From 8306595fc51cadd24fa2eec9c52b526e37d76233 Mon Sep 17 00:00:00 2001 From: Marcel Jacek <72880145+marceljk@users.noreply.github.com> Date: Fri, 6 Nov 2026 08:12:28 +0100 Subject: [PATCH 1/4] fix(release): use built-in GITHUB_TOKEN in release pipeline --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index c10301e79..3c7e1cd7b 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -78,7 +78,7 @@ jobs: with: args: release --clean env: - GITHUB_TOKEN: ${{ secrets.CLI_RELEASE }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }} GPG_KEY_PATH: ${{ env.GPG_KEY_PATH }} # nfpm-rpm signing needs this env to be set. From 985b6a3b3c6a4ab1b6af142d84b3e9ab8e6fb2bd Mon Sep 17 00:00:00 2001 From: Marcel Jacek <72880145+marceljk@users.noreply.github.com> Date: Fri, 6 Nov 2026 16:05:43 +0100 Subject: [PATCH 2/4] feat: create homebrew cask updates via pull requests from a fork --- .github/workflows/release.yaml | 41 +++++++++++++++++++++++++++++++++- .goreleaser.yaml | 12 ++++++++-- 2 files changed, 50 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 3c7e1cd7b..b16829bc1 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -72,18 +72,57 @@ jobs: AUTHKEY_BASE64: ${{ secrets.APPLE_API_KEY }} - name: Install Snapcraft uses: samuelmeuli/action-snapcraft@v3 - + + - name: Ensure tap fork exists + run: | + gh repo fork stackitcloud/homebrew-tap \ + --fork-name homebrew-tap-fork \ + --clone=false || true + env: + GH_TOKEN: ${{ secrets.CLI_RELEASE }} + - name: Run GoReleaser uses: goreleaser/goreleaser-action@v7.3.0 with: args: release --clean env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + HOMEBREW_RELEASE_TOKEN: ${{ secrets.CLI_RELEASE }} GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }} GPG_KEY_PATH: ${{ env.GPG_KEY_PATH }} # nfpm-rpm signing needs this env to be set. NFPM_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + - name: Create issue tracking upstream Homebrew PR + run: | + # Wait a moment for GitHub's search index to catch up + sleep 5 + + # Find the open PR authored by your account in the upstream repository + PR_URL=$(gh pr list \ + --repo stackitcloud/homebrew-tap \ + --author "@me" \ + --state open \ + --search "${{ github.ref_name }}" \ + --limit 1 \ + --json url \ + --jq '.[0].url') + + if [ -n "$PR_URL" ] && [ "$PR_URL" != "null" ]; then + gh issue create \ + --repo "${{ github.repository }}" \ + --title "Homebrew Cask PR opened for ${{ github.ref_name }}" \ + --body "A pull request has been automatically created for release **${{ github.ref_name }}**: + + - **PR:** $PR_URL + - **Upstream:** \`stackitcloud/homebrew-tap:main\` + - **Branch:** \`${{ github.ref_name }}\`" + else + echo "Warning: Could not find an open PR in stackitcloud/homebrew-tap matching release ${{ github.ref_name }}." + fi + env: + GH_TOKEN: ${{ secrets.CLI_RELEASE }} + - name: Clean up GPG key file if: always() run: | diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 22155c8a7..882b55ee2 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -133,8 +133,16 @@ homebrew_casks: - name: stackit directory: Casks repository: - owner: stackitcloud - name: homebrew-tap + owner: stackit-pipeline + name: homebrew-tap-fork + token: "{{ .Env.HOMEBREW_RELEASE_TOKEN }}" + branch: "{{.ProjectName}}-{{.Version}}" + pull_request: + enabled: true + base: + owner: stackitcloud + name: homebrew-tap + branch: main commit_author: name: CLI Release Bot email: noreply@stackit.de From a6248018ff174c639d9147208f7b85b9e089f44b Mon Sep 17 00:00:00 2001 From: Marcel Jacek <72880145+marceljk@users.noreply.github.com> Date: Fri, 6 Nov 2026 16:53:53 +0100 Subject: [PATCH 3/4] simplify issue creation --- .github/workflows/release.yaml | 37 +++++++++------------------------- .goreleaser.yaml | 1 + 2 files changed, 10 insertions(+), 28 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index