ci(release): authenticate Homebrew tap push with HOMEBREW_TAP_TOKEN#21
Merged
Conversation
The "Bump Homebrew formula" step failed with 403: changesets/action writes ~/.netrc with the repo-scoped GITHUB_TOKEN, so the bare git push authenticated as github-actions[bot], which has no access to getbrevo/homebrew-tap. Remove the stale netrc and run gh auth setup-git before pushing so git resolves credentials through gh from GH_TOKEN (the tap PAT) — keeping the token out of argv, the remote URL, and on-disk config. Also document the changeset policy in AGENTS.md and CLAUDE.md: keep one pending changeset file per branch/PR — append new change details to it (raising the bump level if needed) instead of creating additional files. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bump Homebrew formulastep failing with403: Permission to getbrevo/homebrew-tap.git denied to github-actions[bot]on the 1.1.1 release run:changesets/actionwrites~/.netrccontaining the repo-scopedGITHUB_TOKEN, so the baregit pushto the tap authenticated asgithub-actions[bot](which has no access to the tap) instead of usingHOMEBREW_TAP_TOKEN. The step now removes the stale netrc and runsgh auth setup-gitbefore pushing, so git resolves credentials throughghfromGH_TOKEN(the tap PAT) — still keeping the token out of argv, the remote URL, and on-disk config.AGENTS.mdandCLAUDE.md: keep one pending changeset file per branch/PR — append new change details to it (raising the bump level if needed) instead of creating additional files.Notes for reviewers
release.yamlsecurity invariants are untouched: action SHA pins,persist-credentials: false, OIDC/no-NPM_TOKENpublish auth, andHOMEBREW_TAP_TOKENscoping are all unchanged. The fix only affects how the existing PAT reachesgit push.~/.netrcis safe — the bump step is the job's last step, and every other step authenticates via env tokens, not netrc.HOMEBREW_TAP_TOKENhasn't hit its expiry and still has contents + pull-requests write on the tap (an expired token would surface as a 401 on the next run).agent-context/SKILL.md/agent-context/AGENTS.mduntouched (no CLI surface change).🤖 Generated with Claude Code