY`, `HOMEBREW_TAP_TOKEN` +- secrets: `PUTIO_RELEASE_BOT_PRIVATE_KEY` - variables: `PUTIO_RELEASE_BOT_CLIENT_ID` - approval: none; releases are continuous after the `main` gate passes - refs: release branch/tag policy constrains what can publish - deployment records: disabled with `deployment: false` because this is package publishing, not an app deploy -Release GitHub writes use `putio-release-bot` for version sync commits, `v*` tags, GitHub Releases, and binary asset uploads. +Release GitHub writes use `putio-release-bot` for version sync commits, `v*` tags, GitHub Releases, binary asset uploads, and Homebrew tap formula commits. The app installation grants Contents read and write access to `putio-cli` and `homebrew-tap`; the Homebrew job mints an installation token scoped to those two repositories. The npm package uses Trusted Publishing from GitHub Actions. On npm, configure owner `putdotio`, repository `putio-cli`, workflow `ci.yml`, and Environment named `release` for the package. From 93a8e63bcfecfba74c52342b838834b9760edee9 Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 3 Aug 2026 12:40:01 +0300 Subject: [PATCH 2/3] fix(ci): use canonical bot noreply address --- .github/workflows/ci.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d379535..c272d60 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -290,6 +290,19 @@ jobs: homebrew-tap permission-contents: write + - name: Resolve Homebrew release bot user ID + id: homebrew-release-bot-user + env: + BOT_LOGIN: ${{ steps.homebrew-release-bot.outputs.app-slug }}[bot] + GH_TOKEN: ${{ steps.homebrew-release-bot.outputs.token }} + run: | + bot_user_id="$(gh api "/users/$BOT_LOGIN" --jq .id)" + if [[ ! "$bot_user_id" =~ ^[0-9]+$ ]]; then + echo "Expected a numeric GitHub App user ID" >&2 + exit 1 + fi + echo "user-id=$bot_user_id" >> "$GITHUB_OUTPUT" + - name: Release to Homebrew tap uses: Justintime50/homebrew-releaser@a62d7a359683bfc047cdb2431f53ee58241464d1 # v3 with: @@ -297,7 +310,7 @@ jobs: homebrew_tap: homebrew-tap github_token: ${{ steps.homebrew-release-bot.outputs.token }} commit_owner: ${{ steps.homebrew-release-bot.outputs.app-slug }}[bot] - commit_email: ${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]@users.noreply.github.com + commit_email: ${{ steps.homebrew-release-bot-user.outputs.user-id }}+${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]@users.noreply.github.com branch: main formula_folder: Formula install: 'bin.install "putio"' From 6f25fec11e35a64cedffce3e3fa5f21b2ea4652c Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 3 Aug 2026 13:02:23 +0300 Subject: [PATCH 3/3] refactor(ci): simplify bot identity lookup --- .github/workflows/ci.yml | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c272d60..99fe0ea 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -292,16 +292,9 @@ jobs: - name: Resolve Homebrew release bot user ID id: homebrew-release-bot-user + run: echo "user-id=$(gh api "/users/${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" env: - BOT_LOGIN: ${{ steps.homebrew-release-bot.outputs.app-slug }}[bot] GH_TOKEN: ${{ steps.homebrew-release-bot.outputs.token }} - run: | - bot_user_id="$(gh api "/users/$BOT_LOGIN" --jq .id)" - if [[ ! "$bot_user_id" =~ ^[0-9]+$ ]]; then - echo "Expected a numeric GitHub App user ID" >&2 - exit 1 - fi - echo "user-id=$bot_user_id" >> "$GITHUB_OUTPUT" - name: Release to Homebrew tap uses: Justintime50/homebrew-releaser@a62d7a359683bfc047cdb2431f53ee58241464d1 # v3