From 8cf68af6fc4d468629f27e37bd0e577be2858f93 Mon Sep 17 00:00:00 2001
From: Lau Josefsen <lejo@cego.dk>
Date: Mon, 10 Aug 2026 14:34:46 +0200
Subject: [PATCH] ci: fix APT publish failure and bump actions to latest majors

The 2.1.6 release failed in "Publish to APT": the step installed rclone
without refreshing the package index first, so apt resolved the version
baked into the runner image (1.60.1+dfsg-3ubuntu0.24.04.5), which Ubuntu
has since removed from the pool. The download 404'd and the step exited
100, which also skipped the Homebrew formula update. Add apt-get update
before the install.

Also bump the actions that were being force-migrated off Node 20:

  actions/checkout                 v4 -> v7
  actions/setup-go                 v5 -> v7
  actions/upload-artifact          v4 -> v7
  actions/create-github-app-token  v1 -> v3

checkout v6 moved persisted credentials out of .git/config into a
separate file referenced by includeIf, so the release job's
"git config --unset-all http.https://github.com/.extraheader" no longer
removes them and the GITHUB_TOKEN header would have overridden the
GitHub App token in the formula push remote URL. Check out with
persist-credentials: false instead, which leaves no header to unset.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/go.yml      | 18 +++++++++---------
 .github/workflows/release.yml | 14 ++++++++++----
 2 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 831823b6..e869d691 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -13,9 +13,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -27,7 +27,7 @@ jobs:
         run: go test -race -coverprofile=coverage.out ./...
 
       - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage
           path: coverage.out
@@ -38,9 +38,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -53,9 +53,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -70,9 +70,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d41a0792..1b98a8f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,9 +13,15 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      # persist-credentials: false keeps checkout from leaving a GITHUB_TOKEN
+      # Authorization header in the git config. The formula push below
+      # authenticates as the GitHub App via the remote URL, and a persisted
+      # header would take precedence over it.
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -79,6 +85,7 @@ jobs:
           CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         run: |
+          sudo apt-get update
           sudo apt-get install -y dpkg-dev apt-utils rclone
 
           DESCRIPTION="Developer environment orchestration tool"
@@ -126,7 +133,7 @@ jobs:
       - name: Generate app token for formula push
         if: github.ref_type == 'tag'
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -145,7 +152,6 @@ jobs:
 
           git config user.email "noc+gitte@cego.dk"
           git config user.name "CI"
-          git config --unset-all http.https://github.com/.extraheader || true
           git remote set-url origin "https://x-access-token:${APP_TOKEN}@github.com/cego/gitte"
           git fetch origin main
           git checkout main