@.github/workflows/release-cli.yml release seems to be failing

Let me investigate the CLI build setup and check for recent workflow run failures.

All 5 recent runs have failed. Let me check the latest failure details.

Let me also check if earlier runs had different failures.

Found the issues. There are two problems:

1. HOMEBREW_TAP_TOKEN secret is not set (current failure)

The logs show HOMEBREW_TAP_TOKEN: is empty. GitHub Actions would mask it as *** if it were set. The git push fails with:

remote: Invalid username or token. Password authentication is not supported for Git operations.

You need to create a GitHub Personal Access Token (classic) with repo scope for the JustinyAhin/homebrew-threadcast repo and add it as a secret named HOMEBREW_TAP_TOKEN in the threadcast repo settings.

2. Binary name mismatch in Homebrew formula (latent bug)

The tar archives contain files named threadcast-darwin-arm64, threadcast-linux-x64, etc. But the formula does:

def install
  bin.install "threadcast"   # looks for a file named "threadcast"
end

This will fail at brew install time because there's no file called threadcast inside the archive — it's called threadcast-darwin-arm64 (etc.).

Fix — rename the binary to threadcast before creating the tar.gz:

Now fix issue 1 — set the HOMEBREW_TAP_TOKEN secret. You'll need to:

1. Go to github.com/JustinyAhin/threadcast → Settings → Secrets and variables → Actions
2. Add a repository secret named HOMEBREW_TAP_TOKEN with a Personal Access Token (classic) that has repo scope and access to JustinyAhin/homebrew-threadcast

The binary naming fix is committed locally and ready to push when you're ready.

1. Go to github.com → click your profile picture → Settings
2. Scroll down the left sidebar → Developer settings
3. Personal access tokens → Tokens (classic)
4. Click Generate new token → Generate new token (classic)
5. Give it a name like homebrew-tap
6. Set an expiration (or no expiration)
7. Check the repo scope (full control of private repositories)
8. Click Generate token
9. Copy the token immediately (you won't see it again)

Then add it as a secret:

1. Go to github.com/JustinyAhin/threadcast → Settings → Secrets and variables → Actions
2. Click New repository secret
3. Name: HOMEBREW_TAP_TOKEN
4. Value: paste the token
5. Click Add secret

You're right, fine-grained is the better choice here. I defaulted to classic out of habit, but fine-grained lets you scope it tighter.

With a fine-grained token:

1. Set Resource owner to JustinyAhin
2. Repository access → Only select repositories → pick homebrew-threadcast
3. Permissions → Repository permissions → Contents: Read and write
4. That's it — no other permissions needed

This is more secure since it only grants write access to that one repo instead of all repos under your account.

Yes, that's fine. The HOMEBREW_TAP_TOKEN is only used to clone and push to homebrew-threadcast. It doesn't need access to threadcast itself.

The workflow already uses ${{ github.token }} (line 77) for downloading release assets from the private threadcast repo — that's provided automatically by GitHub Actions.

Once you've set the secret and run the release workflow successfully:

brew tap JustinyAhin/threadcast
brew install threadcast

If you want to install it right now without waiting for the release, you can build locally:

bun run --filter @threadcast/cli build

Then copy the binary from packages/cli/dist/threadcast-darwin-arm64 to somewhere on your PATH:

cp packages/cli/dist/threadcast-darwin-arm64 /usr/local/bin/threadcast

Release looks good! All 8 assets (4 raw binaries + 4 tar.gz archives) are there and the workflow passed (green checkmark).

You should now be able to install via Homebrew:

brew tap JustinyAhin/threadcast
brew install threadcast

The repo is private, so Homebrew can't download the release assets — they require authentication.

You have a few options:

1. Make the repo public — simplest fix, Homebrew will just work
2. Host binaries elsewhere (S3, Cloudflare R2, etc.) — keep repo private but serve assets from a public URL
3. Set HOMEBREW_GITHUB_API_TOKEN — works for you locally, but anyone else installing would need to do the same

Which approach works for you?

Here's what you need to set up:

R2 Setup

1. Cloudflare Dashboard → R2 → Create bucket (e.g. threadcast-releases)
2. Settings → Public access → enable either the r2.dev subdomain or a custom domain
3. R2 → Manage R2 API Tokens → Create API token with Object Read & Write on that bucket
4. Copy the Access Key ID, Secret Access Key, and note your account ID

GitHub Secrets

Add these to JustinyAhin/threadcast → Settings → Secrets:

• R2_ACCESS_KEY_ID
• R2_SECRET_ACCESS_KEY
• R2_ENDPOINT — https://<account-id>.r2.cloudflarestorage.com
• R2_PUBLIC_URL — your bucket's public URL (e.g. https://pub-xxx.r2.dev or your custom domain)

Workflow Changes

Here's what changed:

1. release job — added an "Upload to R2" step that copies the .tar.gz files to s3://threadcast-releases/cli/v{version}/
2. update-homebrew job — downloads checksums from R2 instead of GitHub releases, and the formula URLs now point to R2_PUBLIC_URL instead of GitHub

Secrets you need to add

The R2 bucket name is hardcoded as threadcast-releases — adjust if you name it differently.

The formula in homebrew-threadcast still has the old GitHub URLs — the workflow changes haven't been released yet.

To get it working you need to:

1. Create the R2 bucket + secrets (as described above)
2. Push the workflow changes
3. Run the release workflow again

Or if you want to test it right now before re-running the full release, you can manually upload the existing tarballs and update the formula:

# Download the tarballs from the existing GitHub release
gh release download cli-v0.0.1 --pattern "*.tar.gz" --dir /tmp/tc-release

# Upload to R2 (replace with your actual values)
for f in /tmp/tc-release/threadcast-*.tar.gz; do
  aws s3 cp "$f" "s3://threadcast-releases/cli/v0.0.1/$(basename "$f")" \
    --endpoint-url "https://<account-id>.r2.cloudflarestorage.com"
done

Then update the formula in homebrew-threadcast to point to your R2 public URL instead of the GitHub release URL.

Try installing again:

brew untap justinyahin/threadcast && brew tap justinyahin/threadcast && brew install threadcast

Auth is stored at ~/.threadcast/config.json. Both the locally-built binary and the Homebrew-installed one read from the same path, so your previous login persisted.

That's actually standard behavior for CLIs — gh, docker, aws all store config in ~/.{name}/. The Homebrew-installed binary is the same program, just installed to a different path.

Were you expecting it to require a fresh login, or is there a specific concern? Happy to change the behavior if needed.