From 5049d93a3a4089f582388977a8b1106fe4cc9cb1 Mon Sep 17 00:00:00 2001
From: K1-R1 <77465250+K1-R1@users.noreply.github.com>
Date: Sun, 15 Mar 2026 19:21:31 +0000
Subject: [PATCH] fix: replace mislav action with shell script for tap updates

mislav/bump-homebrew-formula-action v3.6 uses the GitHub REST API to
create refs, which returns 403 with fine-grained PATs. A direct git
push via HTTPS (x-access-token) works correctly and is simpler.

Also removes the Node.js 20 runtime dependency that was due for
deprecation in June 2026.

Signed-off-by: K1-R1 <77465250+K1-R1@users.noreply.github.com>
---
 .github/workflows/release.yml | 28 ++++++++++++++++++++++++----
 CHANGELOG.md                  |  3 +++
 MAINTAINING.md                |  8 --------
 3 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d5d4171..052c366 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -114,9 +114,29 @@ jobs:
     # No repo permissions needed — the PAT authenticates to the tap repo.
     permissions: {}
     steps:
-      - uses: mislav/bump-homebrew-formula-action@56a283fa15557e9abaa4bdb63b8212abc68e655c # tag: v3.6
-        with:
-          formula-name: smoosh
-          homebrew-tap: K1-R1/homebrew-tap
+      - name: Update formula
         env:
           COMMITTER_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          version="${TAG_NAME#v}"
+          tarball_url="https://github.com/K1-R1/smoosh/archive/refs/tags/${TAG_NAME}.tar.gz"
+
+          # Compute SHA256 from the release tarball.
+          curl -fsSL "${tarball_url}" -o /tmp/smoosh-src.tar.gz
+          sha256="$(sha256sum /tmp/smoosh-src.tar.gz | awk '{print $1}')"
+
+          # Clone, patch, push.
+          git clone \
+            "https://x-access-token:${COMMITTER_TOKEN}@github.com/K1-R1/homebrew-tap.git" \
+            /tmp/homebrew-tap
+          cd /tmp/homebrew-tap
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+
+          sed -i "s|url \".*\"|url \"${tarball_url}\"|" Formula/smoosh.rb
+          sed -i "s|sha256 \".*\"|sha256 \"${sha256}\"|" Formula/smoosh.rb
+
+          git add Formula/smoosh.rb
+          git commit -m "smoosh ${version}"
+          git push origin main
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a4cd2a0..975b16f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,6 +34,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 - CI and release workflow install shfmt via `go install` (Go module sum
   database) instead of a raw binary download, which had no integrity check.
+- Homebrew tap update replaced `mislav/bump-homebrew-formula-action` with a
+  shell script — removes the Node.js 20 runtime dependency and works
+  reliably with fine-grained PATs.
 - Demo GIFs and VHS tape moved to `assets/` directory.
 
 ## [1.0.0] - 2026-03-14
diff --git a/MAINTAINING.md b/MAINTAINING.md
index f22d596..b748add 100644
--- a/MAINTAINING.md
+++ b/MAINTAINING.md
@@ -33,7 +33,6 @@ Everything else needs manual bumping.
 |---|---|---|
 | `actions/checkout` | `ci.yml`, `release.yml` | v6.0.2 |
 | `actions/upload-artifact` | `ci.yml` | v7.0.0 |
-| `mislav/bump-homebrew-formula-action` | `release.yml` | v3.6 |
 
 ### Manual
 
@@ -50,13 +49,6 @@ When bumping a manual dependency: update the version pin, run CI locally
 (`prek run && bats test/*.bats`), and commit with
 `chore: bump <tool> to vX.Y.Z`.
 
-## Known deprecation
-
-`mislav/bump-homebrew-formula-action` v3.6 uses the Node.js 20 runtime,
-which GitHub deprecates in **June 2026**. Watch for a v4 release or plan
-a replacement (a shell script in the release workflow that computes the
-SHA256 and commits to the tap directly).
-
 ## Periodic checks
 
 **Quarterly — dependency audit**