Skip to content

fix(release): repair Homebrew/WinGet publish auth for external-repo checkouts #2161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tamirdresher merged 2 commits into from
Oct 3, 2026
Merged

fix(release): repair Homebrew/WinGet publish auth for external-repo checkouts #2161

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
47a1b74
fix(release): replace broken external-repo checkout auth for Homebrew…
Copilot Oct 3, 2026
8d95301
fix(release): keep actions/checkout for contract-tested steps, disabl…
Oct 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
98 changes: 75 additions & 23 deletions .github/workflows/squad-standalone-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -429,6 +429,23 @@ jobs:
exit 1
fi

- name: Preflight - verify Homebrew tap token
env:
GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
run: |
set -euo pipefail
login="$(gh api user --jq '.login')" || {
echo "::error::HOMEBREW_TAP_TOKEN failed to authenticate against the GitHub API. The token is likely invalid, expired, or revoked and must be rotated by a maintainer with write access to bradygaster/homebrew-squad."
exit 1
}
echo "Authenticated as: ${login}"
push_access="$(gh api repos/bradygaster/homebrew-squad --jq '.permissions.push // false')"
echo "Push access to bradygaster/homebrew-squad: ${push_access}"
if [ "${push_access}" != "true" ]; then
echo "::error::HOMEBREW_TAP_TOKEN authenticates as '${login}', but that account/token does not have push access to bradygaster/homebrew-squad."
exit 1
fi

- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8
with:
name: packaging-manifests
Expand All @@ -439,9 +456,17 @@ jobs:
repository: bradygaster/homebrew-squad
ref: main
path: homebrew-tap
fetch-depth: 1
token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
persist-credentials: true
persist-credentials: false

- name: Configure Homebrew tap push credential (scoped locally; checkout does not persist it)
env:
TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
working-directory: homebrew-tap
run: |
set -euo pipefail
auth_header="Authorization: basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 -w0)"
git config --local http.https://github.com/.extraheader "${auth_header}"

- name: Publish cask to the tap
env:
Expand Down Expand Up @@ -571,6 +596,23 @@ jobs:
exit 1
fi

- name: Preflight - verify WinGet publish token
env:
GH_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
run: |
set -euo pipefail
login="$(gh api user --jq '.login')" || {
echo "::error::WINGET_CREATE_GITHUB_TOKEN failed to authenticate against the GitHub API. The token is likely invalid, expired, or revoked and must be rotated by a maintainer with push access to tamirdresher/winget-pkgs."
exit 1
}
echo "Authenticated as: ${login}"
push_access="$(gh api repos/tamirdresher/winget-pkgs --jq '.permissions.push // false')"
echo "Push access to tamirdresher/winget-pkgs: ${push_access}"
if [ "${push_access}" != "true" ]; then
echo "::error::WINGET_CREATE_GITHUB_TOKEN authenticates as '${login}', but that account/token does not have push access to tamirdresher/winget-pkgs."
exit 1
fi

- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8
with:
name: packaging-manifests
Expand Down Expand Up @@ -609,15 +651,14 @@ jobs:
echo "package_identifier=${PACKAGE_IDENTIFIER}" >> "${GITHUB_OUTPUT}"
echo "package_root=${package_root}" >> "${GITHUB_OUTPUT}"

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7
with:
repository: microsoft/winget-pkgs
ref: master
path: winget-base
fetch-depth: 1
sparse-checkout: ${{ steps.release.outputs.package_root }}
token: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
persist-credentials: false
- name: Clone WinGet manifests directory (read-only, public repo; no credential needed)
env:
PACKAGE_ROOT: ${{ steps.release.outputs.package_root }}
run: |
set -euo pipefail
git clone --no-checkout --depth 1 --branch master --filter=blob:none https://github.com/microsoft/winget-pkgs.git winget-base
git -C winget-base sparse-checkout set "${PACKAGE_ROOT}"
git -C winget-base checkout master

- name: Check WinGet publication state
id: guard
Expand Down Expand Up @@ -709,22 +750,33 @@ jobs:
repository: tamirdresher/winget-pkgs
ref: ${{ steps.release.outputs.branch }}
path: winget-pkgs
token: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
persist-credentials: false
fetch-depth: 1
sparse-checkout: ${{ steps.release.outputs.package_root }}
token: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
persist-credentials: true

- name: Check out WinGet master for a new version branch
- name: Configure existing-branch push credential (scoped locally; checkout does not persist it)
if: steps.guard.outputs.skip == 'false' && steps.guard.outputs.branch_exists == 'true'
env:
TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
working-directory: winget-pkgs
run: |
set -euo pipefail
auth_header="Authorization: basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 -w0)"
git config --local http.https://github.com/.extraheader "${auth_header}"

- name: Clone WinGet master for a new version branch (credential scoped locally for the later push)
if: steps.guard.outputs.skip == 'false' && steps.guard.outputs.branch_exists == 'false'
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7
with:
repository: microsoft/winget-pkgs
ref: master
path: winget-pkgs
fetch-depth: 1
sparse-checkout: ${{ steps.release.outputs.package_root }}
token: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
persist-credentials: true
env:
TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
PACKAGE_ROOT: ${{ steps.release.outputs.package_root }}
run: |
set -euo pipefail
git clone --no-checkout --depth 1 --branch master --filter=blob:none https://github.com/microsoft/winget-pkgs.git winget-pkgs
git -C winget-pkgs sparse-checkout set "${PACKAGE_ROOT}"
git -C winget-pkgs checkout master
auth_header="Authorization: basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 -w0)"
git -C winget-pkgs config --local http.https://github.com/.extraheader "${auth_header}"

- name: Push manifests and open upstream PR
if: steps.guard.outputs.skip == 'false'
Expand Down
Loading