Skip to content

docs: describe the tap deploy key instead of the retired PAT #103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ernestoongaro wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: describe the tap deploy key instead of the retired PAT #103

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion DEVELOPMENT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,8 @@ The phase-1 tap formula is intentionally separate from the eventual `homebrew/co
For the release workflow to publish the tap formula, the following must be in place:

- The public tap repo `exploreomni/homebrew-tap` exists with `main` as its default branch.
- The `HOMEBREW_TAP_GITHUB_TOKEN` secret is set on the `exploreomni/cli` repo. This token needs `contents:write` access to `exploreomni/homebrew-tap` so GitHub Actions can update the tap from the release workflow.
- The `HOMEBREW_TAP_DEPLOY_KEY` secret is set on the `exploreomni/cli` repo, holding the private half of an ed25519 deploy key. The public half is registered on `exploreomni/homebrew-tap` with write access, so GitHub Actions can update the tap from the release workflow. The key is scoped to the tap alone — it grants nothing anywhere else.
- The tap's `protect-main` ruleset requires pull requests on `main` and lists deploy keys as a bypass actor, so the release workflow is the only thing that can push to it directly.

### What Gets Built

Expand Down
Loading