Update tooling and workflows to current Homebrew conventions - #46
Merged
Conversation
Run RuboCop from the default Rake task over the Gemfile, Rakefile and the lib and spec trees. Passing those paths explicitly is required: the org-synced .rubocop.yml sets `AllCops: Include: ["**/*.rbi"]`, which replaces rather than extends the default globs, so a bare `rubocop` scans nothing here. The two source changes are RuboCop-driven and behaviour-preserving: Dir.glob has sorted by default since Ruby 3.0, and Style/MutableConstant is configured as `strict`. Signed-off-by: Patrick Linnane <patrick@linnane.io>
Restrict push to main, add merge_group, and adopt the standard shell defaults, concurrency group, empty top-level permissions with job-scoped grants, job timeouts, names and repository owner guard. Install check-jsonschema through setup-homebrew and cache-homebrew-prefix instead of pip, matching the synced actionlint.yml in this repository. That file already caches a prefix, so workflow-key is required to keep the two caches isolated. Pin the OSV schema to v1.9.0 rather than tracking main. That is the release adding the Homebrew ecosystem, and its id pattern registers the BREW- prefix these advisories use. Validate via find -print0 | xargs -n 500 so the file list cannot outgrow ARG_MAX, and fail explicitly when no advisories are found rather than passing a literal glob to check-jsonschema. Covered by a regression test asserting the batching invariant. Signed-off-by: Patrick Linnane <patrick@linnane.io>
Adopt the standard shell defaults, serialising concurrency groups, empty top-level permissions with job-scoped grants, job names, a repository owner guard so forks do not run the schedule, and a timeout on Regenerate. Hoist the shared HOMEBREW_* variables to the workflow level; HOMEBREW_NO_INSTALL_FROM_API stays step-scoped because setup-homebrew deliberately unsets it. Replace the hardcoded git identity with git-user-config, which resolves to the same values, and push with git-try-push. Both branches are rebuilt from main on every run, so the push needs no_lease: the default --force-with-lease has no remote-tracking ref to compare against in a shallow checkout. Fix the duplicate pull request guard. `gh pr list --head` filters on GraphQL headRefName, which takes a bare branch name, so an owner:branch argument matches nothing and every run would try to recreate an open pull request and fail. Filter forks with isCrossRepository instead. Signed-off-by: Patrick Linnane <patrick@linnane.io>
Signed-off-by: Patrick Linnane <patrick@linnane.io>
Contributor
There was a problem hiding this comment.
Pull request overview
Aligns repository Ruby tooling and GitHub Actions workflows with current Homebrew conventions, while preserving advisory data/policy behavior. Also corrects the bot workflows’ “duplicate PR” guard by using a bare branch name with gh pr list --head.
Changes:
- Add RuboCop to the Ruby toolchain and run style checks in CI via
bundle exec rake(default task runs RuboCop + RSpec). - Modernize workflows (defaults shell, concurrency, least-privilege permissions, Homebrew setup actions) and fix automated PR creation guard logic.
- Add/adjust tests to validate workflow behavior (bounded schema validation batches) and minor spec refactors.
Reviewed changes
Copilot reviewed 10 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
spec/workflows_spec.rb |
Adds coverage asserting schema validation runs in bounded batches rather than globbing advisories/*.json. |
spec/repology_index_spec.rb |
Refactors test fixture construction for readability; behavior unchanged. |
Rakefile |
Adds RuboCop rake task and makes default task run RuboCop + specs. |
lib/repology_index.rb |
Freezes OVERRIDES_PATH constant to avoid mutable constant string. |
lib/advisory_index.rb |
Removes unnecessary Dir.glob(...).sort while preserving deterministic output via later sorting. |
Gemfile.lock |
Locks RuboCop and dependencies; records Ruby version and bundler version. |
Gemfile |
Declares Ruby version from .ruby-version and adds RuboCop dependency. |
CONTRIBUTING.md |
Documents local dev commands (bundle exec rake) and workflow lint tooling. |
.github/workflows/validate.yml |
Updates validation/test workflow conventions and validates advisories via `find ... |
.github/workflows/regenerate.yml |
Updates regeneration workflow conventions; uses standardized Homebrew git actions and fixes PR guard logic. |
.github/workflows/ingest.yml |
Updates ingest workflow conventions; uses standardized Homebrew git actions and fixes PR guard logic. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
andrew
enabled auto-merge
August 8, 2026 07:54
andrew
approved these changes
Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns the Ruby tooling and the three workflows with current Homebrew
conventions. No advisory data or policy changes; details are in the commits.
Also fixes the duplicate pull request guard in the bot workflows:
gh pr list --headtakes a bare branch name, so theowner:branchform matched nothing andevery run would have tried to recreate an open pull request.