Rotate expired HOMEBREW_TAP_GITHUB_TOKEN secret (breaks Homebrew tap on release)

[blsmth]

Problem

The GoReleaser brews step pushes the updated formula to apppackio/homebrew-apppack using the HOMEBREW_TAP_GITHUB_TOKEN repo secret. That secret (last set 2026-06-30) has expired/been revoked, so the tap update now fails with:

homebrew tap formula: could not get default branch: GET https://api.github.com/repos/apppackio/homebrew-apppack: 401 Bad credentials

The GitHub Release + binaries still publish fine — only the Homebrew tap update fails, causing the goreleaser workflow to exit non-zero.

Impact

Every tagged release will fail the goreleaser job at the Homebrew step until the token is refreshed. brew install/upgrade apppack users won't get the new version automatically.

Observed on

• Release: v4.8.1
• Failed run: https://github.com/apppackio/apppack/releases/tag/v4.8.1 (goreleaser job)
• Workaround applied: the v4.8.1 tap formula was updated manually, so v4.8.1 is fully released.

Fix

1. Generate a new PAT with write access to apppackio/homebrew-apppack (classic PAT with repo scope, or a fine-grained token scoped to that repo with Contents: read/write). Prefer setting a calendar reminder or using a long/no-expiry token to avoid recurrence.
2. Update the secret:

   gh secret set HOMEBREW_TAP_GITHUB_TOKEN --repo apppackio/apppack
   

3. Verify on the next release, or re-run the failed goreleaser job for v4.8.1 to confirm the tap step succeeds.

Config references

• .github/workflows/goreleaser.yml — passes HOMEBREW_TAP_GITHUB_TOKEN env
• .goreleaser.yml — brews[].repository.token

[blsmth]

The ## Fix section above is superseded — a new PAT is the wrong fix

Rotating to another PAT (even a no-expiry one) leaves two problems in place:

1. Bus factor / offboarding. The token is tied to whoever generates it. If that person's account loses org access, releases break again with the same opaque 401 Bad credentials.
2. Recurrence. A "calendar reminder" is a process control on a technical problem. A no-expiry classic PAT trades an availability bug for a standing security liability — broad repo scope, long-lived, sitting in a secret.

Recommended: org-owned GitHub App

.goreleaser.yml consumes repository.token as a plain env var, so any valid token works — including a GitHub App installation token. This is a drop-in.

• Identity is apppack-tap[bot], not a person — survives anyone's offboarding
• App private keys don't expire, so this failure mode is permanently retired
• The usable token is minted at runtime and lives ~1h, so no long-lived credential is stored
• Consumes no paid seat (a machine user would)
• Scoped to exactly one repo, one permission

Setup (https://github.com/organizations/apppackio/settings/apps/new):

• Permissions: Repository → Contents: Read & write (Metadata: Read is implicit)
• Uncheck Webhook → Active
• Install on only apppackio/homebrew-apppack
• Store App ID + private key as HOMEBREW_TAP_APP_ID / HOMEBREW_TAP_APP_PRIVATE_KEY on apppackio/apppack; delete HOMEBREW_TAP_GITHUB_TOKEN

Workflow change in .github/workflows/goreleaser.yml:

      - name: Mint tap token
        id: tap-token
        if: startsWith(github.ref, 'refs/tags/v')
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.HOMEBREW_TAP_APP_ID }}
          private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
          owner: apppackio
          repositories: homebrew-apppack

…then HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}.

⚠️ The if: gate is required, not optional. This workflow triggers on pull_request and push, not just tags. create-github-app-token hard-fails on empty inputs and secrets aren't exposed to fork PRs, so without the gate every PR check goes red. skip_upload: auto already means the tap is untouched on non-tag runs, so gating costs nothing.

Fallback: write-enabled deploy key

GoReleaser supports pushing over SSH instead of via the API (repository.git.{url,private_key,ssh_command}). Deploy keys are repo-scoped, tied to no account, and never expire. Second choice only because it's still a long-lived stored secret.

Not recommended: a machine user (apppack-bot) — burns a seat, needs its own 2FA and recovery path, and its PAT still expires. Same conversation in 12 months.

⛔ Blocked on an org admin

Verified today (2026-08-24) — neither account-free option is self-serve for me:

Action	Requires	blsmth
Rotate the existing secret	repo secrets access	✅
Add deploy key to tap repo	admin on homebrew-apppack	❌ admin:false
Create org-owned GitHub App	org owner	❌ role is member

Org admins: @ipmb, @bartTC, @mtrythall, @yml. Someone with owner rights needs to create the App and hand over the App ID + .pem.

Current state: HOMEBREW_TAP_GITHUB_TOKEN is a repo-level secret on apppackio/apppack, still showing updated_at 2026-06-30 — not yet rotated, so the tap step is still broken for any new tag. v4.8.2 shipped 2026-08-10; the tap may still need a manual formula bump.

@ipmb — can you create the App? Happy to land the gated workflow change ahead of time so it goes green the moment the secrets exist.