From 0b332c5170c3b31332399621420a682b1f96cb4b Mon Sep 17 00:00:00 2001
From: Michel de Graaf <michel@re-invention.nl>
Date: Sat, 25 Jul 2026 04:00:20 +0200
Subject: [PATCH] ci: let the tap update its own formula

The homebrew job needed a cross-repo PAT in HOMEBREW_TAP_TOKEN, which resolved
to an empty string and failed every release with "Input required and not
supplied: token". A tap can write to itself with the GITHUB_TOKEN it already
has, so the formula is now generated by an Update formula workflow in
michel/homebrew-tap that reads the latest release and commits when it changes.

That removes the secret from the release path entirely. Verified by corrupting
the formula and watching the workflow put it back.
---
 .github/workflows/release.yml | 76 -----------------------------------
 1 file changed, 76 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index db2ad6c..e0ce3b9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -185,79 +185,3 @@ jobs:
           checksum: sha256
           ref: refs/tags/${{ needs.release.outputs.tag }}
           token: ${{ secrets.GITHUB_TOKEN }}
-
-  # Rewrites Formula/soulseek-rs.rb in the tap to point at the archives the
-  # matrix just uploaded. The formula is generated whole rather than patched, so
-  # the workflow is the only place its contents live.
-  homebrew:
-    name: Homebrew tap
-    needs: [release, binaries]
-    if: needs.release.outputs.created == 'true' || inputs.tag != ''
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          repository: michel/homebrew-tap
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-
-      - name: Write formula
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ needs.release.outputs.tag }}
-        run: |
-          set -euo pipefail
-          base="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}"
-          sha() {
-            gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
-              --pattern "soulseek-rs-$TAG-$1.sha256" --output - | cut -d' ' -f1
-          }
-          mkdir -p Formula
-          cat > Formula/soulseek-rs.rb <<EOF
-          # Generated by the soulseek-rs release workflow. Do not edit by hand.
-          class SoulseekRs < Formula
-            desc "Soulseek client in Rust"
-            homepage "https://re-invention.nl/soulseek-rs/"
-            version "${TAG#v}"
-            license "MIT"
-
-            on_macos do
-              on_arm do
-                url "$base/soulseek-rs-$TAG-aarch64-apple-darwin.tar.gz"
-                sha256 "$(sha aarch64-apple-darwin)"
-              end
-              on_intel do
-                url "$base/soulseek-rs-$TAG-x86_64-apple-darwin.tar.gz"
-                sha256 "$(sha x86_64-apple-darwin)"
-              end
-            end
-
-            on_linux do
-              on_arm do
-                url "$base/soulseek-rs-$TAG-aarch64-unknown-linux-musl.tar.gz"
-                sha256 "$(sha aarch64-unknown-linux-musl)"
-              end
-              on_intel do
-                url "$base/soulseek-rs-$TAG-x86_64-unknown-linux-musl.tar.gz"
-                sha256 "$(sha x86_64-unknown-linux-musl)"
-              end
-            end
-
-            def install
-              bin.install "soulseek-rs"
-            end
-
-            test do
-              assert_match version.to_s, shell_output("#{bin}/soulseek-rs --version")
-            end
-          end
-          EOF
-
-      - name: Commit
-        env:
-          TAG: ${{ needs.release.outputs.tag }}
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add Formula/soulseek-rs.rb
-          git diff --staged --quiet || git commit -m "soulseek-rs $TAG"
-          git push