Switch tap bump to the dedicated tap-writer runner #46

New issue

Closed

opened 2026-06-04 01:04:15 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-04 01:04:15 +00:00

Owner

Rewrite bump-tap-formula in .github/workflows/release.yml to run on the dedicated tap-writer runner. Companion to coilyco-flight-deck/infrastructure#194. Implemented in PR #47.

Background

Ward installs from the centralized flight-deck tap (brew install coilyco-flight-deck/tap/ward). On each release, the formula in coilyco-flight-deck/homebrew-tap has to be repointed at the new tag + revision. That is a cross-repo write, which the job's auto-issued token cannot do. The earlier version on main used the Forgejo Contents API with a FORGEJO_TOKEN Actions secret. This replaces that with the runner-side credential model from infrastructure#194, so no token lands in the job env or the Actions secret store.

Change

runs-on: tap-writer (host executor, no node), so the job is pure shell: git clone the tag, awk-rewrite the formula url line, git push.
Auth comes from the runner's git credential helper. The job references no secrets.*.
The in-repo bump-formula job and Formula/ward.rb fallback are untouched, so the old per-repo tap keeps resolving for one migration cycle.

Sequencing

Merge AFTER infrastructure#194 is applied. The tap-writer runner must exist or this job waits forever for that label. Until then ward releases still tag, cut a GH release, and bump the in-repo fallback, so installs and upgrades keep working.

Follow-up (next cycle)

Once the central tap is the only install path, drop the bump-formula job and Formula/ward.rb from this repo. Tracked at the close of the migration started in #45.

closes #46 via #47

Rewrite `bump-tap-formula` in `.github/workflows/release.yml` to run on the dedicated `tap-writer` runner. Companion to coilyco-flight-deck/infrastructure#194. Implemented in PR #47. ## Background Ward installs from the centralized flight-deck tap (`brew install coilyco-flight-deck/tap/ward`). On each release, the formula in coilyco-flight-deck/homebrew-tap has to be repointed at the new tag + revision. That is a cross-repo write, which the job's auto-issued token cannot do. The earlier version on `main` used the Forgejo Contents API with a `FORGEJO_TOKEN` Actions secret. This replaces that with the runner-side credential model from infrastructure#194, so no token lands in the job env or the Actions secret store. ## Change - `runs-on: tap-writer` (host executor, no node), so the job is pure shell: git clone the tag, awk-rewrite the formula `url` line, git push. - Auth comes from the runner's git credential helper. The job references no `secrets.*`. - The in-repo `bump-formula` job and `Formula/ward.rb` fallback are untouched, so the old per-repo tap keeps resolving for one migration cycle. ## Sequencing Merge AFTER infrastructure#194 is applied. The `tap-writer` runner must exist or this job waits forever for that label. Until then ward releases still tag, cut a GH release, and bump the in-repo fallback, so installs and upgrades keep working. ## Follow-up (next cycle) Once the central tap is the only install path, drop the `bump-formula` job and `Formula/ward.rb` from this repo. Tracked at the close of the migration started in #45. closes #46 via #47

~~coilysiren referenced this issue from coilyco-flight-deck/infrastructure 2026-06-04 01:04:52 +00:00~~

feat: tap-writer runner + tap-bump token provisioning #195

coilysiren referenced this issue from a commit

2026-06-04 01:05:03 +00:00

ci: run tap bump on the dedicated tap-writer runner

coilysiren referenced this issue from a pull request that will close it,

2026-06-04 01:05:13 +00:00

ci: run tap bump on the dedicated tap-writer runner #47

coilysiren referenced this issue from coilyco-flight-deck/infrastructure

2026-06-04 01:08:08 +00:00

Add tap-writer Forgejo runner + tap-bump token provisioning #194

coilysiren added the