fix: use gh CLI for private repo asset downloads in homebrew job

The repo is private so curl cannot download release assets without
auth. Switch to `gh release download` which uses GH_TOKEN automatically.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sionsmith

.github/workflows/release.yml

@@ -80,28 +80,27 @@ jobs:
       - name: Update Homebrew tap
         env:
           HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF_NAME#v}"
-          BASE_URL="https://github.com/osodevops/keito-cli/releases/download/${GITHUB_REF_NAME}"
 
-          # Download each binary tarball and compute SHA256
-          # Retry up to 5 times with 15s delay to allow CDN propagation
-          download_with_retry() {
-            local url="$1" output="$2"
-            for i in 1 2 3 4 5; do
-              if curl -fsSL "$url" -o "$output"; then
-                return 0
-              fi
-              echo "Attempt $i failed for $output, retrying in 15s..."
-              sleep 15
-            done
-            echo "Failed to download $output after 5 attempts"
-            return 1
-          }
-          download_with_retry "${BASE_URL}/keito-aarch64-apple-darwin.tar.gz" arm64.tar.gz
-          download_with_retry "${BASE_URL}/keito-x86_64-apple-darwin.tar.gz" x86_64_mac.tar.gz
-          download_with_retry "${BASE_URL}/keito-x86_64-unknown-linux-gnu.tar.gz" x86_64_linux.tar.gz
+          # Download release assets using gh CLI (handles private repo auth)
+          gh release download "${GITHUB_REF_NAME}" \
+            --repo "${{ github.repository }}" \
+            --pattern "keito-aarch64-apple-darwin.tar.gz" \
+            --output arm64.tar.gz
+          gh release download "${GITHUB_REF_NAME}" \
+            --repo "${{ github.repository }}" \
+            --pattern "keito-x86_64-apple-darwin.tar.gz" \
+            --output x86_64_mac.tar.gz
+          gh release download "${GITHUB_REF_NAME}" \
+            --repo "${{ github.repository }}" \
+            --pattern "keito-x86_64-unknown-linux-gnu.tar.gz" \
+            --output x86_64_linux.tar.gz
+
+          # Public download URLs for the formula (used after repo goes public)
+          BASE_URL="https://github.com/osodevops/keito-cli/releases/download/${GITHUB_REF_NAME}"
 
           SHA_ARM64=$(sha256sum arm64.tar.gz | awk '{print $1}')
           SHA_X86_64_MAC=$(sha256sum x86_64_mac.tar.gz | awk '{print $1}')

CHANGELOG.md

@@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [0.1.1] - 2026-03-05
+## [0.1.2] - 2026-03-05
 
 ### Added
 
@@ -15,7 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 ### Fixed
 
 - Commit `Cargo.lock` so `rustsec/audit-check` can run in CI
-- Add retry logic to Homebrew tap job to handle GitHub CDN propagation delays
+- Use `gh release download` for Homebrew tap job (fixes private repo asset downloads)
 
 ## [0.1.0] - 2026-03-05
 

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "keito-cli"
-version = "0.1.1"
+version = "0.1.2"
 edition = "2021"
 description = "CLI for AI agents and humans to track billable time against the Keito platform"
 license = "MIT"