From 9538cefbf43ead4784a8eda359f6741d6df13637 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Asger=20Geel=20Weirs=C3=B8e?= <github@weircon.dk>
Date: Wed, 30 Sep 2026 20:03:00 +0200
Subject: [PATCH] Fix the release token and the Homebrew tap update

Gitea refuses secret names starting with GITEA_, so GITEA_TOKEN could
never be set and every release failed; it is RELEASE_TOKEN now. git over
HTTP is disabled on this Gitea, so the tap formula is updated through
the contents API instead of a clone and push.

Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG
---
 .gitea/workflows/release.yml | 51 ++++++++++++++++++++++++------------
 1 file changed, 34 insertions(+), 17 deletions(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 9779b14..42b4617 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -13,7 +13,7 @@ jobs:
       image: archlinux:base-devel
     steps:
       - name: Install system dependencies
-        run: pacman -Syu --noconfirm --needed base-devel git openssh nodejs rust meson ninja gtk3 gtk-session-lock gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad-libs pam curl
+        run: pacman -Syu --noconfirm --needed base-devel git openssh nodejs rust meson ninja gtk3 gtk-session-lock gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad-libs pam curl python
 
       - uses: actions/checkout@v4
 
@@ -40,30 +40,47 @@ jobs:
           tar czf ahfail-linux-x86_64.tar.gz -C dist .
 
       - name: Upload release asset
-        # Requires a GITEA_TOKEN secret with write:repository scope.
-        # Create it in repo Settings → Secrets.
+        # RELEASE_TOKEN: an agw token with write:repository scope. Gitea refuses
+        # secret names that start with GITEA_ or GITHUB_, so it cannot be called
+        # GITEA_TOKEN.
         uses: https://gitea.com/actions/gitea-release-action@v1
         with:
-          token: ${{ secrets.GITEA_TOKEN }}
+          token: ${{ secrets.RELEASE_TOKEN }}
           server_url: ${{ github.server_url }}
           tag_name: ${{ github.ref_name }}
           name: ${{ github.ref_name }}
           files: ahfail-linux-x86_64.tar.gz
 
       - name: Update Homebrew tap
+        # git over HTTP is disabled on this Gitea on purpose, so the formula is
+        # updated through the contents API instead of a clone and push.
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           TAG: ${{ github.ref_name }}
+          API: ${{ github.server_url }}/api/v1/repos/agw/homebrew-ahfail/contents/Formula/ahfail.rb
         run: |
-          set -euo pipefail
-          git clone \
-            "https://oauth2:${GITEA_TOKEN}@gitea.weircon.dk/agw/homebrew-ahfail.git" \
-            tap
-          cd tap
-          sed -i "s|url \".*\"|url \"https://gitea.weircon.dk/agw/gtk-ahfail/archive/${TAG}.tar.gz\"|" Formula/ahfail.rb
-          sed -i "s|sha256 \".*\"|sha256 \"${SOURCE_SHA256}\"|" Formula/ahfail.rb
-          git config user.email "actions@weircon.dk"
-          git config user.name "Gitea Actions"
-          git add Formula/ahfail.rb
-          git diff --cached --quiet || git commit -m "chore: update ahfail to ${TAG}"
-          git push
+          python3 - <<'PY'
+          import base64, json, os, re, urllib.request
+
+          api, token, tag = os.environ["API"], os.environ["RELEASE_TOKEN"], os.environ["TAG"]
+          sha256 = os.environ["SOURCE_SHA256"]
+          headers = {"Authorization": f"token {token}", "Content-Type": "application/json"}
+
+          with urllib.request.urlopen(urllib.request.Request(api, headers=headers)) as r:
+              current = json.load(r)
+          formula = base64.b64decode(current["content"]).decode()
+          new = re.sub(r'url ".*?"', f'url "https://gitea.weircon.dk/agw/gtk-ahfail/archive/{tag}.tar.gz"', formula, count=1)
+          new = re.sub(r'sha256 ".*?"', f'sha256 "{sha256}"', new, count=1)
+          if new == formula:
+              print("formula already up to date")
+              raise SystemExit(0)
+
+          body = json.dumps({
+              "content": base64.b64encode(new.encode()).decode(),
+              "sha": current["sha"],
+              "message": f"chore: update ahfail to {tag}",
+          }).encode()
+          req = urllib.request.Request(api, data=body, headers=headers, method="PUT")
+          with urllib.request.urlopen(req) as r:
+              print("formula updated:", r.status)
+          PY