Repository navigation
fix(release): repair Homebrew/WinGet publish auth for external-repo checkouts - #2164
Conversation
…heckouts (#2161) * fix(release): replace broken external-repo checkout auth for Homebrew/WinGet publish The publish-homebrew and publish-winget jobs used actions/checkout with a custom classic PAT against external repositories (bradygaster/homebrew-squad, microsoft/winget-pkgs, tamirdresher/winget-pkgs). This failed deterministically in the v1.0.0 release run (reproduced on rerun) with: fatal: could not read Username for 'https://github.com': terminal prompts disabled Root cause not fully isolated (token validity could not be checked from outside Actions), so this change removes the dependency on actions/checkout's token/includeIf mechanism entirely rather than guessing around it: - All three target repos are public, so the initial read/clone never actually needs authentication - switched to plain anonymous 'git clone'. - Push credentials (needed only for the later 'git push'/gh pr create steps) are now set via a local, non-global 'git config --local http.<url>.extraheader' scoped to just that one clone directory - never embedded in a remote URL, never printed, and cleaned up automatically when the job's workspace is discarded. - Added an explicit preflight step to each job that validates the relevant token via 'gh api user' and checks '.permissions.push' on the target repo before attempting any clone/push, so an actually-invalid/expired PAT fails fast with a clear, actionable error instead of surfacing as a confusing low-level git auth error. No changes to job graph, secrets, or permissions scopes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(release): keep actions/checkout for contract-tested steps, disable credential persistence The contract test (test/standalone-release-workflow.test.ts) asserts the Homebrew tap checkout and the 'Check out existing WinGet version branch' step remain real actions/checkout steps with specific with: fields (repository/ref/path/token) - replacing them with raw git clone broke that contract and failed the test job on PR #2161. Revert those two specific steps to actions/checkout, but add persist-credentials: false so the action does not attempt to write its own git credential config (the suspected source of the original 'could not read Username... terminal prompts disabled' failure). Credential configuration for the later git push is now done explicitly via a scoped, local-only http.extraheader in a separate step - never persisted globally, never logged, never embedded in a remote URL. The two clones that are not covered by the contract test (the read-only winget-base base clone and the new-branch clone from microsoft/winget-pkgs master) remain anonymous git clone, since no credential is needed to read these public repos. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <Copilot@users.noreply.github.com>
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 3 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ❌ | Branch up to date | main is 1 commit(s) ahead — rebase recommended |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | No source files changed — changeset not required |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | Merge status unknown — GitHub is still computing |
| ✅ | Copilot threads resolved | No Copilot review threads |
| ❌ | CI passing | 1 check(s) failing: test |
Files Changed (2 files, +126 −50)
| File | +/− |
|---|---|
.github/workflows/squad-standalone-release.yml |
+87 −38 |
test/standalone-release-workflow.test.ts |
+39 −12 |
Total: +126 −50
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
The Homebrew tap checkout previously used actions/checkout with 'token: secrets.HOMEBREW_TAP_TOKEN' and 'persist-credentials: false'. persist-credentials only controls whether the credential is scrubbed AFTER the step completes - it does not change how the step's own initial fetch authenticates. The real production failure (run 37104124444, job 111157909375) showed this exact checkout failing with 'fatal: could not read Username ... terminal prompts disabled' despite a valid, non-empty token (preflight passed) - meaning the prior persist-credentials:false change alone did not address the failing mechanism. bradygaster/homebrew-squad is a public repository, so the read-only clone does not need any credential at all. Replace the token-bearing actions/checkout with a plain anonymous 'git clone', and continue to configure the push credential as a locally-scoped git config entry (set only after the clone, only for the later push step) - this removes the token from the path that was actually failing while preserving scoped, non-persisted auth for the write operation. Root cause of the exact actions/checkout auth-setup failure itself remains unconfirmed (no definitive matching upstream report found); this change eliminates the observed failure path rather than claiming a confirmed upstream bug. Updates the standalone-release-workflow contract test to assert the new anonymous-clone + scoped-push-credential shape instead of the token-bearing checkout shape. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The 'Check out existing WinGet version branch' step (exercised only when re-publishing to an already-open version branch) used the same token-bearing actions/checkout + persist-credentials:false shape that was just shown to be unreliable for the Homebrew tap checkout. This exact path has never been exercised by a real production run (the only successful standalone-release run on record predates this branch-reuse code and always took the branch_exists=false path), so it carries the same latent risk without any positive evidence it works. tamirdresher/winget-pkgs is a public fork, so apply the identical fix: anonymous git clone for the read, scoped local push credential configured afterward only for the subsequent push. Update the matching contract test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
