ci: harden nightly cask publish workflow

Author: danielewood

.github/workflows/nightly-cask.yml

@@ -6,6 +6,10 @@ on:
       - main
   workflow_dispatch:
 
+concurrency:
+  group: nightly-cask
+  cancel-in-progress: true
+
 permissions:
   contents: write
 
@@ -70,18 +74,19 @@ jobs:
 
           gh release upload nightly /tmp/nightly-dist/*.tar.gz
 
-      - name: Clone tap repository
-        env:
-          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-        run: |
-          set -euo pipefail
-          git clone "https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/sensiblebit/homebrew-tap.git" /tmp/homebrew-tap
+      - name: Checkout tap repository
+        uses: actions/checkout@v6
+        with:
+          repository: sensiblebit/homebrew-tap
+          path: homebrew-tap
+          fetch-depth: 0
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
 
       - name: Render nightly cask
         run: |
           set -euo pipefail
-          mkdir -p /tmp/homebrew-tap/Casks
-          cat > /tmp/homebrew-tap/Casks/certkit@nightly.rb <<EOF
+          mkdir -p homebrew-tap/Casks
+          cat > homebrew-tap/Casks/certkit@nightly.rb <<EOF
 # This file is auto-generated by certkit nightly workflow. DO NOT EDIT.
 cask "certkit@nightly" do
   name "certkit nightly"
@@ -94,6 +99,12 @@ cask "certkit@nightly" do
   end
 
   conflicts_with cask: "certkit"
+
+  postflight do
+    system_command "/usr/bin/xattr",
+                   args: ["-dr", "com.apple.quarantine", "#{staged_path}"]
+  end
+
   binary "certkit"
 
   on_macos do
@@ -120,7 +131,7 @@ cask "certkit@nightly" do
 end
 EOF
 
-          stable_cask="/tmp/homebrew-tap/Casks/certkit.rb"
+          stable_cask="homebrew-tap/Casks/certkit.rb"
           if [[ -f "${stable_cask}" ]] && ! grep -q 'conflicts_with cask: "certkit@nightly"' "${stable_cask}"; then
             awk '
               /^[[:space:]]*binary "certkit"/ && !inserted {
@@ -140,17 +151,10 @@ EOF
       - name: Commit and push tap update
         run: |
           set -euo pipefail
-          cd /tmp/homebrew-tap
-
-          changed=0
-          if ! git diff --quiet -- Casks/certkit@nightly.rb; then
-            changed=1
-          fi
-          if [[ -f Casks/certkit.rb ]] && ! git diff --quiet -- Casks/certkit.rb; then
-            changed=1
-          fi
+          cd homebrew-tap
 
-          if [[ "${changed}" -eq 0 ]]; then
+          changed_files="$(git status --porcelain -- Casks/certkit@nightly.rb Casks/certkit.rb || true)"
+          if [[ -z "${changed_files}" ]]; then
             echo "No cask changes detected."
             exit 0
           fi