Skip to content

fix(ci): use release bot for Homebrew tap #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
altaywtf merged 3 commits into from
Aug 3, 2026
Merged

fix(ci): use release bot for Homebrew tap #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9ee397b
fix(ci): use release bot for Homebrew tap
altaywtf Aug 3, 2026
93a8e63
fix(ci): use canonical bot noreply address
altaywtf Aug 3, 2026
6f25fec
refactor(ci): simplify bot identity lookup
altaywtf Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,14 +278,32 @@ jobs:
contents: read

steps:
- name: Create Homebrew release bot token
id: homebrew-release-bot
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.PUTIO_RELEASE_BOT_CLIENT_ID }}
private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
owner: putdotio
repositories: |
putio-cli
homebrew-tap
permission-contents: write

- name: Resolve Homebrew release bot user ID
id: homebrew-release-bot-user
run: echo "user-id=$(gh api "/users/${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
env:
GH_TOKEN: ${{ steps.homebrew-release-bot.outputs.token }}

- name: Release to Homebrew tap
uses: Justintime50/homebrew-releaser@a62d7a359683bfc047cdb2431f53ee58241464d1 # v3
with:
homebrew_owner: putdotio
homebrew_tap: homebrew-tap
github_token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
commit_owner: devsputio
commit_email: devs@put.io
github_token: ${{ steps.homebrew-release-bot.outputs.token }}
commit_owner: ${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]
commit_email: ${{ steps.homebrew-release-bot-user.outputs.user-id }}+${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]@users.noreply.github.com
branch: main
formula_folder: Formula
install: 'bin.install "putio"'
Expand Down
4 changes: 2 additions & 2 deletions docs/DISTRIBUTION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,13 +20,13 @@ Release jobs declare the protected GitHub Environment named `release`.

Environment entries:

- secrets: `PUTIO_RELEASE_BOT_PRIVATE_KEY`, `HOMEBREW_TAP_TOKEN`
- secrets: `PUTIO_RELEASE_BOT_PRIVATE_KEY`
- variables: `PUTIO_RELEASE_BOT_CLIENT_ID`
- approval: none; releases are continuous after the `main` gate passes
- refs: release branch/tag policy constrains what can publish
- deployment records: disabled with `deployment: false` because this is package publishing, not an app deploy

Release GitHub writes use `putio-release-bot` for version sync commits, `v*` tags, GitHub Releases, and binary asset uploads.
Release GitHub writes use `putio-release-bot` for version sync commits, `v*` tags, GitHub Releases, binary asset uploads, and Homebrew tap formula commits. The app installation grants Contents read and write access to `putio-cli` and `homebrew-tap`; the Homebrew job mints an installation token scoped to those two repositories.

The npm package uses Trusted Publishing from GitHub Actions. On npm, configure owner `putdotio`, repository `putio-cli`, workflow `ci.yml`, and Environment named `release` for the package.

Expand Down