Summary
The fine-grained PAT backing the HOMEBREW_DEPLOY_KEY repo secret expires around 2027-07-12 (⚠️ assumed 1-year default — correct this if a shorter expiry was chosen).
- Secret:
HOMEBREW_DEPLOY_KEY on thingzio/devradarctl
- Token: fine-grained PAT, owner
thingzio, repo homebrew-tap, permission Contents: Read and write
- Purpose: lets the release workflow push the Homebrew cask into
thingzio/homebrew-tap
Impact when it lapses
Only the cask-publish step of release.yaml fails. Binaries, checksums, SBOMs, and SLSA provenance still publish normally — so a lapsed token means the tap goes stale (users can't brew upgrade to the newest version), not a broken release.
Rotation steps
- Mint a new fine-grained PAT: owner
thingzio, repository access homebrew-tap only, permission Contents: Read and write (Metadata: Read is auto-added).
- Approve it in the org PAT queue if pending: https://github.com/organizations/thingzio/settings/personal-access-tokens/pending_requests
- Update the secret:
gh secret set HOMEBREW_DEPLOY_KEY --repo thingzio/devradarctl
- Confirm on the next release that the cask lands in
thingzio/homebrew-tap.
Set a new reminder for the next expiry after rotating.
Summary
The fine-grained PAT backing the⚠️ assumed 1-year default — correct this if a shorter expiry was chosen).
HOMEBREW_DEPLOY_KEYrepo secret expires around 2027-07-12 (HOMEBREW_DEPLOY_KEYonthingzio/devradarctlthingzio, repohomebrew-tap, permission Contents: Read and writethingzio/homebrew-tapImpact when it lapses
Only the cask-publish step of
release.yamlfails. Binaries, checksums, SBOMs, and SLSA provenance still publish normally — so a lapsed token means the tap goes stale (users can'tbrew upgradeto the newest version), not a broken release.Rotation steps
thingzio, repository accesshomebrew-taponly, permission Contents: Read and write (Metadata: Read is auto-added).gh secret set HOMEBREW_DEPLOY_KEY --repo thingzio/devradarctlthingzio/homebrew-tap.Set a new reminder for the next expiry after rotating.