From cefb4e11fe6599dc27edf84b99acf5caeb70ca32 Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Mon, 13 Jul 2026 16:31:43 +0000
Subject: [PATCH] [patch] Separate release publication tokens

---
 .github/workflows/reusable-goreleaser.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/reusable-goreleaser.yaml b/.github/workflows/reusable-goreleaser.yaml
index d6e79ae..6511cc5 100644
--- a/.github/workflows/reusable-goreleaser.yaml
+++ b/.github/workflows/reusable-goreleaser.yaml
@@ -82,11 +82,13 @@ jobs:
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7
         with:
           distribution: goreleaser
-          # This binary receives the Homebrew publication token.
+          # Keep source-release and cross-repository publication credentials
+          # independently scoped.
           version: v2.17.0
           args: ${{ inputs.goreleaser-args }}
         env:
-          GITHUB_TOKEN: ${{ secrets.HOMEBREW_REPO }}
+          GITHUB_TOKEN: ${{ github.token }}
+          HOMEBREW_REPO_TOKEN: ${{ secrets.HOMEBREW_REPO }}
 
       - name: Authenticate to Google Cloud
         if: ${{ inputs.publish-package-repo }}