ci: use existing release-plz GitHub App for Homebrew tap pushes#43
Conversation
Reuse the existing release-plz GitHub App (RELEASE_PLZ_APP_ID / RELEASE_PLZ_APP_PRIVATE_KEY) to authenticate the homebrew-tap push instead of a personal fine-grained PAT (HOMEBREW_TAP_TOKEN). The token is minted at runtime via actions/create-github-app-token and scoped to repositories: homebrew-tap, so even though the app is installed on both zift and homebrew-tap, the minted token can only reach the tap. Same SHA pin as release-plz.yml. Author/committer is now <app-slug>[bot] for honest provenance. Requires the app to be installed on EnforceAuth/homebrew-tap (one-time UI step). HOMEBREW_TAP_TOKEN secret can be deleted once this lands.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe workflow replaces a static Homebrew tap PAT with a minted GitHub App token via ChangesHomebrew Tap Release Workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Review rate limit: 3/5 reviews remaining, refill in 15 minutes and 38 seconds. Comment |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
The migration from a personal PAT to GitHub App authentication is implemented correctly. The token minting, scoping, and usage all follow GitHub Actions best practices. The workflow will now use short-lived, repository-scoped tokens instead of a long-lived personal access token, improving security posture.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release-binaries.yml:
- Around line 143-148: Update the git author email to use the documented GitHub
App bot format including the numeric bot user ID: call the GitHub API (or use
the output from the app token action that returns the bot user id) to obtain the
numeric ID (e.g. steps.app-token.outputs.app-user-id) and set git config
user.email to "<BOT_ID>+${APP_SLUG}[bot]@users.noreply.github.com" instead of
"${APP_SLUG}[bot]@users.noreply.github.com"; keep the existing git config
user.name "${APP_SLUG}[bot]" and ensure the new BOT_ID output is fetched before
the git config commands run.
- Around line 87-94: The GitHub App token step ("Mint Homebrew tap token", id:
app-token) currently mints a token with all installation permissions; narrow it
to least privilege by adding the input permission-contents: write to the
actions/create-github-app-token@... step so the minted token only has repository
contents write access required for the checkout/add/commit/push operations on
the homebrew-tap repository.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c0c6c8d6-27fa-4db8-b8d1-a072f5ab2bdb
📒 Files selected for processing (1)
.github/workflows/release-binaries.yml
Address CodeRabbit review feedback on PR #43: - Add permission-contents: write to actions/create-github-app-token to follow least-privilege; the workflow only needs contents access on homebrew-tap to commit and push the formula update. - Use the documented GitHub App bot email format <bot-id>+<slug>[bot]@users.noreply.github.com so commits are properly attributed to the App's bot user. The numeric ID is fetched at runtime via gh api /users/<slug>[bot].
1 participant
Follow-up to #42. Switches the
update-homebrewjob from a personal fine-grained PAT (HOMEBREW_TAP_TOKEN) to the existingenforceauth-zift-release-plzGitHub App.Why
RELEASE_PLZ_APP_ID/RELEASE_PLZ_APP_PRIVATE_KEYalready in the repo forrelease-plz.yml.actions/create-github-app-tokenSHA pin asrelease-plz.ymlso dependabot updates them together.Scope
The minted token is scoped via
repositories: homebrew-tap, so even though the app is installed on bothziftandhomebrew-tap, the token only has access to the tap.Trade-off: the private key's blast radius widens from "can push to zift" to "can push to zift and the tap." For a derivative tap repo this is the same trust posture; not worth a second app.
Required one-time setup
enforceauth-zift-release-plzinstalled onEnforceAuth/homebrew-tap(Settings → Installations → Configure → add repo)HOMEBREW_TAP_TOKENrepo secret if it was created — no longer usedTest plan
update-homebrewjob mints a token, checks out the tap, writesFormula/zift.rb, and pushes — committer shows asenforceauth-zift-release-plz[bot]Summary by CodeRabbit