Fix nightly release: scope homebrew cask to vigilante archives, gate publish to main (#464)

* ci: scope homebrew cask to vigilante archive id and gate nightly publish to main

The nightly release was failing at the homebrew cask stage with:

  one tap can handle only one archive of an OS/Arch combination.
  Consider using ids in the homebrew_casks section

Both `vigilante` and `gh-sandbox` produce Linux amd64/arm64 archives, so
the unscoped homebrew_casks entry tried to template both into a single
cask and collided. Filter the cask to the `release-archives` archive id
(which already pins to the `vigilante` build) so gh-sandbox artifacts
are excluded from the cask template while still shipping as release
assets.

Also harden the workflow so it only publishes/updates external
artifacts when running on `main`. Non-main pushes (currently used as a
temporary verification branch for this fix) exercise the goreleaser
build step but skip the rolling prerelease, nightly verification, and
Homebrew tap update. The `main`-only gates are the permanent behavior;
the branch entry under `on.push.branches` is temporary and will be
removed once this run is confirmed green.

Local verification:
- goreleaser check — pass
- goreleaser release --snapshot --clean --skip=publish — pass; the
  generated dist/homebrew/Casks/vigilante.rb references only the
  vigilante archives (macOS amd64/arm64, Linux amd64).

* ci: make environment and tap-token step main-only for nightly

Branch pushes hit environment protection rules before the job could
even start, because the job unconditionally required environment `main`
and that environment is gated to `main`. Make the environment
conditional so non-main verification pushes still build the goreleaser
snapshot, and gate the `Get token for Homebrew tap` step to main since
its secrets are only available inside the `main` environment.

On main pushes the behavior is identical to before.

* ci: remove temporary branch entry from nightly trigger

Nightly run 24846173714 on this branch succeeded with the goreleaser
homebrew_casks fix in place (build step passed; publish/tap steps
correctly skipped off-main). Drop the temporary branch entry from the
push trigger list so nightly only fires on main again.

The permanent main-only gates on the publish/verify/tap steps and the
conditional `environment: main` stay in place as a safety net.

Author: nicobistolfi

.github/workflows/nightly.yml

@@ -11,7 +11,9 @@ permissions:
 jobs:
   prerelease:
     runs-on: ubuntu-latest
-    environment: main
+    # Only gate production secrets behind the protected `main` environment on main pushes;
+    # verification runs on other branches build without access to publish credentials.
+    environment: ${{ github.ref == 'refs/heads/main' && 'main' || '' }}
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
@@ -48,6 +50,7 @@ jobs:
         run: goreleaser check
 
       - name: Get token for Homebrew tap
+        if: github.ref == 'refs/heads/main'
         uses: actions/create-github-app-token@v3
         id: tap_token
         with:
@@ -65,6 +68,7 @@ jobs:
         run: goreleaser release --snapshot --clean
 
       - name: Publish rolling prerelease
+        if: github.ref == 'refs/heads/main'
         env:
           GH_TOKEN: ${{ github.token }}
           NIGHTLY_TAG: ${{ env.NIGHTLY_TAG }}
@@ -96,19 +100,22 @@ jobs:
             --prerelease
 
       - name: Verify nightly release publication
+        if: github.ref == 'refs/heads/main'
         env:
           GH_TOKEN: ${{ github.token }}
           NIGHTLY_TAG: ${{ env.NIGHTLY_TAG }}
           NIGHTLY_VERSION: ${{ env.NIGHTLY_VERSION }}
         run: bash ./scripts/verify-nightly-release.sh
 
       - name: Check out Homebrew tap
+        if: github.ref == 'refs/heads/main'
         env:
           TAP_TOKEN: ${{ steps.tap_token.outputs.token }}
         run: |
           git clone "https://x-access-token:${TAP_TOKEN}@github.com/aliengiraffe/homebrew-spaceship.git" "$RUNNER_TEMP/homebrew-spaceship"
 
       - name: Update nightly Homebrew cask
+        if: github.ref == 'refs/heads/main'
         env:
           CHECKSUMS_FILE: dist/checksums.txt
           NIGHTLY_TAG: ${{ env.NIGHTLY_TAG }}
@@ -117,6 +124,7 @@ jobs:
         run: ./scripts/update-nightly-cask.sh
 
       - name: Push nightly Homebrew cask
+        if: github.ref == 'refs/heads/main'
         working-directory: ${{ runner.temp }}/homebrew-spaceship
         run: |
           git config user.name "github-actions[bot]"

.goreleaser.yml

@@ -69,6 +69,8 @@ release:
 
 homebrew_casks:
   - name: vigilante
+    ids:
+      - release-archives
     repository:
       owner: aliengiraffe
       name: homebrew-spaceship