Skip to content

ci(release): bez sondy tapa w PR-ach Dependabota #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mbeczynski merged 1 commit into from
Nov 7, 2026
Merged

ci(release): bez sondy tapa w PR-ach Dependabota #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions .github/test-release-workflow.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,9 +170,10 @@ for step in "Import signing certificate" "Tap token" "Check tap access" \
done

# The tap token is also taken on pull requests, on purpose: an app that lost
# its installation fails the PR, not the release. Never on a dry run from
# its installation fails the PR, not the release. Not on Dependabot PRs: they get
# Dependabot secrets only, without TAP_APP_KEY (2026-11-07). Never on a dry run from
# another branch - that branch's code has already run in earlier steps.
TAP_PROBE="env.IS_RELEASE == 'true' || github.event_name == 'pull_request'"
TAP_PROBE="env.IS_RELEASE == 'true' || (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')"
# Publishing steps that read no secret themselves: the gate that stops a build
# which changed tracked files, the release action (job token), git push with
# the tap checkout's credentials.
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,10 +319,11 @@ jobs:
# release: an app that lost its installation (or a missing key) fails
# the PR, not the release after the DMG is already published. Not on a
# dry run from another branch: its code has already run in the steps
# above and could read the token (2026-11-04).
# above and could read the token (2026-11-04). Not on Dependabot PRs:
# they get only Dependabot secrets, so TAP_APP_KEY is empty (2026-11-07).
- name: Tap token
id: tap-token
if: env.IS_RELEASE == 'true' || github.event_name == 'pull_request'
if: env.IS_RELEASE == 'true' || (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TAP_APP_CLIENT_ID }}
Expand All @@ -331,7 +332,7 @@ jobs:
repositories: homebrew-tap

- name: Check tap access
if: env.IS_RELEASE == 'true' || github.event_name == 'pull_request'
if: env.IS_RELEASE == 'true' || (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')
env:
TAP_TOKEN: ${{ steps.tap-token.outputs.token }}
run: git ls-remote "https://x-access-token:${TAP_TOKEN}@github.com/RenaCode/homebrew-tap.git" HEAD
Expand Down
Loading