Revert REST API approach; add GH_PAT permission diagnostic

The REST API switch was a non-fix: it reuses the same GH_PAT and hits
the identical 403 permission check, so it could never resolve the push
denial. Reverted ci.yml back to the git-push path.

Added a diagnostic step to update-tap.yml that prints the stored secret's
actual scopes (x-oauth-scopes), authenticated login, and .permissions on
homebrew-heard — so the next run reveals whether the secret can write,
rather than us guessing.

https://claude.ai/code/session_017hkC9vmFd9ejBQNxzBfcWP

Author: claude

.github/workflows/ci.yml

@@ -130,14 +130,12 @@ jobs:
           GH_PAT: ${{ secrets.GH_PAT }}
         run: |
           VERSION="${{ steps.meta.outputs.version }}"
-          CONTENT=$(base64 -w 0 Casks/heard.rb)
-          FILE_SHA=$(curl -sf \
-            -H "Authorization: token ${GH_PAT}" \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/repos/execsumo/homebrew-heard/contents/Casks/heard.rb" \
-            | jq -r '.sha')
-          curl -sf -X PUT \
-            -H "Authorization: token ${GH_PAT}" \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/repos/execsumo/homebrew-heard/contents/Casks/heard.rb" \
-            -d "{\"message\":\"Update heard to v${VERSION}\",\"content\":\"${CONTENT}\",\"sha\":\"${FILE_SHA}\"}"
+          git clone "https://execsumo:${GH_PAT}@github.com/execsumo/homebrew-heard.git" homebrew-tap
+          mkdir -p homebrew-tap/Casks
+          cp Casks/heard.rb homebrew-tap/Casks/heard.rb
+          cd homebrew-tap
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add Casks/heard.rb
+          git commit -m "Update heard to v${VERSION}"
+          git push origin HEAD:refs/heads/main

.github/workflows/update-tap.yml

@@ -27,20 +27,31 @@ jobs:
             -e "s/sha256 \"[^\"]*\"/sha256 \"${SHA256}\"/" \
             Casks/heard.rb
 
+      - name: Diagnose GH_PAT permissions
+        env:
+          GH_PAT: ${{ secrets.GH_PAT }}
+        run: |
+          echo "=== Token scopes (classic PAT) ==="
+          curl -sI -H "Authorization: token ${GH_PAT}" https://api.github.com/user \
+            | grep -i '^x-oauth-scopes:' || echo "(no x-oauth-scopes header — fine-grained token or invalid)"
+          echo "=== Authenticated user ==="
+          curl -s -H "Authorization: token ${GH_PAT}" https://api.github.com/user | jq -r '.login // "AUTH FAILED"'
+          echo "=== Write permission on homebrew-heard ==="
+          curl -s -H "Authorization: token ${GH_PAT}" \
+            https://api.github.com/repos/execsumo/homebrew-heard | jq '.permissions'
+
       - name: Push cask to Homebrew tap
         env:
           GH_PAT: ${{ secrets.GH_PAT }}
         run: |
           VERSION="${{ inputs.version }}"
-          CONTENT=$(base64 -w 0 Casks/heard.rb)
-          # Get current file SHA (required by the API to update an existing file)
-          FILE_SHA=$(curl -sf \
-            -H "Authorization: token ${GH_PAT}" \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/repos/execsumo/homebrew-heard/contents/Casks/heard.rb" \
-            | jq -r '.sha')
-          curl -sf -X PUT \
-            -H "Authorization: token ${GH_PAT}" \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/repos/execsumo/homebrew-heard/contents/Casks/heard.rb" \
-            -d "{\"message\":\"Update heard to v${VERSION}\",\"content\":\"${CONTENT}\",\"sha\":\"${FILE_SHA}\"}"
+          git clone "https://execsumo:${GH_PAT}@github.com/execsumo/homebrew-heard.git" homebrew-tap
+          mkdir -p homebrew-tap/Casks
+          cp Casks/heard.rb homebrew-tap/Casks/heard.rb
+          cd homebrew-tap
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add Casks/heard.rb
+          git diff --cached --quiet && echo "No changes" && exit 0
+          git commit -m "Update heard to v${VERSION}"
+          git push origin HEAD:refs/heads/main