release: remove debug job, gate brew upload on HOMEBREW_TAP_TOKEN

- debug job served its purpose (proved workflow_run fires correctly)
  and is gone
- restore the [skip-release] guard
- brews.skip_upload is now a go-template that evaluates to true when
  HOMEBREW_TAP_TOKEN is empty, so tag pushes before the tap is
  created don't fail the whole release (v0.0.1 cut fine but the
  goreleaser exit code was 1 because the brew step 401'd)

commit: 4d847ec6335d747449fe362aee2de0b983b0b74c
author: patriceckhart · 6mo ago · 2026-04-18 09:21 UTC
parent: 75aa6d4
signature: unsigned

2 files · +12 -28

M .github/workflows/release.yml +6 -23


@@ -30,28 +30,10 @@ concurrency:
30	30		cancel-in-progress: false
31	31
32	32		jobs:
33		-	debug:
34		-	# One-shot diagnostic job with no if-filter: dumps the full
35		-	# workflow_run context so we can see what fields are actually
36		-	# populated on the webhook payload. Remove once the release job
37		-	# starts firing reliably.
38		-	runs-on: ubuntu-latest
39		-	steps:
40		-	- name: dump workflow_run
41		-	env:
42		-	WR: ${{ toJSON(github.event.workflow_run) }}
43		-	run: \|
44		-	echo "conclusion: ${{ github.event.workflow_run.conclusion }}"
45		-	echo "head_branch: ${{ github.event.workflow_run.head_branch }}"
46		-	echo "head_sha: ${{ github.event.workflow_run.head_sha }}"
47		-	echo "---"
48		-	printenv WR \| head -c 2000
49		-
50	33		release:
51		-	needs: debug
52	34		# Only run when ci succeeded and we're on main, and when the head
53	35		# commit doesn't opt out via [skip-release].
54		-	if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' }}
	36	+	if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' && !contains(github.event.workflow_run.head_commit.message, '[skip-release]') }}
55	37		runs-on: ubuntu-latest
56	38		steps:
57	39		- name: checkout

@@ -113,7 +95,8 @@ jobs:
113	95		# goreleaser reads the tag we just pushed and builds binaries
114	96		# for every (goos, goarch) combination in .goreleaser.yaml.
115	97		GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
116		-	# Optional: PAT with `repo` scope for patriceckhart/homebrew-tap
117		-	# so we can push a Formula/zot.rb update on every release.
118		-	# If unset, goreleaser skips the brew step (skip_upload: auto).
119		-	HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
	98	+	# Optional PAT with `repo` scope for patriceckhart/homebrew-tap.
	99	+	# Always exported (as empty string when the secret is unset)
	100	+	# so the goreleaser template that gates the brew upload on
	101	+	# this value can evaluate without errors.
	102	+	HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN \|\| '' }}

   cancel-in-progress: false
 jobs:
-  debug:
-    # One-shot diagnostic job with no if-filter: dumps the full
-    # workflow_run context so we can see what fields are actually
-    # populated on the webhook payload. Remove once the release job
-    # starts firing reliably.
-    runs-on: ubuntu-latest
-    steps:
-      - name: dump workflow_run
-        env:
-          WR: ${{ toJSON(github.event.workflow_run) }}
-        run: |
-          echo "conclusion: ${{ github.event.workflow_run.conclusion }}"
-          echo "head_branch: ${{ github.event.workflow_run.head_branch }}"
-          echo "head_sha: ${{ github.event.workflow_run.head_sha }}"
-          echo "---"
-          printenv WR | head -c 2000
   release:
-    needs: debug
     # Only run when ci succeeded and we're on main, and when the head
     # commit doesn't opt out via [skip-release].
-    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' && !contains(github.event.workflow_run.head_commit.message, '[skip-release]') }}
     runs-on: ubuntu-latest
     steps:
       - name: checkout
           # goreleaser reads the tag we just pushed and builds binaries
           # for every (goos, goarch) combination in .goreleaser.yaml.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Optional: PAT with `repo` scope for patriceckhart/homebrew-tap
+          # Optional PAT with `repo` scope for patriceckhart/homebrew-tap.
-          # so we can push a Formula/zot.rb update on every release.
+          # Always exported (as empty string when the secret is unset)
-          # If unset, goreleaser skips the brew step (skip_upload: auto).
+          # so the goreleaser template that gates the brew upload on
-          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          # this value can evaluate without errors.
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN || '' }}

M .goreleaser.yaml +6 -5


@@ -102,8 +102,9 @@ release:
102	102		# Optional: publish a Homebrew formula to a tap repo on every release.
103	103		# Requires the tap repo to exist at github.com/patriceckhart/homebrew-tap
104	104		# and a PAT with `repo` scope exported as `HOMEBREW_TAP_TOKEN` in the
105		-	# release workflow. Safe to leave enabled even before the tap exists;
106		-	# goreleaser skips it when the token isn't set.
	105	+	# release workflow. The skip_upload expression disables the step when
	106	+	# the token isn't set, so tag pushes before the tap is created don't
	107	+	# fail the whole release.
107	108		brews:
108	109		- repository:
109	110		owner: patriceckhart

@@ -117,6 +118,6 @@ brews:
117	118		bin.install "zot"
118	119		test: \|
119	120		system "#{bin}/zot", "--help"
120		-	# Only publish the formula when the token is actually set, so
121		-	# ordinary tag pushes from forks don't explode.
122		-	skip_upload: auto
	121	+	# Skip the formula upload when HOMEBREW_TAP_TOKEN is empty. Auto
	122	+	# only skips for prereleases/snapshots, which isn't what we want.
	123	+	skip_upload: '{{ if eq .Env.HOMEBREW_TAP_TOKEN "" }}true{{ else }}false{{ end }}'

 # Optional: publish a Homebrew formula to a tap repo on every release.
 # Requires the tap repo to exist at github.com/patriceckhart/homebrew-tap
 # and a PAT with `repo` scope exported as `HOMEBREW_TAP_TOKEN` in the
-# release workflow. Safe to leave enabled even before the tap exists;
+# release workflow. The skip_upload expression disables the step when
-# goreleaser skips it when the token isn't set.
+# the token isn't set, so tag pushes before the tap is created don't
+# fail the whole release.
 brews:
   - repository:
       owner: patriceckhart
       bin.install "zot"
     test: |
       system "#{bin}/zot", "--help"
-    # Only publish the formula when the token is actually set, so
+    # Skip the formula upload when HOMEBREW_TAP_TOKEN is empty. Auto
-    # ordinary tag pushes from forks don't explode.
+    # only skips for prereleases/snapshots, which isn't what we want.
-    skip_upload: auto
+    skip_upload: '{{ if eq .Env.HOMEBREW_TAP_TOKEN "" }}true{{ else }}false{{ end }}'