From 70f573cf079737e0eff25ed8111dca27975789bb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 9 Jun 2026 07:22:08 +0000
Subject: [PATCH 1/5] Initial plan


From ab3a6ebf9a74c312a635d8a1dea7e300d0571179 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 9 Jun 2026 07:25:46 +0000
Subject: [PATCH 2/5] fix: skip update-tap job when TAP_PUSH_TOKEN is missing

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 659a04b..ae00622 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -179,6 +179,7 @@ jobs:
   update-tap:
     name: Update Homebrew tap
     needs: build
+    if: ${{ secrets.TAP_PUSH_TOKEN != '' }}
     runs-on: ubuntu-latest        # no macOS toolchain needed for a git commit
 
     steps:

From 92eef1aeac32c969cb195802f441f225276d9a95 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 9 Jun 2026 07:26:49 +0000
Subject: [PATCH 3/5] fix: make update-tap resilient when token secret is unset

---
 .github/workflows/release.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ae00622..7f169ad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -179,7 +179,6 @@ jobs:
   update-tap:
     name: Update Homebrew tap
     needs: build
-    if: ${{ secrets.TAP_PUSH_TOKEN != '' }}
     runs-on: ubuntu-latest        # no macOS toolchain needed for a git commit
 
     steps:
@@ -201,7 +200,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: HackPoint/homebrew-tap
-          token: ${{ secrets.TAP_PUSH_TOKEN }}
+          token: ${{ secrets.TAP_PUSH_TOKEN || github.token }}
           path: homebrew-tap
 
       - name: Update formulae with new version + sha256
@@ -227,6 +226,10 @@ jobs:
       - name: Commit + push tap update
         working-directory: homebrew-tap
         run: |
+          if [[ -z "${{ secrets.TAP_PUSH_TOKEN }}" ]]; then
+            echo "TAP_PUSH_TOKEN is not set; skipping Homebrew tap push."
+            exit 0
+          fi
           VERSION="${{ needs.build.outputs.version }}"
           git config user.name  "HackPoint"
           git config user.email "6758579+HackPoint@users.noreply.github.com"

From 453d73f11154b663d88b79f98419f39b9570a34f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 9 Jun 2026 07:27:38 +0000
Subject: [PATCH 4/5] fix: skip tap update steps when TAP_PUSH_TOKEN is
 unavailable

---
 .github/workflows/release.yml | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7f169ad..b8068e2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -185,6 +185,16 @@ jobs:
       - name: Checkout lumen (for formula templates)
         uses: actions/checkout@v4
 
+      - name: Check TAP_PUSH_TOKEN availability
+        id: tap_token
+        run: |
+          if [[ -n "${{ secrets.TAP_PUSH_TOKEN }}" ]]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            echo "TAP_PUSH_TOKEN is not set; skipping Homebrew tap update."
+          fi
+
       # TAP_PUSH_TOKEN is a GitHub Personal Access Token with `repo` scope on
       # HackPoint/homebrew-tap. GITHUB_TOKEN is scoped to this repo and cannot
       # push to another repo.
@@ -197,13 +207,15 @@ jobs:
       #   4. HackPoint/lumen → Settings → Secrets and variables → Actions → New secret
       #      Name: TAP_PUSH_TOKEN    Value: (paste token)
       - name: Checkout homebrew-tap
+        if: steps.tap_token.outputs.configured == 'true'
         uses: actions/checkout@v4
         with:
           repository: HackPoint/homebrew-tap
-          token: ${{ secrets.TAP_PUSH_TOKEN || github.token }}
+          token: ${{ secrets.TAP_PUSH_TOKEN }}
           path: homebrew-tap
 
       - name: Update formulae with new version + sha256
+        if: steps.tap_token.outputs.configured == 'true'
         run: |
           VERSION="${{ needs.build.outputs.version }}"
           DMG_SHA="${{ needs.build.outputs.dmg_sha256 }}"
@@ -224,12 +236,9 @@ jobs:
           grep -E 'version|sha256' "$FORMULA"
 
       - name: Commit + push tap update
+        if: steps.tap_token.outputs.configured == 'true'
         working-directory: homebrew-tap
         run: |
-          if [[ -z "${{ secrets.TAP_PUSH_TOKEN }}" ]]; then
-            echo "TAP_PUSH_TOKEN is not set; skipping Homebrew tap push."
-            exit 0
-          fi
           VERSION="${{ needs.build.outputs.version }}"
           git config user.name  "HackPoint"
           git config user.email "6758579+HackPoint@users.noreply.github.com"

From e87c8f3fb8a70863e7b7600b511f7e2401b7eb60 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 9 Jun 2026 07:28:14 +0000
Subject: [PATCH 5/5] chore: harden tap token availability check

---
 .github/workflows/release.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b8068e2..794bbb6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -187,8 +187,10 @@ jobs:
 
       - name: Check TAP_PUSH_TOKEN availability
         id: tap_token
+        env:
+          TAP_PUSH_TOKEN: ${{ secrets.TAP_PUSH_TOKEN }}
         run: |
-          if [[ -n "${{ secrets.TAP_PUSH_TOKEN }}" ]]; then
+          if [[ -n "$TAP_PUSH_TOKEN" ]]; then
             echo "configured=true" >> "$GITHUB_OUTPUT"
           else
             echo "configured=false" >> "$GITHUB_OUTPUT"