Merge pull request #23042 from Homebrew/github-actions-auto-commits

Use Actions bot for vendor-gems

Author: MikeMcQuaid

.github/workflows/vendor-gems.yml

@@ -10,7 +10,10 @@ on:
       - Library/Homebrew/Gemfile*
   push:
     paths:
+      - .github/licensed.yml
       - .github/workflows/vendor-gems.yml
+      - Library/Homebrew/dev-cmd/vendor-gems.rb
+      - Library/Homebrew/Gemfile*
     branches-ignore:
       - main
       - master
@@ -20,9 +23,7 @@ on:
         description: Pull request number
         required: true
 
-permissions:
-  contents: read
-  pull-requests: read
+permissions: {}
 
 defaults:
   run:
@@ -32,6 +33,9 @@ jobs:
   vendor-gems:
     if: github.repository_owner == 'Homebrew'
     runs-on: macos-26
+    permissions:
+      contents: write
+      pull-requests: read
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
@@ -41,22 +45,22 @@ jobs:
           cask: false
 
       - name: Configure Git user
-        if: github.event_name == 'workflow_dispatch'
+        if: github.event_name != 'pull_request'
         uses: Homebrew/actions/git-user-config@1f8e202ffddf94def7f42f6fa3a482e821489f9c # 2026.07.10.1
         with:
-          username: BrewTestBot
-
-      - name: Set up commit signing
-        if: github.event_name == 'workflow_dispatch'
-        uses: Homebrew/actions/setup-commit-signing@1f8e202ffddf94def7f42f6fa3a482e821489f9c # 2026.07.10.1
-        with:
-          signing_key: ${{ secrets.BREWTESTBOT_SSH_SIGNING_KEY }}
+          username: github-actions[bot]
 
-      - name: Check out pull request
-        id: checkout
-        if: github.event_name == 'workflow_dispatch'
+      - name: Prepare push target
+        id: push-target
+        if: github.event_name != 'pull_request'
         run: |
-          gh pr checkout "${PR}"
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]
+          then
+            gh pr checkout "${PR}"
+          else
+            git fetch origin "+refs/heads/${GITHUB_REF_NAME}:refs/remotes/origin/${GITHUB_REF_NAME}"
+            git checkout --no-track -B "${GITHUB_REF_NAME}" "origin/${GITHUB_REF_NAME}"
+          fi
 
           branch="$(git branch --show-current)"
           echo "branch=${branch}" >> "$GITHUB_OUTPUT"
@@ -65,16 +69,16 @@ jobs:
           echo "gem_name=${gem_name}" >> "$GITHUB_OUTPUT"
         env:
           PR: ${{ github.event.pull_request.number || github.event.inputs.pull_request }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
 
       - name: Vendor Gems
         run: |
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]
+          if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]
           then
-            brew vendor-gems --non-bundler-gems
-          else
             brew vendor-gems --non-bundler-gems --no-commit
+          else
+            brew vendor-gems --non-bundler-gems
           fi
 
       - name: Install CMake and Licensed
@@ -93,9 +97,9 @@ jobs:
           licensed status --config .github/licensed.yml
 
       - name: Commit licence metadata changes
-        if: github.event_name == 'workflow_dispatch'
+        if: github.event_name != 'pull_request'
         env:
-          GEM_NAME: ${{ steps.checkout.outputs.gem_name }}
+          GEM_NAME: ${{ steps.push-target.outputs.gem_name }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
         run: |
           if [[ -n "$(git status --porcelain -- ".licenses")" ]]
@@ -109,9 +113,9 @@ jobs:
         run: brew typecheck --update
 
       - name: Commit RBI changes
-        if: github.event_name == 'workflow_dispatch'
+        if: github.event_name != 'pull_request'
         env:
-          GEM_NAME: ${{ steps.checkout.outputs.gem_name }}
+          GEM_NAME: ${{ steps.push-target.outputs.gem_name }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
         run: |
           if [[ -n "$(git status --porcelain -- "Library/Homebrew/sorbet")" ]]
@@ -121,22 +125,13 @@ jobs:
                        -m "Autogenerated by the [vendor-gems](https://github.com/Homebrew/brew/blob/HEAD/.github/workflows/vendor-gems.yml) workflow."
           fi
 
-      - name: Generate push token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        if: github.event_name == 'workflow_dispatch'
-        with:
-          client-id: ${{ vars.BREW_COMMIT_CLIENT_ID }}
-          private-key: ${{ secrets.BREW_COMMIT_APP_KEY }}
-          permission-contents: write
-
       - name: Push to pull request
-        if: github.event_name == 'workflow_dispatch'
+        if: github.event_name != 'pull_request'
         uses: Homebrew/actions/git-try-push@1f8e202ffddf94def7f42f6fa3a482e821489f9c # 2026.07.10.1
         with:
-          token: ${{ steps.app-token.outputs.token }}
+          token: ${{ github.token }}
           directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
-          branch: ${{ steps.checkout.outputs.branch }}
+          branch: ${{ steps.push-target.outputs.branch }}
           force: true
 
       - name: Check vendor and RBI files are in sync