From 03a6259bf5bcaf2827769add338ec791be6ad24d Mon Sep 17 00:00:00 2001
From: Joey Parrish <joeyparrish@google.com>
Date: Thu, 19 Dec 2024 17:00:17 -0800
Subject: [PATCH] ci: Fix macOS deployment workflow

---
 .github/workflows/release.yaml | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index cb711e6..0d70409 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -198,9 +198,13 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: '${{ secrets.HOMEBREW_TAP_REPO }}'
-          fetch-depth: 0  # The entire repo history, so we can push an update
-          # To push to this repo, an explicit token is used to authenticate.
-          persist-credentials: false
+          # Get the entire repo history, so we can push an update.
+          fetch-depth: 0
+          # To push to the tap repo, an explicit token is used to authenticate,
+          # and we persist it for the later step where we push.  Nothing is
+          # executed in this job.  Files are copied and staged only.
+          token: '${{ secrets.HOMEBREW_DEPLOY_TOKEN }}'
+          persist-credentials: true
 
       - name: Wipe source and formula folders
         run: |
@@ -245,9 +249,4 @@ jobs:
           git commit -m "Release $PACKAGE_VERSION"
 
       - name: Push homebrew repo
-        run: |
-          # Remove default authentication headers from GitHub Actions
-          # environment, since we're pushing to a different repo as a different
-          # user.
-          git config --unset-all http.https://github.com/.extraheader
-          git push https://shaka-bot:${{ secrets.HOMEBREW_DEPLOY_TOKEN }}@github.com/${{ secrets.HOMEBREW_TAP_REPO }}
+        run: git push