From a04895e9b9ab06b9f0a3b2d21d2be24530bf73fe Mon Sep 17 00:00:00 2001
From: Nathan Nutter <nnutter@duck.com>
Date: Thu, 5 Nov 2026 00:55:42 -0600
Subject: [PATCH 1/2] Publish each release with the app token

A workflow run that GITHUB_TOKEN starts starts no further run, so a
release that GITHUB_TOKEN publishes cannot start the tap update. The app
token publishes the release instead, and it starts the tap update, which
is how timber already publishes.

The release.yaml files were otherwise the same as timber's, so the token
step and the publish step now match it.

Change-Id: I0772d12cf71a9b0b0f98ab6eb4a2d55c140d6939
---
 .github/workflows/release.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2c9df2b..6da2657 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -60,6 +60,13 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       TAG: ${{ github.ref_name }}
     steps:
+      - name: Generate a token
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
       - name: Download the archives
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
@@ -81,6 +88,10 @@ jobs:
         run: gh release create "$TAG" --verify-tag --draft --generate-notes --title "$TAG"
       - name: Upload the assets
         run: gh release upload "$TAG" dist/* --clobber
+      # GITHUB_TOKEN starts no workflow run, so the app token publishes the
+      # release and starts the tap update.
       - name: Publish the release
         if: steps.state.outputs.state != 'published'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: gh release edit "$TAG" --draft=false --latest

From b0c2f2d4c0d4bc53295e237cc53bf8dd1ce95c00 Mon Sep 17 00:00:00 2001
From: Nathan Nutter <nnutter@duck.com>
Date: Thu, 5 Nov 2026 00:55:51 -0600
Subject: [PATCH 2/2] Start the tap update when a release is published

The push of a version tag fires before the release exists, so the
workflow asked GitHub for a release that was not there yet and stopped
with HTTP 404. constable v0.5.2, constable v0.6.0, git-bump v0.3.4, and
roam v2.1.3 all left a stale formula that way. Listening for the
published release removes the race, because the release and its assets
exist by then.

The tag branch of the resolve step goes with the trigger, so the step
takes only the release tag or the dispatch input, as timber's step does.

Change-Id: I4488835faea75bb2e7e60de05b34d70379febfb2
---
 .github/workflows/update-tap.yaml | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/.github/workflows/update-tap.yaml b/.github/workflows/update-tap.yaml
index dc05a78..f9c2642 100644
--- a/.github/workflows/update-tap.yaml
+++ b/.github/workflows/update-tap.yaml
@@ -1,7 +1,5 @@
 name: Update Tap
 on:
-  push:
-    tags: ["v*"]
   release:
     types: [published]
   workflow_dispatch:
@@ -28,18 +26,8 @@ jobs:
         env:
           EVENT_TAG: ${{ github.event.release.tag_name }}
           INPUT_TAG: ${{ inputs.tag }}
-          REF_TAG: ${{ github.ref_name }}
-          REF_TYPE: ${{ github.ref_type }}
         run: |
-          if [[ -n "$EVENT_TAG" ]]; then
-            tag="$EVENT_TAG"
-          elif [[ -n "$INPUT_TAG" ]]; then
-            tag="$INPUT_TAG"
-          elif [[ "$REF_TYPE" == "tag" ]]; then
-            tag="$REF_TAG"
-          else
-            tag=""
-          fi
+          tag="${EVENT_TAG:-$INPUT_TAG}"
           if [[ -z "$tag" ]]; then
             echo "A release tag is required." >&2
             exit 1