fix(release): pass HOMEBREW_TAP_GITHUB_TOKEN explicitly to tap/bucket publishers

Author: nachiket

.goreleaser.yml

@@ -66,6 +66,9 @@ brews:
     repository:
       owner: logicwind
       name: homebrew-tap
+      # Cross-repo push: must explicitly reference the PAT; goreleaser does
+      # NOT auto-fall-back to HOMEBREW_TAP_GITHUB_TOKEN without this line.
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
     description: "Typed project-state substrate for LLM-first software development"
     homepage: "https://github.com/logicwind/DocOps"
     license: MIT
@@ -82,6 +85,9 @@ scoops:
     repository:
       owner: logicwind
       name: scoop-bucket
+      # Same cross-repo-push requirement as brew. Same PAT, aliased as
+      # SCOOP_TAP_GITHUB_TOKEN in .github/workflows/release.yml.
+      token: "{{ .Env.SCOOP_TAP_GITHUB_TOKEN }}"
     description: "Typed project-state substrate for LLM-first software development"
     homepage: "https://github.com/logicwind/DocOps"
     license: MIT

docs/.docops/counters.json

@@ -3,6 +3,6 @@
   "next": {
     "ADR": 26,
     "CTX": 5,
-    "TP": 28
+    "TP": 29
   }
 }

docs/.index.json

@@ -1,5 +1,5 @@
 {
-  "generated_at": "2026-04-23T08:33:23Z",
+  "generated_at": "2026-04-23T08:41:52Z",
   "version": 1,
   "docs": [
     {
@@ -860,7 +860,7 @@
       ],
       "summary": "\u003c!-- AMENDMENTS (body-only until ADR-0025 / TP-026 land the frontmatter schema):   - 2026-04-23 editorial — tap/bucket repo names migrated from     per-tool (homebrew-docops, scoop-docops) to org-wide…",
       "word_count": 1095,
-      "last_touched": "2026-04-22T12:30:23Z",
+      "last_touched": "2026-04-23T08:37:39Z",
       "age_days": 0,
       "referenced_by": [
         {
@@ -886,6 +886,10 @@
         {
           "id": "TP-024",
           "edge": "requires"
+        },
+        {
+          "id": "TP-028",
+          "edge": "requires"
         }
       ],
       "active_tasks": [
@@ -1100,7 +1104,7 @@
       ],
       "summary": "ADRs are immutable by convention. This is the right default — decision history must not be silently rewritten. But the convention creates a dead zone for the most common kind of post-acceptance change…",
       "word_count": 1188,
-      "last_touched": "2026-04-23T04:56:04Z",
+      "last_touched": "2026-04-23T08:37:39Z",
       "age_days": 0,
       "referenced_by": [
         {
@@ -1902,7 +1906,7 @@
       ],
       "summary": "\u003e **2026-04-23 progress note.** Phase 1 (new repos created) ✅. \u003e Phase 3 (legacy repos archived) ✅. `.goreleaser.yml` has \u003e `skip_upload: false`; `.github/workflows/release.yml` passes \u003e `HOMEBREW_TAP…",
       "word_count": 619,
-      "last_touched": "2026-04-23T08:33:14Z",
+      "last_touched": "2026-04-23T08:37:39Z",
       "age_days": 0,
       "referenced_by": [
         {
@@ -1950,7 +1954,7 @@
       ],
       "summary": "Ship the machine layer behind ADR-0025: the `amendments:` frontmatter field, the `docops amend` CLI, validator + audit + index + state integration, and the JSON Schema extension.",
       "word_count": 602,
-      "last_touched": "2026-04-23T04:56:54Z",
+      "last_touched": "2026-04-23T08:37:39Z",
       "age_days": 0,
       "referenced_by": [
         {
@@ -1975,7 +1979,25 @@
       ],
       "summary": "Once TP-026 ships the `amendments:` schema and `docops amend` CLI, convert ADR-0019's HTML-comment amendment stub into a proper frontmatter entry using the new machinery. ADR-0019 is the live motivati…",
       "word_count": 354,
-      "last_touched": "2026-04-23T05:14:55Z",
+      "last_touched": "2026-04-23T08:37:39Z",
+      "age_days": 0,
+      "stale": false
+    },
+    {
+      "id": "TP-028",
+      "kind": "TP",
+      "folder": "docs/tasks",
+      "path": "docs/tasks/TP-028-fix-makefile-release-dry-run-guard-escapes-real-co.md",
+      "title": "Fix Makefile release DRY_RUN — guard escapes, real commit/tag/push runs",
+      "task_status": "backlog",
+      "priority": "p2",
+      "assignee": "unassigned",
+      "requires": [
+        "ADR-0019"
+      ],
+      "summary": "Make `make release VERSION=X.Y.Z DRY_RUN=1` actually be a dry run. Today it prints the \"would do\" lines and then runs the real `echo \u003e VERSION` / `git commit` / `git tag` / `git push` commands anyway.",
+      "word_count": 425,
+      "last_touched": "2026-04-23T08:41:43Z",
       "age_days": 0,
       "stale": false
     }

docs/STATE.md

@@ -6,7 +6,7 @@
 
 - Context: 4 active · 0 superseded
 - ADRs: 22 accepted · 3 draft · 0 superseded (24 `coverage: required`, 1 `coverage: not-needed`)
-- Tasks: 5 backlog · 1 active · 0 blocked · 21 done
+- Tasks: 6 backlog · 1 active · 0 blocked · 21 done
 
