Problem
`release.yml` patches `homebrew/kshield.rb` inside the `kshield` repo itself (version + checksums), but nothing pushes that file to the separate `YTT-Global/homebrew-tap` repo, which is what `brew install ytt-global/tap/kshield` actually reads from.
For v1.1.0 this had to be fixed by hand: the tap repo was still on v1.0.0 pointing at the dead `YTTGlobalServices` org, and it will drift again on every future release unless this is automated.
Proposed fix
Add a step to the `publish` job (or a new job) in `release.yml` that, after computing the correct checksums:
- Checks out (or clones) `YTT-Global/homebrew-tap`
- Overwrites `kshield.rb` with the freshly-patched formula
- Commits and pushes to `main`
Needs a token with write access to `homebrew-tap` (the default `GITHUB_TOKEN` only has access to the repo the workflow runs in) — a fine-grained PAT or a GitHub App installation token stored as a secret (e.g. `HOMEBREW_TAP_PUSH_TOKEN`).
Related
Also depends on PR #16 (checksums-collision fix) being merged first, since that's what makes the computed checksums trustworthy again.
Problem
`release.yml` patches `homebrew/kshield.rb` inside the `kshield` repo itself (version + checksums), but nothing pushes that file to the separate `YTT-Global/homebrew-tap` repo, which is what `brew install ytt-global/tap/kshield` actually reads from.
For v1.1.0 this had to be fixed by hand: the tap repo was still on v1.0.0 pointing at the dead `YTTGlobalServices` org, and it will drift again on every future release unless this is automated.
Proposed fix
Add a step to the `publish` job (or a new job) in `release.yml` that, after computing the correct checksums:
Needs a token with write access to `homebrew-tap` (the default `GITHUB_TOKEN` only has access to the repo the workflow runs in) — a fine-grained PAT or a GitHub App installation token stored as a secret (e.g. `HOMEBREW_TAP_PUSH_TOKEN`).
Related
Also depends on PR #16 (checksums-collision fix) being merged first, since that's what makes the computed checksums trustworthy again.