From 17a9ba0872eb80b842c46e63f94e46cc51fd9403 Mon Sep 17 00:00:00 2001
From: Ben Johnson <ben@binarylogic.com>
Date: Tue, 31 Mar 2026 10:13:42 -0700
Subject: [PATCH 1/2] chore: use the company Hermit source overlay

---
 bin/hermit.hcl | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bin/hermit.hcl b/bin/hermit.hcl
index 081cbe8..297f158 100644
--- a/bin/hermit.hcl
+++ b/bin/hermit.hcl
@@ -1,2 +1,4 @@
+sources = ["https://github.com/usetero/hermit-packages.git", "https://github.com/cashapp/hermit-packages.git"]
+
 github-token-auth {
 }

From 6353cb7b80a61503313957b4bd8769058e8c88f6 Mon Sep 17 00:00:00 2001
From: Ben Johnson <ben@binarylogic.com>
Date: Tue, 31 Mar 2026 10:32:00 -0700
Subject: [PATCH 2/2] fix: authenticate Hermit overlay in release workflow

---
 .github/workflows/release.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 50b705f..3905229 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -28,7 +28,19 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate token
+        id: generate-token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        with:
+          app-id: ${{ secrets.TERO_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.TERO_BOT_PRIVATE_SIGNING_KEY }}
+          owner: ${{ github.repository_owner }}
+
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+
+      - run: git config --global url.https://x-access-token:${{ steps.generate-token.outputs.token }}@github.com/.insteadOf https://github.com/
 
       - uses: cashapp/activate-hermit@12a728b03ad41eace0f9abaf98a035e7e8ea2318 # v1.1.4