bybrooklyn/openbitdo
1
0
Fork 0
mirror of https://github.com/bybrooklyn/openbitdo.git synced 2026-03-19 04:12:56 -04:00
Code Issues Packages Projects Releases Wiki Activity

release: preflight tap token via git remote auth

Browse Source
This commit is contained in:
Brooklyn Halmstad
2026-03-02 18:47:10 -05:00
parent 33c45a66af
commit 6dab2259de
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
.github/workflows/release.yml vendored
View File

@@ -67,15 +67,19 @@ jobs:
set -euo pipefail set -euo pipefail
[[ -n "${HOMEBREW_TAP_REPO:-}" ]] || { echo "missing required variable: HOMEBREW_TAP_REPO" >&2; exit 1; } [[ -n "${HOMEBREW_TAP_REPO:-}" ]] || { echo "missing required variable: HOMEBREW_TAP_REPO" >&2; exit 1; }
gh repo view "${HOMEBREW_TAP_REPO}" >/dev/null gh repo view "${HOMEBREW_TAP_REPO}" >/dev/null
# Validate that the release push token can write to the tap repo. # Validate token auth against the exact git remote path used for tap sync.
tap_push_permission="$( tap_token="$(printf '%s' "${HOMEBREW_TAP_TOKEN}" | tr -d '\r\n')"
GH_TOKEN="${HOMEBREW_TAP_TOKEN}" \ tap_owner="${HOMEBREW_TAP_REPO%%/*}"
gh api "repos/${HOMEBREW_TAP_REPO}" --jq '.permissions.push // false' tap_url_primary="https://${tap_owner}:${tap_token}@github.com/${HOMEBREW_TAP_REPO}.git"
)" tap_url_fallback="https://x-access-token:${tap_token}@github.com/${HOMEBREW_TAP_REPO}.git"
if [[ "${tap_push_permission}" != "true" ]]; then if git ls-remote --heads "${tap_url_primary}" >/dev/null 2>&1; then
echo "HOMEBREW_TAP_TOKEN does not have push access to ${HOMEBREW_TAP_REPO}" >&2 exit 0
exit 1
fi fi
if git ls-remote --heads "${tap_url_fallback}" >/dev/null 2>&1; then
exit 0
fi
echo "HOMEBREW_TAP_TOKEN cannot access ${HOMEBREW_TAP_REPO} via git over HTTPS" >&2
exit 1
- name: Require successful CI checks on tagged commit - name: Require successful CI checks on tagged commit
working-directory: ${{ github.workspace }} working-directory: ${{ github.workspace }}