From 3716be524bc99e16d6e7b19253f201d61094598f Mon Sep 17 00:00:00 2001 From: Ernesto Ongaro Date: Sat, 19 Sep 2026 13:02:30 +0100 Subject: [PATCH] Push Homebrew tap via scoped deploy key instead of personal PAT The release job checked out exploreomni/homebrew-tap with HOMEBREW_TAP_GITHUB_TOKEN, a classic PAT on a personal account created 2026-04-14 and never rotated. Despite the cosmetic `git config user.name "github-actions[bot]"`, every push event on the tap is authenticated as that human, and the PAT's scope spans every repo the account can write to. Swap it for an ed25519 deploy key scoped to the tap alone. This lets a ruleset on homebrew-tap require PRs for all actors while allowing the deploy key to bypass, so the release workflow remains the only thing that can write to main. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f43ae1c..78fe33e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,7 +34,7 @@ jobs: with: repository: exploreomni/homebrew-tap ref: main - token: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }} + ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }} path: homebrew-tap - name: Render Homebrew formula from release artifacts