tapster
tapster turns your Homebrew tap into the one place that signs, notarizes and publishes the releases of all your projects. Each project builds its files and opens a draft release. It holds no signing certificate, no notary key and no tap token.
Tutorial and docs: tapster.doguyilmaz.com
npm: @doguyilmaz/tapster
Set it up in your browser
You need Bun and the GitHub CLI, signed in with gh auth login. Signing for macOS also needs an Apple
Developer account.
bunx @doguyilmaz/tapster setup
A page opens in your browser, served by your own computer. It walks you through every step and shows what each one changes on GitHub:
- Choose or create your tap. It becomes your hub.
- Protect it, create its GitHub App and store your Apple files. Drop the
.p12and.p8; your password manager can keep the.p12password. - Write the hub files. tapster commits them to your tap through GitHub; you need no clone of it.
- Add your projects. tapster finds the projects cloned on your computer, prepares their release workflows, protects them and proposes them to the hub.
Then click Release on a project. tapster tags its latest commit on GitHub and shows the release until the hub has published it. The tutorial shows every step.
Prefer a terminal? Run bunx @doguyilmaz/tapster init in a clone of your tap and bunx @doguyilmaz/tapster add in
each project. See Set up from a terminal.
How it works
project (tag v1.2.3) hub: you/homebrew-tap
builds, attests, holds no keys runs tapster on a schedule or when rung
-> draft release + checksums.txt -> checks every file against the project's build
signs and notarizes the macOS code
publishes the release
writes the cask, the Scoop manifest and the apt and dnf repositories
It publishes Go tools built with GoReleaser, command line tools written for Bun and Mac apps that update with Sparkle. Users install them with Homebrew, Scoop, apt or dnf. When something needs you, such as a certificate that expires soon, the hub opens an issue and closes it once all is well.
Your keys stay in your accounts
tapster has no server. Your Apple certificate, notary key and App key are secrets of your hub's tapster environment,
which only its main branch can open. Projects hold no signing keys. No one else, including tapster's author, ever
receives them. tapster's own code uses them only inside your hub's runs, at the commit your hub workflow pins. Read the
security model.
The Action
You do not write the hub workflow yourself: the setup writes it and pins this Action by commit. If you added the Action
from the Marketplace first, run it once. With no mode it runs a guide: its run summary checks your repository and
shows the next step.
on: workflow_dispatch
jobs:
guide:
runs-on: ubuntu-24.04
steps:
- uses: doguyilmaz/[email protected]
To move a hub to a newer release, see Upgrade tapster.
Docs
- Tutorial: from an empty tap to an installed release
- Guides: Set up from a terminal, GoReleaser, Bun, Mac apps with Sparkle, apt and dnf, the doorbell, automatic releases and workflow tags, Dependabot, certificates of single apps, key rotation, upgrades
- Reference: Commands, tapster.yml, Security, Troubleshooting
The design documents are in docs/superpowers/specs.
License
MIT