Skip to content

Publish to the tap and bucket with deploy keys #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imanimanyara merged 2 commits into from
Oct 19, 2026
Merged

Publish to the tap and bucket with deploy keys #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4ff3ce0
Publish to the tap and bucket with write deploy keys when set
imanimanyara Oct 19, 2026
0068501
Document the tap and bucket deploy keys in the release guide
imanimanyara Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,10 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# PAT with write access to the Homebrew tap + Scoop bucket repos.
TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
# Write deploy keys on simtabi/homebrew-tap and simtabi/scoop-bucket. When set, GoReleaser
# pushes with them and the token is not used for those two.
HOMEBREW_TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
SCOOP_BUCKET_DEPLOY_KEY: ${{ secrets.SCOOP_BUCKET_DEPLOY_KEY }}
# Sign a build-provenance attestation for every released artifact. The
# checksums file lists them all, so `gh attestation verify <file>
# --repo simtabi/probaci` works for any downloaded binary or archive.
Expand Down
12 changes: 12 additions & 0 deletions .goreleaser.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,12 @@ homebrew_casks:
# Cross-repo tap push needs a PAT (the default GITHUB_TOKEN is scoped to
# this repo). Set the TAP_GITHUB_TOKEN secret before releasing.
token: "{{ .Env.TAP_GITHUB_TOKEN }}"
# Write deploy key on simtabi/homebrew-tap (secret HOMEBREW_TAP_DEPLOY_KEY): reaches that
# one repository only. Set, git pushes with it; unset, the URL is empty and the token
# path above runs. Measured with GoReleaser 2.18.3.
git:
url: '{{ if envOrDefault "HOMEBREW_TAP_DEPLOY_KEY" "" }}git@github.com:simtabi/homebrew-tap.git{{ end }}'
private_key: '{{ envOrDefault "HOMEBREW_TAP_DEPLOY_KEY" "" }}'
commit_author:
name: Imani Manyara
email: imanimanyara@users.noreply.github.com
Expand All @@ -170,6 +176,12 @@ scoops:
name: scoop-bucket
branch: main
token: "{{ .Env.TAP_GITHUB_TOKEN }}"
# Write deploy key on simtabi/scoop-bucket (secret SCOOP_BUCKET_DEPLOY_KEY): reaches that
# one repository only. Set, git pushes with it; unset, the URL is empty and the token
# path above runs. Measured with GoReleaser 2.18.3.
git:
url: '{{ if envOrDefault "SCOOP_BUCKET_DEPLOY_KEY" "" }}git@github.com:simtabi/scoop-bucket.git{{ end }}'
private_key: '{{ envOrDefault "SCOOP_BUCKET_DEPLOY_KEY" "" }}'
commit_author:
name: Imani Manyara
email: imanimanyara@users.noreply.github.com
Expand Down
3 changes: 2 additions & 1 deletion docs/release.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,8 @@ Pure Go, `CGO_ENABLED=0`.
1. Make the repo public on GitHub.
2. Create the `pypi`/`npm`-equivalent here: a GitHub Release flow via OIDC (no
long-lived registry credentials).
3. Add `TAP_GITHUB_TOKEN` (Homebrew tap) and any registry tokens as needed.
3. Add the write deploy keys `HOMEBREW_TAP_DEPLOY_KEY` (on `simtabi/homebrew-tap`) and `SCOOP_BUCKET_DEPLOY_KEY` (on `simtabi/scoop-bucket`), each a repository secret that reaches its one repository and nothing else (`TAP_GITHUB_TOKEN` is only a fallback, and the
Winget pull request's token), plus any registry tokens as needed.
4. Cut `v0.1.0`.

The full org-wide gate is `/opensource/shipping-checklist.md` (local; not in any
Expand Down
Loading