From 5a2f4f0c4c6ae1de67c1411a9f19133a25413993 Mon Sep 17 00:00:00 2001
From: Joshua Gilman <joshuagilman@gmail.com>
Date: Fri, 21 Aug 2026 14:16:01 -0700
Subject: [PATCH] test(ci): rehearse Scoop bucket token access

---
 .github/workflows/scoop-token-rehearsal.yml | 29 +++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 .github/workflows/scoop-token-rehearsal.yml

diff --git a/.github/workflows/scoop-token-rehearsal.yml b/.github/workflows/scoop-token-rehearsal.yml
new file mode 100644
index 0000000..8740cfd
--- /dev/null
+++ b/.github/workflows/scoop-token-rehearsal.yml
@@ -0,0 +1,29 @@
+name: Scoop token rehearsal
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/scoop-token-rehearsal.yml'
+
+permissions: {}
+
+jobs:
+  token:
+    name: Mint bucket-scoped Release App token
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Create bucket token
+        id: app-token
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        with:
+          app-id: ${{ vars.MEIGMA_RELEASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.MEIGMA_RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: scoop-bucket
+
+      - name: Verify bucket access
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: test "$(gh api repos/meigma/scoop-bucket --jq .full_name)" = 'meigma/scoop-bucket'