Fix nightly release: scope homebrew cask to vigilante archives, gate publish to main

.github/workflows/nightly.yml

@@ -11,7 +11,9 @@ permissions:
 jobs:
   prerelease:
     runs-on: ubuntu-latest
-    environment: main
+    # Only gate production secrets behind the protected `main` environment on main pushes;
+    # verification runs on other branches build without access to publish credentials.
+    environment: ${{ github.ref == 'refs/heads/main' && 'main' || '' }}
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
@@ -48,6 +50,7 @@ jobs:
         run: goreleaser check
 
       - name: Get token for Homebrew tap
+        if: github.ref == 'refs/heads/main'
         uses: actions/create-github-app-token@v3
         id: tap_token
         with:
@@ -65,6 +68,7 @@ jobs:
         run: goreleaser release --snapshot --clean
 
       - name: Publish rolling prerelease
+        if: github.ref == 'refs/heads/main'
         env:
           GH_TOKEN: ${{ github.token }}
           NIGHTLY_TAG: ${{ env.NIGHTLY_TAG }}
@@ -96,19 +100,22 @@ jobs:
             --prerelease
 
       - name: Verify nightly release publication
+        if: github.ref == 'refs/heads/main'
         env:
           GH_TOKEN: ${{ github.token }}
           NIGHTLY_TAG: ${{ env.NIGHTLY_TAG }}
           NIGHTLY_VERSION: ${{ env.NIGHTLY_VERSION }}
         run: bash ./scripts/verify-nightly-release.sh
 
       - name: Check out Homebrew tap
+        if: github.ref == 'refs/heads/main'
         env:
           TAP_TOKEN: ${{ steps.tap_token.outputs.token }}
         run: |
           git clone "https://x-access-token:${TAP_TOKEN}@github.com/aliengiraffe/homebrew-spaceship.git" "$RUNNER_TEMP/homebrew-spaceship"
 
       - name: Update nightly Homebrew cask
+        if: github.ref == 'refs/heads/main'
         env:
           CHECKSUMS_FILE: dist/checksums.txt
           NIGHTLY_TAG: ${{ env.NIGHTLY_TAG }}
@@ -117,6 +124,7 @@ jobs:
         run: ./scripts/update-nightly-cask.sh
 
       - name: Push nightly Homebrew cask
+        if: github.ref == 'refs/heads/main'
         working-directory: ${{ runner.temp }}/homebrew-spaceship
         run: |
           git config user.name "github-actions[bot]"

.goreleaser.yml

@@ -69,6 +69,8 @@ release:
 
 homebrew_casks:
   - name: vigilante
+    ids:
+      - release-archives
     repository:
       owner: aliengiraffe
       name: homebrew-spaceship