fix(ci): authenticate tap push via org GitHub App, not a personal PAT

[elkaix]

Problem

homebrew-tap.yml pushes the generated formula to the separate TechMatrix-labs/homebrew-pythinker repo, which the default GITHUB_TOKEN can't write to — so it used a personal PAT in HOMEBREW_TAP_TOKEN. That PAT broke on the org migration and again on re-issue: it authenticated as mohamed-elkholy95 but lacked Contents: write, so every git push 403'd and the tap froze at 0.25.0 (current latest release is 0.26.0).

Fix

Mint a short-lived installation token at runtime from an org-owned GitHub App (actions/create-github-app-token@v2) scoped to the tap repo with Contents: Read and write:

• Org-owned → survives member/org-migration changes (the exact failure class that's bitten us twice).
• Short-lived → token expires in ~1h, minted fresh each run; nothing long-lived in CI except the App private key.
• Repo-scoped → owner/repositories limit the token to only homebrew-pythinker.

Deploy keys (the simpler robust option) are disabled org-wide for TechMatrix-labs, so the App is the frictionless path that needs no org-policy change. The HTTPS x-access-token:<token>@github.com/... push is unchanged — only the token source moved.

Required secrets (set on TechMatrix-labs/pythinker-code)

Secret	Value
HOMEBREW_TAP_APP_ID	the GitHub App's App ID
HOMEBREW_TAP_APP_PRIVATE_KEY	the App's generated .pem private key

The old HOMEBREW_TAP_TOKEN secret is no longer referenced and can be deleted after this lands.

Verification

After the App is created/installed and the secrets are set: re-run homebrew-tap.yml for 0.26.0 and confirm the tap formula flips to 0.26.0. (Tracked separately; this PR is the workflow wiring only.)

Summary by CodeRabbit

• Chores
  • Improved security for Homebrew repository sync by switching from long-lived static credentials to short-lived installation tokens.
  • Updated deployment messaging to provide clearer guidance for verifying app secrets, configuration, and installation permissions when authentication fails.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 71448f7b-99ff-4ee1-9832-7d2161d45c4b

📥 Commits

Reviewing files that changed from the base of the PR and between eadef6d and 610b324.

📒 Files selected for processing (1)

• .github/workflows/homebrew-tap.yml

---

📝 Walkthrough

Walkthrough

The workflow replaces static PAT authentication with a minted short-lived GitHub App token for the Homebrew tap repository. A new step uses app credentials and environment variables to create the token, and the subsequent sync step uses that token while updating its error message to reflect the new authentication method.

Changes

GitHub App Token Authentication for Homebrew Tap

Layer / File(s)

Summary

GitHub App token minting and tap-sync usage .github/workflows/homebrew-tap.yml

A new create-github-app-token@v2 step mints a short-lived token from org-owned app credentials and repository environment variables, exposing it as steps.app-token.outputs.token. The "Sync formula into tap repo" step consumes that token instead of HOMEBREW_TAP_TOKEN, and the empty-token validation error now instructs to verify GitHub App configuration and installation permissions for ${TAP_OWNER}/${TAP_REPO}.

Sequence Diagram(s)

sequenceDiagram
  participant Runner as GitHub Actions Runner
  participant TokenAction as actions/create-github-app-token
  participant TapSync as "Sync formula into tap repo"
  participant TapRepo as Tap repository (${TAP_OWNER}/${TAP_REPO})

  Runner->>TokenAction: provide HOMEBREW_TAP_APP_ID & HOMEBREW_TAP_APP_PRIVATE_KEY
  TokenAction-->>Runner: outputs steps.app-token.outputs.token
  Runner->>TapSync: set TAP_TOKEN=steps.app-token.outputs.token
  TapSync->>TapRepo: push/sync formulas using TAP_TOKEN

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• TechMatrix-labs/pythinker-code#22: Both PRs modify Homebrew tap workflow authentication; PR #22 added an empty PAT guard while this PR replaces PAT usage entirely with a minted GitHub App token.

Suggested labels

bug

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows conventional commits format with valid 'fix' type, '(ci)' scope, and clearly describes the main change: replacing a personal PAT with an org GitHub App for tap authentication.
Description check	✅ Passed	Description comprehensively covers the problem, fix, required secrets, and verification steps, exceeding the template's basic requirements despite missing some optional checklist items.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/homebrew-tap-github-app

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/homebrew-tap.yml:
- Around line 79-86: Replace movable action tags with immutable commit SHAs:
change uses: actions/create-github-app-token@v2 to uses:
actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349, and
similarly pin uses: actions/checkout@v4 and uses: actions/setup-python@v5 to
their respective full commit SHAs (replace the `@vX` tags with the full commit IDs
you fetch from each repo). Also ensure the GitHub App installation permissions
are restricted to only "Contents: Read and write" for the installation on the
TAP owner/repo (the ${TAP_OWNER}/${TAP_REPO} installation) in the app settings
so the minted token scoped by owner/repositories is limited to that permission.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8388c4e8-7c4b-430f-8048-2227aa7825b4

📥 Commits

Reviewing files that changed from the base of the PR and between 707817d and eadef6d.

📒 Files selected for processing (1)

• .github/workflows/homebrew-tap.yml