From b8f82fbd867ba7b2d3bac385e8808d134b5b9327 Mon Sep 17 00:00:00 2001
From: Nathan Nutter <nnutter@duck.com>
Date: Tue, 3 Nov 2026 23:55:07 -0600
Subject: [PATCH 1/2] Publish the release with the app token

When `GITHUB_TOKEN` publishes a release, that event starts no workflow
run. The tap update listens for `release: published`, so it never ran
after an automatic release, and an earlier change worked around that
with a tag trigger.

A GitHub App token does not suppress the event, so the publish step now
uses one. A published release can then start the tap update.

The token comes first in the job, so a missing app install fails the run
before any release exists. The create and upload steps keep
`GITHUB_TOKEN`, so the app needs write access to release contents only.

Change-Id: I98a9c646b27b1fcc4de81512d963c62f904c321e
---
 .github/workflows/release.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c790ea4..88a886f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -55,6 +55,13 @@ jobs:
       GH_REPO: ${{ github.repository }}
       TAG: ${{ github.ref_name }}
     steps:
+      - name: Generate a token
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
       - name: Download the archives
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
@@ -76,6 +83,10 @@ jobs:
         run: gh release create "$TAG" --verify-tag --draft --generate-notes --title "$TAG"
       - name: Upload the assets
         run: gh release upload "$TAG" dist/* --clobber
+      # GITHUB_TOKEN starts no workflow run, so the app token publishes the
+      # release and starts the tap update.
       - name: Publish the release
         if: steps.state.outputs.state != 'published'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: gh release edit "$TAG" --draft=false --latest

From 8b3ab14a448566e8f1fab06564271de406a08ba9 Mon Sep 17 00:00:00 2001
From: Nathan Nutter <nnutter@duck.com>
Date: Tue, 3 Nov 2026 23:55:24 -0600
Subject: [PATCH 2/2] Trigger the tap update from the published release

The formula downloads the release archives, so its URLs exist only
after the release publishes. A tag push lands before the upload, when
those assets are still absent, so the tag trigger cannot fill them in.

The workflow now starts on `release: published` and takes the tag from
that event. `workflow_dispatch` stays, so a backfill can still name a
tag by hand. The tag-push fields go away with the trigger.

Change-Id: I7c9b16689e61e11ba4820b54db6d06841b48cde4
---
 .github/workflows/update-tap.yaml | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/.github/workflows/update-tap.yaml b/.github/workflows/update-tap.yaml
index 39b9272..2d3b4ef 100644
--- a/.github/workflows/update-tap.yaml
+++ b/.github/workflows/update-tap.yaml
@@ -1,7 +1,5 @@
 name: Update Tap
 on:
-  push:
-    tags: ["v*"]
   release:
     types: [published]
   workflow_dispatch:
@@ -28,18 +26,8 @@ jobs:
         env:
           EVENT_TAG: ${{ github.event.release.tag_name }}
           INPUT_TAG: ${{ inputs.tag }}
-          REF_TAG: ${{ github.ref_name }}
-          REF_TYPE: ${{ github.ref_type }}
         run: |
-          if [[ -n "$EVENT_TAG" ]]; then
-            tag="$EVENT_TAG"
-          elif [[ -n "$INPUT_TAG" ]]; then
-            tag="$INPUT_TAG"
-          elif [[ "$REF_TYPE" == "tag" ]]; then
-            tag="$REF_TAG"
-          else
-            tag=""
-          fi
+          tag="${EVENT_TAG:-$INPUT_TAG}"
           if [[ -z "$tag" ]]; then
             echo "A release tag is required." >&2
             exit 1