diff --git a/.github/workflows/release-homebrew.yml b/.github/workflows/release-homebrew.yml index 23dd19d29..185b0b45f 100644 --- a/.github/workflows/release-homebrew.yml +++ b/.github/workflows/release-homebrew.yml @@ -198,6 +198,7 @@ jobs: env: EXPECTED_COMMIT: ${{ needs.validate.outputs.commit }} GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} RELEASE_TAG: ${{ needs.validate.outputs.tag }} RELEASE_VERSION: ${{ needs.validate.outputs.version }} steps: diff --git a/scripts/release/test_homebrew_source_release.py b/scripts/release/test_homebrew_source_release.py index 6c3584c57..834a3dae4 100644 --- a/scripts/release/test_homebrew_source_release.py +++ b/scripts/release/test_homebrew_source_release.py @@ -407,6 +407,7 @@ def test_workflow_keeps_untrusted_tag_away_from_shell_and_tokens(self) -> None: self.assertIn("gh pr create", workflow) self.assertIn("--latest", workflow) self.assertIn('gh release upload "$RELEASE_TAG"', workflow) + self.assertIn("GH_REPO: ${{ github.repository }}", workflow) self.assertIn("Fail closed unless the tap is public", workflow) self.assertIn('"$private" != "false"', workflow) self.assertIn('"$visibility" != "public"', workflow)