Create the hub

Step 3 of 5

1. Before you start
2. Apple credentials
3. 3Create the hub
4. 4Add a project
5. 5First release

Start the setup in any folder:

bunx @doguyilmaz/tapster setup

tapster opens a page in your browser. It runs on your computer only, at 127.0.0.1:8277. It stops when you press Ctrl+C in the terminal or click Close on the page.

You should see

tapster setup runs on this computer at http://127.0.0.1:8277. Your keys go from here to your own GitHub account only.

Installed tapster with Homebrew? Run brew upgrade --cask tapster first: bunx runs the copy on your PATH when it finds one.

The link it opens works once. If you close the tab, press Enter in the terminal for a fresh one. Prefer to type commands? Set up from a terminal does the same steps with tapster init. Want the page to stay there and update tapster with one click? Install tapster and keep setup running.

Choose your tap

Pick your tap or create homebrew-tap here. Keep it public: GitHub gives public repositories free macOS runners, which signing needs. It also gives them the protected environment that holds your keys.

The page now shows a route of seven stops on the left. Each stop turns green when GitHub has what it needs, so you can close the page and come back later: tapster reads where you are from GitHub, not from your computer.

1. Protect the hub

One button sets four things on the hub: a tapster environment that only main can open, a ruleset that keeps main from being deleted or force-pushed, a rule that workflows run only GitHub’s and tapster’s actions pinned by commit, and a read-only default token.

Careful

Bringing an existing tap? The page lists its other workflows, such as the tests.yml and publish.yml that brew tap-new writes. They stop running once the hub is protected. The hub does not need them; Hub files removes them.

2. Create the GitHub App

The hub needs a GitHub App to write releases to your projects. The page lists the permissions it asks for.

1. Click Continue to GitHub.
2. GitHub shows the same App. Click Create GitHub App.
3. GitHub brings you back to the setup, which stores the App and its key in the hub.

Where your keys go

GitHub hands the App’s private key to tapster on your computer, once. tapster stores it as a secret of the hub’s tapster environment. It goes nowhere else.

Now install it: click Install the App, choose Only select repositories and pick the projects the hub should publish. Never pick the hub itself: the App can write to every repository it is installed on. The hub holds your keys. The page notices the installation within seconds and lists the projects the App reaches.

3. macOS or not

Answer Yes if the hub will sign Mac apps or command line tools with macOS builds. That needs an Apple Developer Program membership and the two files from the previous step. Answer No to publish only Linux and Windows builds; you can add the Apple credentials later on the same page.

4. Apple certificate

Drop the .p12 you exported and type its password. tapster opens it on your computer to check that it is a Developer ID Application certificate with its private key that has not expired, then stores it. The page then shows your team and the expiry date; the hub warns 30 days before.

Your password manager

The form is built for password managers: yours can save the password under the name shown above the file, such as you/homebrew-tap: Developer ID certificate. It fills it in when you renew the certificate.

5. Notarization key

Drop the AuthKey_….p8 file and type its Key ID and Issuer ID. On a Mac, tapster asks Apple whether the key works before it stores it.

Where your keys go

The certificate, its password and the notarization key become secrets of the hub’s tapster environment. Only workflows on main can read them. Keep your backups: GitHub never shows a secret again.

6. Hub files

tapster shows the four files it writes to main: tapster.yml, .tapster/state.json, a README for your users and the hub workflow, which pins the exact tapster you run by its commit. Open a file to read it. An existing README stays unless you ask for tapster’s. Then click Write the changes to main: tapster commits them through GitHub, so you need no clone of the hub.

Before it writes

If someone else changed main since your last push, tapster stops and lists what changed. The hub refuses to run in that state too, because only you may change it.

The hub is ready. It has no projects yet, so its runs find nothing to do.