 ## Needs attention
 
@@ -19,6 +19,7 @@
 ## Recent activity
 
 - 2026-04-23 c038a01 chore: mark TP-018/020/021/022 done; ignore /docops smoke binary
+- 2026-04-23 aeb53b3 chore: enable tap/bucket auto-publish for v0.2.1
 - 2026-04-23 a131d95 planning: ADR-0024 + TP-022 — ship CLAUDE.md alongside AGENTS.md
 - 2026-04-23 7656d08 planning: ADR-0023 + TP-020/TP-021 — split TP-018 into refactor + upgrader + update-check
 - 2026-04-23 6f41758 TP-012: docops get/list/graph/next — focused read commands
@@ -37,5 +38,4 @@
 - 2026-04-22 84fb540 planning: ADR-0020 + TP-015/TP-016/TP-017 for v0.1.1 ergonomics
 - 2026-04-22 73cd5db TP-010/TP-013: finalize skill-pack scope — --no-skills + skills lint
 - 2026-04-22 6b41ceb TP-008: docops new — scaffold CTX/ADR/Task with atomic ID allocation
-- 2026-04-22 56f6d7c TP-003: docops validate — schema + graph invariants over docs/
 

docs/tasks/TP-028-fix-makefile-release-dry-run-guard-escapes-real-co.md

@@ -0,0 +1,73 @@
+---
+title: Fix Makefile release DRY_RUN — guard escapes, real commit/tag/push runs
+status: backlog
+priority: p2
+assignee: unassigned
+requires: [ADR-0019]
+depends_on: []
+---
+
+## Goal
+
+Make `make release VERSION=X.Y.Z DRY_RUN=1` actually be a dry run.
+Today it prints the "would do" lines and then runs the real
+`echo > VERSION` / `git commit` / `git tag` / `git push` commands
+anyway.
+
+## What happened (incident trace — 2026-04-23)
+
+- Operator ran `make release VERSION=0.2.1 DRY_RUN=1` expecting a
+  preview. The command printed the dry-run lines AND executed the
+  real sequence: wrote VERSION, committed, tagged `v0.2.1`, pushed
+  both main and the tag to origin.
+- The tag push triggered the release workflow. It half-succeeded
+  (GitHub Release published, tap/bucket push failed with a 403 —
+  separate bug, fixed in the same session).
+- When the operator followed up with the non-dry-run
+  `make release VERSION=0.2.1`, the Makefile correctly refused with
+  `tag v0.2.1 already exists locally` — which *confirmed* the dry
+  run had really tagged and pushed.
+
+## Root cause
+
+Make runs **each recipe line in its own shell** unless `.ONESHELL:`
+is set or all lines are joined with `\`. The current target has the
+DRY_RUN guard as one if-block ending with `exit 0`. `exit 0` exits
+that subshell with success — it does NOT tell Make to skip the
+remaining recipe lines. The next lines then run in their own fresh
+shells and execute the real commit/tag/push.
+
+## Fix options
+
+- **A. `.ONESHELL:` directive** — one shell per recipe globally.
+  Fixes this cleanly but changes the behaviour of every other
+  target; audit them first.
+- **B. Collapse `release` into one shell block** (`@bash -c
+  '...'` or `&&`-chained). Scoped to this target; recommended.
+- **C. Guard each side-effect line individually** with
+  `@[ -z "$(DRY_RUN)" ] && <cmd>`. Noisy but surgical.
+
+**Recommended:** Option B.
+
+## Acceptance
+
+- `make release VERSION=9.9.9 DRY_RUN=1` on a clean tree prints
+  the "would do" lines and makes **zero** changes:
+  - `git status` is clean after.
+  - `git log -1 --format=%H` is unchanged.
+  - `git tag | grep v9.9.9` is empty.
+  - `git ls-remote origin refs/tags/v9.9.9` is empty.
+- `make release VERSION=X.Y.Z` (no DRY_RUN) continues to work
+  exactly as before.
+- Regression test: a shell test under `scripts/` (or a new
+  `make test-release` target) runs the dry-run against a temp
+  git repo fixture and asserts the four "zero change" conditions.
+
+## Notes
+
+- This bug sent a real tag to production. Fixing it is p1 even
+  though the damage this time was self-limiting.
+- While fixing, also consider:
+  - A final "(no changes made)" footer on dry runs.
+  - A confirm prompt on the real path — `make release` has no
+    confirmation today, which is the pair of this bug.