Sync and authenticate private Taps with Workbrew

Workbrew supports automatic installation of private Taps through our GitHub or GitLab integrations for Workbrew Enterprise Workspaces.

Connect your private Taps with GitHub#

1. Open your Workspace settings and navigate to the GitHub Installations tab
2. Click Install GitHub App
3. During the GitHub OAuth flow, choose the organization to install Workbrew Console in, and grant permissions to your private tap repositories
4. Return to the Workspace settings page in the console and navigate to the GitHub Installations tab
5. Select each private Tap that you want to automatically sync to devices

Allow Workbrew through your GitHub IP allow list#

If your GitHub organization has IP address allow listing enabled, GitHub blocks requests from the Workbrew Console until you allow its outbound IPs. Without this, Devices fail to clone or update private Taps after the integration is installed.

In your GitHub organization, go to Settings → Authentication security → IP allow list, click Add, and add each of the following:

• 67.207.88.80
• 167.99.156.159

These are the same two addresses for every integration the Console connects out to, not just GitHub. They are listed in Network requirements.

Connect your private Taps with GitLab#

1. Open your Workspace settings and navigate to the GitLab Integrations tab
2. Click Install GitLab.com Integration
3. During the GitLab OAuth flow, choose the organization to install Workbrew Console in, and grant permissions to your private tap repositories
4. Return to the Workspace settings page in the console and navigate to the GitLab Integrations tab
5. Select each private Tap that you want to automatically sync to devices

Allow Workbrew through a GitLab firewall#

A GitLab instance that only accepts traffic from known networks blocks the Workbrew Console the same way GitHub does. Allow the two addresses above on the GitLab side over HTTPS on port 443. This applies whether the instance is self-hosted or is GitLab.com behind an allowed IP restriction.

Your Devices clone private Taps directly, so they also need to reach the GitLab host. Allowing the Console alone is not enough.

Troubleshooting private Taps#

Once the GitHub or GitLab integration is setup, private Taps in that organization should sync automatically. If a private tap isn't appearing on end-user machines, check the following:

1. The repository name follows Homebrew’s naming convention (for example homebrew-[something])
2. The formula in the tap is valid and parses cleanly
3. The tap repository is private and resides in the same organization connected to Workbrew

Authenticate private repositories#

Workbrew doesn't currently fetch or mirror external files referenced in a formula, even if they're located in another private repository within the same organization. To ensure users can access the artifacts, the address in the formula must point to one of the following:

• A public or pre-signed URL (for example from S3)
• GitHub Releases that users already have access to (for example through a Personal Access Token)