From c9497ed0d9b07e4365d034de17191288cbd0c070 Mon Sep 17 00:00:00 2001
From: Nathan Nutter <nnutter@duck.com>
Date: Thu, 5 Nov 2026 00:55:40 -0600
Subject: [PATCH 1/2] Publish each release with the app token

A workflow run that GITHUB_TOKEN starts starts no further run, so a
release that GITHUB_TOKEN publishes cannot start the tap update. The app
token publishes the release instead, and it starts the tap update, which
is how timber already publishes.

The release.yaml files were otherwise the same as timber's, so the token
step and the publish step now match it.

Change-Id: Icda8d56d6948e9dd481cc5243d74ad209681c857
---
 .github/workflows/release.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c382f98..5256abf 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -64,6 +64,13 @@ jobs:
       GH_REPO: ${{ github.repository }}
       TAG: ${{ github.ref_name }}
     steps:
+      - name: Generate a token
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
       - name: Download the artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
@@ -85,6 +92,10 @@ jobs:
         run: gh release create "$TAG" --verify-tag --draft --generate-notes --title "$TAG"
       - name: Upload the assets
         run: gh release upload "$TAG" dist/* --clobber
+      # GITHUB_TOKEN starts no workflow run, so the app token publishes the
+      # release and starts the tap update.
       - name: Publish the release
         if: steps.state.outputs.state != 'published'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: gh release edit "$TAG" --draft=false --latest

From 123705ad3f541cbe8fa2efb1bb94fbf7eb5dce4f Mon Sep 17 00:00:00 2001
From: Nathan Nutter <nnutter@duck.com>
Date: Thu, 5 Nov 2026 00:55:49 -0600
Subject: [PATCH 2/2] Start the tap update when a release is published

The push of a version tag fires before the release exists, so the
workflow asked GitHub for a release that was not there yet and stopped
with HTTP 404. constable v0.5.2, constable v0.6.0, git-bump v0.3.4, and
roam v2.1.3 all left a stale formula that way. Listening for the
published release removes the race, because the release and its assets
exist by then.

The tag branch of the resolve step goes with the trigger, so the step
takes only the release tag or the dispatch input, as timber's step does.

Change-Id: Ibbc6dfc5cb123f4475e7c4e86db1b5fa93794d43
---
 .github/workflows/update-tap.yaml | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/.github/workflows/update-tap.yaml b/.github/workflows/update-tap.yaml
index c189f48..bceaba0 100644
--- a/.github/workflows/update-tap.yaml
+++ b/.github/workflows/update-tap.yaml
@@ -1,7 +1,5 @@
 name: Update Tap
 on:
-  push:
-    tags: ["v*"]
   release:
     types: [published]
   workflow_dispatch:
@@ -28,18 +26,8 @@ jobs:
         env:
           EVENT_TAG: ${{ github.event.release.tag_name }}
           INPUT_TAG: ${{ inputs.tag }}
-          REF_TAG: ${{ github.ref_name }}
-          REF_TYPE: ${{ github.ref_type }}
         run: |
-          if [[ -n "$EVENT_TAG" ]]; then
-            tag="$EVENT_TAG"
-          elif [[ -n "$INPUT_TAG" ]]; then
-            tag="$INPUT_TAG"
-          elif [[ "$REF_TYPE" == "tag" ]]; then
-            tag="$REF_TAG"
-          else
-            tag=""
-          fi
+          tag="${EVENT_TAG:-$INPUT_TAG}"
           if [[ -z "$tag" ]]; then
             echo "A release tag is required." >&2
             exit 1