fix(ci): use release bot for Homebrew tap

[altaywtf]

Summary

• replace the personal Homebrew tap PAT with a short-lived putio-release-bot installation token
• attribute generated formula commits to putio-release-bot[bot]
• remove HOMEBREW_TAP_TOKEN from the documented release environment

Changed

The Homebrew job now scopes its installation token to putio-cli and homebrew-tap with Contents write permission. The pinned Homebrew action uses that same token to read the source release and push the formula commit.

Review aids

flowchart LR
  Workflow["putio-cli release workflow"] --> AppToken["short-lived putio-release-bot token"]
  AppToken --> Source["read putio-cli release"]
  AppToken --> Tap["commit and push homebrew-tap formula"]

Loading

Risks

• the next real release is the end-to-end proof of the cross-repository push and bot attribution
• the existing HOMEBREW_TAP_TOKEN secret can be deleted after that release succeeds

Verification

• actionlint .github/workflows/ci.yml
• pnpm exec vp run verify — 245 tests passed, including the packed-install smoke and coverage gate

---

Summary by cubic

Switch Homebrew tap publishing to a short‑lived putio-release-bot installation token instead of a personal PAT. Formula commits are authored by putio-release-bot[bot] using its canonical noreply address; HOMEBREW_TAP_TOKEN is no longer required.

• Refactors
  • Use actions/create-github-app-token to mint a token scoped to putio-cli and homebrew-tap with Contents write access.
  • Configure Justintime50/homebrew-releaser to use the token and attribute commits to putio-release-bot[bot], deriving the canonical <id>+<app>[bot]@users.noreply.github.com via gh api and the action’s app-slug.
  • Update docs/DISTRIBUTION.md to remove HOMEBREW_TAP_TOKEN, note bot-authored Homebrew tap commits, and document the two‑repo installation scope.

^{Written for commit 6f25fec. Summary will update on new commits.}

[Copilot]

🟡 Not ready to approve

The workflow’s current commit_email format may prevent GitHub from attributing commits to the GitHub App bot account, undermining a stated goal of the PR.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR updates the release pipeline to publish the Homebrew tap formula using a short-lived GitHub App installation token (putio-release-bot) instead of a long-lived personal access token, and updates distribution documentation accordingly.

Changes:

• Mint a scoped GitHub App installation token for the Homebrew tap publish step and use it for cross-repo formula updates.
• Update the Homebrew publish step to author commits as putio-release-bot[bot].
• Remove HOMEBREW_TAP_TOKEN from the documented release environment requirements.

File summaries

File	Description
docs/DISTRIBUTION.md	Updates release-environment documentation to reflect GitHub App–based Homebrew publishing and removes the PAT secret requirement.
.github/workflows/ci.yml	Replaces the Homebrew tap PAT usage with a GitHub App installation token and updates commit attribution inputs for the Homebrew releaser step.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[putio-releaser]

🎉 This PR is included in version 1.2.7 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