b16829bc1..82c99af7c 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -14,6 +14,7 @@ on: # GitHub considers creating releases and uploading assets as writing contents. permissions: contents: write + issues: write jobs: goreleaser: @@ -75,6 +76,7 @@ jobs: - name: Ensure tap fork exists run: | + # Create fork with suffix `-fork` to indicate that the repo in the technical user are just a fork gh repo fork stackitcloud/homebrew-tap \ --fork-name homebrew-tap-fork \ --clone=false || true @@ -86,42 +88,21 @@ jobs: with: args: release --clean env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ github.token }} HOMEBREW_RELEASE_TOKEN: ${{ secrets.CLI_RELEASE }} GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }} GPG_KEY_PATH: ${{ env.GPG_KEY_PATH }} # nfpm-rpm signing needs this env to be set. NFPM_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - - name: Create issue tracking upstream Homebrew PR + - name: Create issue to inform about Homebrew PR run: | - # Wait a moment for GitHub's search index to catch up - sleep 5 - - # Find the open PR authored by your account in the upstream repository - PR_URL=$(gh pr list \ - --repo stackitcloud/homebrew-tap \ - --author "@me" \ - --state open \ - --search "${{ github.ref_name }}" \ - --limit 1 \ - --json url \ - --jq '.[0].url') - - if [ -n "$PR_URL" ] && [ "$PR_URL" != "null" ]; then - gh issue create \ - --repo "${{ github.repository }}" \ - --title "Homebrew Cask PR opened for ${{ github.ref_name }}" \ - --body "A pull request has been automatically created for release **${{ github.ref_name }}**: - - - **PR:** $PR_URL - - **Upstream:** \`stackitcloud/homebrew-tap:main\` - - **Branch:** \`${{ github.ref_name }}\`" - else - echo "Warning: Could not find an open PR in stackitcloud/homebrew-tap matching release ${{ github.ref_name }}." - fi + gh issue create \ + --repo "${{ github.repository }}" \ + --title "Homebrew Cask PR opened for ${{ github.ref_name }}" \ + --body "A pull request has been automatically created for release **${{ github.ref_name }}**" env: - GH_TOKEN: ${{ secrets.CLI_RELEASE }} + GH_TOKEN: ${{ github.token }} - name: Clean up GPG key file if: always() diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 882b55ee2..c6a08973a 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -133,6 +133,7 @@ homebrew_casks: - name: stackit directory: Casks repository: + # Update of the homebrew cask is created via a fork of the homebrew tap owner: stackit-pipeline name: homebrew-tap-fork token: "{{ .Env.HOMEBREW_RELEASE_TOKEN }}" From 9cc91a3431002575224ef23df301294ffa927225 Mon Sep 17 00:00:00 2001 From: Marcel Jacek <72880145+marceljk@users.noreply.github.com> Date: Fri, 6 Nov 2026 17:29:19 +0100 Subject: [PATCH 4/4] review feedback --- .github/workflows/release.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 82c99af7c..8e466706f 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -76,7 +76,7 @@ jobs: - name: Ensure tap fork exists run: | - # Create fork with suffix `-fork` to indicate that the repo in the technical user are just a fork + # Create fork with suffix `-fork` to indicate that the repo in the technical users account is just a fork gh repo fork stackitcloud/homebrew-tap \ --fork-name homebrew-tap-fork \ --clone=false || true @@ -88,7 +88,11 @@ jobs: with: args: release --clean env: + # GITHUB_TOKEN is used to create the GitHub release in this repository. + # It uses the workflow-level permissions defined above. GITHUB_TOKEN: ${{ github.token }} + # HOMEBREW_RELEASE_TOKEN is a PAT belonging to the `stackit-pipeline` user. + # It is used by GoReleaser to push to the tap fork and open the upstream Homebrew PR. HOMEBREW_RELEASE_TOKEN: ${{ secrets.CLI_RELEASE }} GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }} GPG_KEY_PATH: ${{ env.GPG_KEY_PATH }}