From 1f614f501ec99e8dc5765a7aa270f4270caaa904 Mon Sep 17 00:00:00 2001
From: TerrifiedBug <admin@terrifiedbug.com>
Date: Thu, 27 Aug 2026 20:03:20 +0100
Subject: [PATCH] ci: fail the tap token before notarize
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tap is public, so an unset HOMEBREW_TAP_TOKEN clones anonymously
and only dies at git push — after the GitHub release and appcast.xml
are already published. Probe emptiness, credentials, and push access
before Build, sign, notarize.
---
 .github/workflows/release.yml | 18 ++++++++++++++++++
 CHANGELOG.md                  |  1 +
 2 files changed, 19 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 28e7b3f..28cec66 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -59,6 +59,24 @@ jobs:
           echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
           echo "zip=dist/Browseroute-$VERSION.zip" >> "$GITHUB_OUTPUT"
 
+      - name: Verify Homebrew tap token
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+        run: |
+          if [ -z "$GH_TOKEN" ]; then
+            echo "::error::HOMEBREW_TAP_TOKEN is not set. The cask cannot be published."
+            exit 1
+          fi
+          # The tap is public: git clone succeeds without credentials. A dead
+          # or read-only token only fails at git push, after the GitHub release
+          # and appcast.xml are already published. Probe before notarize.
+          git ls-remote "https://x-access-token:${GH_TOKEN}@github.com/TerrifiedBug/homebrew-tap.git" >/dev/null
+          CAN_PUSH="$(gh api repos/TerrifiedBug/homebrew-tap --jq .permissions.push)"
+          if [ "$CAN_PUSH" != "true" ]; then
+            echo "::error::HOMEBREW_TAP_TOKEN cannot push to TerrifiedBug/homebrew-tap."
+            exit 1
+          fi
+
       - name: Import signing certificate
         env:
           APP_P12: ${{ secrets.DEVELOPER_ID_APP_P12_BASE64 }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0eb4f39..ff8b238 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,3 +14,4 @@ All notable changes to Browseroute are documented here (Keep a Changelog style).
 
 - Developer ID-signed, notarized GitHub releases (same methodology as yap and TickerBar) and a Homebrew cask.
 - Sparkle EdDSA key baked in; Check for Updates is live on Developer ID-signed GitHub builds (ad-hoc and Homebrew stay off). The cert check runs after launch and does not hash sealed resources.
+- Release CI fails before notarize if `HOMEBREW_TAP_TOKEN` is missing, expired, or cannot push to the tap.