@bradygaster — Release follow-up: exact remaining action Please review and approve this PR, which brings the external-repository Homebrew/WinGet publishing authentication repair onto Once approved, we can complete the normal merge and run the existing distribution recovery for Homebrew 1.0.0 is already shipped: bradygaster/homebrew-squad@bc3f903 . npm CLI/SDK and the GitHub release assets are published. The WinGet 1.0.0 manifests are verified and pushed: https://github.com/tamirdresher/winget-pkgs/tree/bradygaster-squad-1.0.0 . Opening the upstream PR is separately blocked by Microsoft organization SAML authorization of my existing OAuth credential. That is an action for me, not another approval required from you. We will share the actual upstream PR URL after submission; WinGet is not yet complete. |
|
@bradygaster — the remaining WinGet submission is now open: microsoft/winget-pkgs#446257. It contains only the three Squad 1.0.0 manifests. Local WinGet validation passed; upstream PR validation and CLA are already passing. The remaining upstream manifest, installer, and installation checks are pending. This is submitted, not yet merged/published in the WinGet catalog. Current 1.0.0 channel links:
The activation-pin PR #2163 is merged. This PR (#2164) still needs your independent review for the main-branch publishing automation repair. The expanded announcement draft already covers changes since v0.13.1; the tagged detailed notes are https://github.com/bradygaster/squad/tree/v1.0.0/.changeset . |
Closes github#2165. Merge latest main after independently approved github#2164 standalone-auth workflow fix; no dev promotion or additional product changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Summary
Ports the already-merged
devfix (#2161, squash commit8c0311c3) ontomain, then corrects a gap found during root-cause verification against the real production failure logs, so the standalone release workflow's Homebrew/WinGet publish jobs no longer depend on a brokenactions/checkoutauth path for external-repo checkouts.Problem (confirmed from real production run, not just contract-test shape)
The actual failing run was
37104124444(triggered by #2154's push tomain, 2026-10-03T06:46:06Z):111157909325failed at the "winget-base" read-only clone ofmicrosoft/winget-pkgswithfatal: could not read Username for 'https://github.com': terminal prompts disabled.111157909375failed identically at its sole checkout step (bradygaster/homebrew-squad), despitepersist-credentials: true— proving the failure is not simply apersist-credentialsvalue issue. Verbose logs showactions/checkoutDID attempt to configure the token as anhttp.extraheaderbefore the fetch, yet the fetch still behaved as unauthenticated. The exact upstream mechanism is not confirmed (no definitive matchingactions/checkoutissue found); this PR eliminates the observed failure path rather than claiming a confirmed upstream root cause.Fix (two commits)
fa4652ba(original fix(release): repair Homebrew/WinGet publish auth for external-repo checkouts #2161 cherry-pick): added preflight token-validation steps and setpersist-credentials: falseon the external checkouts. This alone was insufficient —persist-credentialsonly controls whether the credential is scrubbed after the step, not how the step's own initial fetch authenticates, so the token-bearingactions/checkoutcall was still exercising the same failing mechanism.a785b2d6+9ae555a8(this review cycle, added after re-verifying against the real failure logs): replaced the token-bearingactions/checkoutfor both external, publicly-readable repos (bradygaster/homebrew-squad,tamirdresher/winget-pkgs) with plain anonymousgit clone. The publish token is now configured as a scoped--localhttp.extraheaderonly after the anonymous clone, and only for the subsequent push — never passed to the step that was actually failing. Applied consistently to both the Homebrew tap checkout and the WinGet "existing version branch" reuse path (same latent risk, never previously exercised by a real run).microsoft/winget-pkgs"winget-base" read-only clone (new-branch path) was already using anonymous clone prior to this PR and is unaffected.Validation
test/standalone-release-workflow.test.ts) updated to assert the anonymous-clone + scoped-local-push-credential shape (and explicitly assert the token is never passed to the read-only clone step). All 32 tests in the file pass.gh-aw strict compile,Policy Gates,samples-build,sdk-exports-validation,Changeset Drift,Lint,readiness,test— all green on head9ae555a8.Not yet proven (honest status)
actions/checkoutauth-setup bug mechanism is not confirmed — this fix sidesteps it rather than explains it.squad-standalone-release.ymlworkflow against the existingv1.0.0tag, post-merge, is the only way to get a final confirmed-working receipt for both Homebrew and WinGet automation. The Homebrew v1.0.0 cask itself is already live (shipped via a separate manual path, independently hash-verified) — this PR is about making the automation for future releases reliable, not about the already-shipped v1.0.0 artifact.Closes the Homebrew/WinGet publish-auth gap on
mainahead of re-running the standalone release workflow for future releases.