Push the tap and bucket with deploy keys, not a PAT - #117
Merged
Merged
Conversation
Homebrew and Scoop are the two channels we own outright, so they are the two we can actually turn on without waiting for anyone. Both repos already existed (profullstack/homebrew-tap, profullstack/scoop-bucket) and both now carry a write deploy key titled "tronbrowser release automation", with the private half stored as HOMEBREW_TAP_SSH_KEY and SCOOP_BUCKET_SSH_KEY. A deploy key rather than a PAT. A PAT carries the whole account, so any token able to push to the tap could also push to every other repo; GitHub has no API to mint one, so it would have to be pasted in by hand and rotated by hand. A deploy key is scoped to one repository, can be created through the API, and is revoked by deleting it from that repo. Two details the first real push turned up. The tap keeps Casks/ for nightcell7 and had no Formula/ at all, and distribution/homebrew/tronbrowser.rb is a Formula, so the push has to create the directory; a tap carries both quite happily. And the bucket needed the same mkdir -p treatment for its first entry. Verified by pushing for real: tronbrowser 3.15.1 is live in both repos, and the Formula's linux sha256 matches the published v3.15.1 tarball byte for byte. `brew install profullstack/tap/tronbrowser` now resolves, which it never has before. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
ThreatCrush Security Scan52 finding(s) HIGH/CRITICAL: 3 | MEDIUM: 28 | LOW: 21
…and 2 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Homebrew and Scoop are the two channels we own outright, so they are the two that can be turned on without waiting on anyone.
Both repos already existed (
profullstack/homebrew-tap,profullstack/scoop-bucket). Both now carry a write deploy key titled "tronbrowser release automation", with the private half stored asHOMEBREW_TAP_SSH_KEYandSCOOP_BUCKET_SSH_KEYon this repo.Why a deploy key and not a PAT. A PAT carries the whole account, so any token able to push to the tap could push anywhere else too. GitHub has no API to mint one, so it would have to be pasted in by hand and rotated by hand. A deploy key is scoped to a single repository, can be created through the API, and is revoked by deleting it from that repo.
Two things the first real push turned up:
Casks/(for nightcell7) and had noFormula/at all.distribution/homebrew/tronbrowser.rbis a Formula, so the push has to create that directory — a tap carries both happily.mkdir -pfor its first entry.Verified by actually pushing
tronbrowser 3.15.1 is live in both repos now, and the Formula's linux
sha256matches the published v3.15.1 tarball byte for byte (fd102dbb…7130).brew install profullstack/tap/tronbrowserresolves for the first time.🤖 Generated with Claude Code