From cfebc13eeb61bf5425542b6c1f2735482a90b8fb Mon Sep 17 00:00:00 2001
From: bybrooklyn <brooklyn.halmstad@proton.me>
Date: Mon, 2 Mar 2026 20:27:58 -0500
Subject: [PATCH] homebrew: surface primary token error in tap sync

---
 packaging/homebrew/sync_tap.sh | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/packaging/homebrew/sync_tap.sh b/packaging/homebrew/sync_tap.sh
index 229cd45..ff1970e 100755
--- a/packaging/homebrew/sync_tap.sh
+++ b/packaging/homebrew/sync_tap.sh
@@ -38,21 +38,27 @@ api() {
 }
 
 api_with_fallback() {
-  local error_log="$TMP/gh_api_error.log"
-  rm -f "$error_log"
+  local primary_error_log="$TMP/gh_api_primary_error.log"
+  local fallback_error_log="$TMP/gh_api_fallback_error.log"
+  rm -f "$primary_error_log" "$fallback_error_log"
 
-  if api "${HOMEBREW_TAP_TOKEN}" "$@" 2>"$error_log"; then
+  if api "${HOMEBREW_TAP_TOKEN}" "$@" 2>"$primary_error_log"; then
     return 0
   fi
 
-  if [[ -n "${JOB_GH_TOKEN}" && "${JOB_GH_TOKEN}" != "${HOMEBREW_TAP_TOKEN}" ]]; then
-    echo "homebrew token auth failed; retrying with workflow token" >&2
-    if api "${JOB_GH_TOKEN}" "$@" 2>"$error_log"; then
-      return 0
+  # Only try workflow-token fallback for clear auth failures.
+  if grep -Eq 'HTTP 401|HTTP 403' "$primary_error_log"; then
+    if [[ -n "${JOB_GH_TOKEN}" && "${JOB_GH_TOKEN}" != "${HOMEBREW_TAP_TOKEN}" ]]; then
+      echo "homebrew token auth failed; retrying with workflow token" >&2
+      if api "${JOB_GH_TOKEN}" "$@" 2>"$fallback_error_log"; then
+        return 0
+      fi
+      cat "$fallback_error_log" >&2
+      return 1
     fi
   fi
 
-  cat "$error_log" >&2
+  cat "$primary_error_log" >&2
   return 1
 }