ci: use releaser app for v2 publishing

Author: danielgtaylor

.github/workflows/docs-site.yml

@@ -1,12 +1,14 @@
 name: Docs Site
 
 on:
+  push:
+    tags:
+      - "v*"
   workflow_dispatch:
 
-# Automatic push and pull request triggers are intentionally omitted while the
-# v2 docs site is unreleased. Before release, configure Pages to use GitHub
-# Actions, set DOCS_SITE_DEPLOY_ENABLED=true in repository variables, and add
-# the desired push trigger.
+# Branch push and pull request triggers are intentionally omitted. Version tags
+# keep docs in step with stable builds, and workflow_dispatch lets maintainers
+# publish small main-branch docs edits without waiting for another release.
 
 permissions:
   contents: read

.github/workflows/release.yml

@@ -29,11 +29,21 @@ jobs:
       - name: Test
         run: go test ./...
 
+      - name: Generate Homebrew tap token
+        id: releaser-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.RELEASER_APP_ID }}
+          private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
+          repositories: |
+            homebrew-tap
+            restish
+
       - name: Check out Homebrew tap
         uses: actions/checkout@v5
         with:
           repository: rest-sh/homebrew-tap
-          token: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
+          token: ${{ steps.releaser-token.outputs.token }}
           path: homebrew-tap
 
       - name: Ensure v1 Homebrew formula
@@ -60,4 +70,4 @@ jobs:
             release --clean --parallelism 4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.releaser-token.outputs.token }}

docs/release-packaging.md

@@ -60,9 +60,10 @@ formula without fighting for the same linked executable.
 brew install rest-sh/tap/restish@1
 ```
 
-The release workflow expects `HOMEBREW_TAP_GITHUB_TOKEN` to have write access to
-`rest-sh/homebrew-tap`. GoReleaser uses it to update v2 formulae, and the
-workflow seeds the v1 formula from `packaging/homebrew/restish@1.rb`.
+The release workflow uses the existing Restish Releaser GitHub App secrets
+(`RELEASER_APP_ID` and `RELEASER_APP_PRIVATE_KEY`) to mint a short-lived token
+with access to `rest-sh/homebrew-tap`. GoReleaser uses it to update v2 formulae,
+and the workflow seeds the v1 formula from `packaging/homebrew/restish@1.rb`.
 
 ## First-Party Plugin Artifacts