mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-08 23:54:39 +00:00
Vitor Pamplona
db529444c4
`brew bump-cask-pr` forks homebrew-cask into the token owner's account, which requires a CLASSIC PAT with the `repo` scope. That scope cannot be narrowed: it grants write to every repository the owning account can reach, including this one. As an Actions secret it would be usable by anyone with push access here, because a pushed branch containing a workflow runs with repo secrets — a strict escalation for a channel that ships one DMG a month. Split the work so the token never becomes a CI secret: - CI (bump-homebrew.yml, now "Sync Homebrew Cask Reference") does the error-prone bookkeeping with GITHUB_TOKEN only: downloads the DMG, asserts it is notarized + stapled, computes the sha256, and opens an in-repo PR syncing desktopApp/packaging/homebrew/amethyst-nostr.rb. This makes it a third sibling of the amy/geode formula-sync workflows rather than a special case. - scripts/bump-homebrew-cask.sh does the upstream PR from a maintainer's shell, re-verifying sha256 and the notarization ticket against the live asset first, and refusing to submit if either fails. Verified against v1.13.1: the sha256 matches and it correctly refuses on the missing notarization ticket. Drop HOMEBREW_TOKEN from the secret inventory, and rewrite the two formula TODO(bootstrap) notes that proposed reintroducing it so a future homebrew-core submission follows the same local pattern.