Fix Homebrew tap publishing: master→main, fine-grained PAT diagnosis, manual dispatch#27
Merged
Merged
Conversation
The CI was pushing to refs/heads/master in execsumo/homebrew-heard, but that repo's default branch is main — so v0.2.0, v0.2.1, and v0.2.2 never reached brew users (tap is still on 0.1.0). Fixes: change tap push target to refs/heads/main. Adds: update-tap.yml workflow_dispatch so the 0.2.2 gap can be closed immediately without cutting a new release. https://claude.ai/code/session_017hkC9vmFd9ejBQNxzBfcWP
Industry standard since GitHub changed its default in 2020. Updates ci.yml (comment + push target), release.sh (branch check + push), and CLAUDE.md (docs reference). Note: the GitHub repo's default branch also needs renaming in Settings → Branches. Until then, release.sh will reject runs on the old master branch. https://claude.ai/code/session_017hkC9vmFd9ejBQNxzBfcWP
git push via PAT was hitting a 403 despite correct repo scope. Switching to the Contents API (curl PUT) avoids the git auth path entirely — same token, different mechanism. https://claude.ai/code/session_017hkC9vmFd9ejBQNxzBfcWP
The REST API switch was a non-fix: it reuses the same GH_PAT and hits the identical 403 permission check, so it could never resolve the push denial. Reverted ci.yml back to the git-push path. Added a diagnostic step to update-tap.yml that prints the stored secret's actual scopes (x-oauth-scopes), authenticated login, and .permissions on homebrew-heard — so the next run reveals whether the secret can write, rather than us guessing. https://claude.ai/code/session_017hkC9vmFd9ejBQNxzBfcWP
Root cause was a fine-grained PAT in the GH_PAT secret without Contents: write on homebrew-heard. Token updated; tap now publishes 0.2.2. Diagnostic is no longer needed. https://claude.ai/code/session_017hkC9vmFd9ejBQNxzBfcWP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
refs/heads/masterinexecsumo/homebrew-heard, but that repo's default branch ismain. Every release since v0.2.0 silently pushed to a dead branch; the tap stayed on 0.1.0.master→mainthroughoutci.yml,release.sh, andCLAUDE.mdto match the repo rename and industry standard.update-tap.yml— manualworkflow_dispatchworkflow to publish any version to the tap without cutting a full release. Used to close the 0.1.0 → 0.2.2 gap immediately.The tap is already updated to 0.2.2 (workflow ran successfully after the root-cause
GH_PATtoken was corrected — the stored secret was a fine-grained PAT without Contents:write onhomebrew-heard).Test plan
update-tap.ymlran successfully andexecsumo/homebrew-heardnow shows version 0.2.2ci.ymlrelease job pushes torefs/heads/mainon the next releaseGenerated by Claude Code