Problem
The Homebrew publish job embeds the tap token in the clone URL and leaves temporary files/directories without a cleanup trap.
Evidence
.github/workflows/release.yml:
- creates
checksums="$(mktemp)".
- creates
tap_dir="$(mktemp -d)".
- runs
git clone "https://x-access-token:${TAP_TOKEN}@github.com/Widthdom/homebrew-tap.git" "$tap_dir".
The tokenized URL can persist in remote config and leak through diagnostics. The temporary checksum file and clone are not cleaned up on success or failure.
Expected behavior
Use a credential helper or extraheader approach that does not persist the token in the remote URL, and add cleanup traps for temporary artifacts.
Labels
bug, security, github_actions
Problem
The Homebrew publish job embeds the tap token in the clone URL and leaves temporary files/directories without a cleanup trap.
Evidence
.github/workflows/release.yml:checksums="$(mktemp)".tap_dir="$(mktemp -d)".git clone "https://x-access-token:${TAP_TOKEN}@github.com/Widthdom/homebrew-tap.git" "$tap_dir".The tokenized URL can persist in remote config and leak through diagnostics. The temporary checksum file and clone are not cleaned up on success or failure.
Expected behavior
Use a credential helper or extraheader approach that does not persist the token in the remote URL, and add cleanup traps for temporary artifacts.
Labels
bug,security,github_actions