From ac62d5681f375dfda46fc7e4a2448490c9547ae1 Mon Sep 17 00:00:00 2001 From: Peter Balogh Date: Tue, 14 Jul 2026 08:07:52 +0200 Subject: [PATCH 1/4] ci: update build cluster Signed-off-by: Peter Balogh --- .github/workflows/docker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 3f90902..ce376f8 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -17,7 +17,7 @@ jobs: matrix: architecture: [x86_64, aarch64] fail-fast: false - runs-on: ${{ fromJSON(format('["self-hosted", "build", "{0}"]', matrix.architecture)) }} + runs-on: build-${{ matrix.architecture }} steps: - name: Setup docker arch From 3058bb0c61b0ff43b45a7745de833319d7e8073e Mon Sep 17 00:00:00 2001 From: Peter Balogh Date: Tue, 14 Jul 2026 08:28:58 +0200 Subject: [PATCH 2/4] ci: run docker builds on github-hosted runners The repository is now public, so switch the multi-arch docker build from self-hosted runners to GitHub-hosted amd64 (ubuntu-24.04) and arm64 (ubuntu-24.04-arm) runners. Signed-off-by: Peter Balogh --- .github/workflows/docker.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index ce376f8..76329a5 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -15,9 +15,13 @@ jobs: build-image: strategy: matrix: - architecture: [x86_64, aarch64] + include: + - architecture: x86_64 + runner: ubuntu-24.04 + - architecture: aarch64 + runner: ubuntu-24.04-arm fail-fast: false - runs-on: build-${{ matrix.architecture }} + runs-on: ${{ matrix.runner }} steps: - name: Setup docker arch From 9786a987d4f6c50f509c1c5d909f0e78db133682 Mon Sep 17 00:00:00 2001 From: Peter Balogh Date: Tue, 14 Jul 2026 08:51:59 +0200 Subject: [PATCH 3/4] ci: use repo token for homebrew tap in release workflow Replace the GitHub App token generation with a repo-level HOMEBREW_KEYLEDGER secret for pushing to the homebrew tap, and use github.token for the release itself. This removes the dependency on org-level app credentials that are not visible to the now-public repository. Signed-off-by: Peter Balogh --- .github/workflows/release.yml | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f312381..397aeae 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,15 +16,6 @@ jobs: with: fetch-depth: 0 - - name: Generate token - id: generate-token - uses: actions/create-github-app-token@v1 - with: - app-id: ${{ vars.RIPTIDES_CI_APP_ID }} - private-key: ${{ secrets.RIPTIDES_CI_PRIVATE_KEY }} - repositories: homebrew-keyledger - owner: ${{ github.repository_owner }} - - uses: actions/setup-go@v5 with: go-version-file: go.mod @@ -34,5 +25,5 @@ jobs: version: "~> v2" args: release --clean env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }} + GITHUB_TOKEN: ${{ github.token }} + HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_KEYLEDGER }} From 9c1b5ea826fe49a01e0c01805d877996a2ff7a61 Mon Sep 17 00:00:00 2001 From: Peter Balogh Date: Tue, 14 Jul 2026 09:09:14 +0200 Subject: [PATCH 4/4] ci: replace existing release artifacts on re-run Set replace_existing_artifacts so re-running a release for an existing tag overwrites already-uploaded assets instead of failing with 422 already_exists. Signed-off-by: Peter Balogh --- .goreleaser.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 69216eb..25b30d5 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -38,6 +38,7 @@ release: github: owner: riptideslabs name: keyledger + replace_existing_artifacts: true brews: - name: keyledger