Add the ability to use Deploy Keys to deploy Homebrew taps

[AnomalRoil]

Is your feature request related to a problem?
Using a Personal Access Token (PAT) with repo rights to deploy the Homebrew taps is a security concern, see #2026

Describe the solution you'd like
Since Github does not allow to create PAT that are restricted to a few repository, but allows adding Deploy Keys to specific repositories, it might be interesting to have a way to provide a SSH Deploy Key instead of a Token for Homebrew deployment as was proposed in #1643 and for the same reasons.

Describe alternatives you've considered
We can use Machine User accounts to workaround the security issue, but it adds a significant extra burden (with the need to create and secure an extra account).

We can use a very hackish way using Github Apps Installation token, since these can be restricted to specific repo, it appears.

Additional context
I'll open a discussion on the topic shortly.

[caarlos0]

What was done on #1643 works on the brew pipe as well...

see #1650

[AnomalRoil]

Yes, but the issue is that PA Token are too difficult to "restrict" in scope to a single repo, whereas Deploy Keys are highly specific to a repo and thus super useful for deployment.

[caarlos0]

My understanding is that it would require us to change our impls to clone/commit/push the tap repo, as today we only use the github API.

Probably won't happen anytime soon as its a big rewrite on otherwise stable code.

Will keep in mind for v2 though.

Thanks!

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.