ci: run tap bump on the dedicated tap-writer runner #61

Merged

coilysiren merged 1 commit from feat/tap-writer-bump-v2 into main

2026-06-06 22:01:01 +00:00

coilysiren commented

2026-06-06 21:57:13 +00:00

Owner

Rewrite bump-tap-formula in the Forgejo release pipeline to target the dedicated tap-writer runner, replacing the Contents-API write that used a FORGEJO_TOKEN Actions secret.

Replaces #47

PR #47 was authored against .github/workflows/release.yml, before #55 migrated the release pipeline to Forgejo Actions. That file no longer exists on main (the pipeline now lives at .forgejo/workflows/release.yml), so #47 no longer applies. This re-cuts the same change against the current workflow. Close #47 in favor of this.

What

runs-on: tap-writer (host executor, no node), so the job is pure shell: git clone the tag, awk-rewrite the formula url line, git push.
Auth comes from the runner's git credential helper - no secrets.*, no FORGEJO_TOKEN, no token in the job env or logs.
Skips the push when the formula is already at the tag.
The in-repo bump-formula fallback and Formula/ward.rb are untouched, so ward installs/upgrades keep working this cycle.

Sequencing

The companion infrastructure#195 is already merged, so the tap-writer runner and /forgejo/ci-release-token it reads exist. This is safe to merge now. If the runner is not yet registered with the tap-writer:host label, the job waits for that label while the in-repo fallback keeps installs working.

Follow-up (next cycle)

Once the central tap is the only install path, drop the bump-formula job and Formula/ward.rb (tracked at the close of the migration from #45).

closes #46

🤖 Generated with Claude Code

Rewrite `bump-tap-formula` in the Forgejo release pipeline to target the dedicated `tap-writer` runner, replacing the Contents-API write that used a `FORGEJO_TOKEN` Actions secret. ## Replaces #47 PR #47 was authored against `.github/workflows/release.yml`, before #55 migrated the release pipeline to Forgejo Actions. That file no longer exists on `main` (the pipeline now lives at `.forgejo/workflows/release.yml`), so #47 no longer applies. This re-cuts the same change against the current workflow. **Close #47 in favor of this.** ## What - `runs-on: tap-writer` (host executor, no node), so the job is pure shell: git clone the tag, awk-rewrite the formula `url` line, git push. - Auth comes from the runner's git credential helper - no `secrets.*`, no `FORGEJO_TOKEN`, no token in the job env or logs. - Skips the push when the formula is already at the tag. - The in-repo `bump-formula` fallback and `Formula/ward.rb` are untouched, so ward installs/upgrades keep working this cycle. ## Sequencing The companion **infrastructure#195 is already merged**, so the `tap-writer` runner and `/forgejo/ci-release-token` it reads exist. This is safe to merge now. If the runner is not yet registered with the `tap-writer:host` label, the job waits for that label while the in-repo fallback keeps installs working. ## Follow-up (next cycle) Once the central tap is the only install path, drop the `bump-formula` job and `Formula/ward.rb` (tracked at the close of the migration from #45). closes #46 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilysiren added 1 commit

2026-06-06 21:57:13 +00:00

ci: run tap bump on the dedicated tap-writer runner e5c4bea3c4

Rewrite bump-tap-formula in the Forgejo release pipeline to target the
dedicated tap-writer runner instead of writing the centralized homebrew-tap
via the Contents API + FORGEJO_TOKEN Actions secret.

- runs-on: tap-writer (host executor, no node), so the job is pure shell:
  git clone the tag, awk-rewrite the formula url line, git push.
- Auth comes from the runner's git credential helper. The job references
  no secrets.* and no token reaches its env or logs.
- Skips the push when the formula is already at the tag.

The tap-writer runner and its token were provisioned by the now-merged
infrastructure#195. The in-repo bump-formula fallback and Formula/ward.rb
are untouched, so ward installs/upgrades keep working this cycle.

Supersedes #47, which was authored against the pre-Forgejo-migration
.github/workflows/release.yml and no longer applies after the release
pipeline moved to .forgejo/workflows/release.yml.

closes #46

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coilysiren referenced this pull request

2026-06-06 21:58:07 +00:00

ci: run tap bump on the dedicated tap-writer runner #47

coilysiren merged commit 9948b8301f into main

2026-06-06 22:01:01 +00:00

coilysiren referenced this pull request from a commit

2026-06-06 22:01:03 +00:00

Merge pull request 'ci: run tap bump on the dedicated tap-writer runner' (#61) from feat/tap-writer-bump-v2 into main