From bc0a1228a29d2626b9de7330a3aa229755913827 Mon Sep 17 00:00:00 2001 From: Adhik Joshi Date: Fri, 18 Sep 2026 21:17:10 +0530 Subject: [PATCH] Render the tap tokens the only way goreleaser allows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first release run with a working tap PAT (the v0.2.1 retry) failed: homebrew cask: template: failed to apply "{{ envOrDefault \"HOMEBREW_TAP_GITHUB_TOKEN\" \"unset\" }}": function "envOrDefault" not defined goreleaser renders a repository token through ApplySingleEnvOnly, which accepts exactly `{{ .Env.NAME }}` (^{{\s*\.Env\.[^.\s}]+\s*}}$) and has no template functions. envOrDefault went in with #8 and was never exercised: while the PATs were dead, skip_upload short-circuited the publish before the token was rendered, so `goreleaser check` and every skipped run passed. skip_upload keeps envOrDefault — that field goes through the full template engine, and there an unset variable must still read as "false". The GitHub assets that retry replaced are intact: all ten match checksums.txt. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01NJxK2YGapyVchfyE1F8CpR --- .goreleaser.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.goreleaser.yml b/.goreleaser.yml index 8d85f0d..45b67c5 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -69,12 +69,21 @@ homebrew_casks: # a credential that only affects two optional install channels. A dead tap # token now degrades the release instead of ending it. # - # envOrDefault, not .Env: an unset secret must not fail config loading. + # skip_upload uses envOrDefault so an unset variable reads as "false". + # + # token must NOT. goreleaser renders a repository token through + # ApplySingleEnvOnly, which accepts exactly `{{ .Env.NAME }}` and has no + # template functions at all, so envOrDefault there fails with + # 'function "envOrDefault" not defined'. That went unnoticed until the first + # run with a working PAT: while the taps were skipped, the token was never + # rendered. The token is only rendered when the tap is published, and the + # workflow always sets the variable (empty when the secret is missing, in + # which case the probe has already set skip_upload). - skip_upload: '{{ envOrDefault "SKIP_HOMEBREW" "false" }}' repository: owner: ModelsLab name: homebrew-tap - token: '{{ envOrDefault "HOMEBREW_TAP_GITHUB_TOKEN" "unset" }}' + token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}" homepage: https://modelslab.sh description: "ModelsLab CLI — AI generation and account management from the terminal" @@ -84,7 +93,7 @@ scoops: repository: owner: ModelsLab name: scoop-bucket - token: '{{ envOrDefault "SCOOP_BUCKET_GITHUB_TOKEN" "unset" }}' + token: "{{ .Env.SCOOP_BUCKET_GITHUB_TOKEN }}" homepage: https://modelslab.sh description: "ModelsLab CLI — AI generation and account management from the terminal" license: MIT