From dc776ffeabd41c43c9b23f459b728bf98ca6e2ea Mon Sep 17 00:00:00 2001
From: aaltshuler <andrew@collectivelab.io>
Date: Sat, 6 Jun 2026 01:21:20 +0300
Subject: [PATCH] ci: add brew style + audit workflow for the tap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The engine's release pipeline audits the formula it generates, but this tap
repo had zero CI of its own — a hand-edited or drifted formula here was never
independently linted, the second half of iss-dx-brew-install-broken's root
cause. Add a workflow that runs `brew style` + `brew audit --strict` (offline,
deterministic) on every change to Formula/** and to the workflow itself, so a
malformed formula can't reach `main` and break `brew install`.

Validated locally against Formula/omnigraph.rb: style clean, audit clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/audit.yml | 46 +++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/audit.yml

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
new file mode 100644
index 0000000..1aa422c
--- /dev/null
+++ b/.github/workflows/audit.yml
@@ -0,0 +1,46 @@
+name: Formula Audit
+
+# Independent CI for the tap (the gap iss-dx-brew-install-broken called out: the
+# engine's release pipeline audits the formula it generates, but the tap repo
+# itself had no CI, so a hand-edited formula here was never linted). This gates
+# every change to the formula on `brew style` + `brew audit` so a malformed
+# formula can't land on `main` and break `brew install` for users.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "Formula/**"
+      - ".github/workflows/audit.yml"
+  pull_request:
+    paths:
+      - "Formula/**"
+      - ".github/workflows/audit.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: brew style + audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout tap
+        uses: actions/checkout@v5.0.1
+
+      - name: Set up Homebrew
+        uses: Homebrew/actions/setup-homebrew@master
+
+      - name: Style + audit formula
+        run: |
+          # Register this checkout as the `modernrelay/tap` tap so the
+          # `modernrelay/tap/omnigraph` formula ref resolves (brew audit rejects
+          # bare paths and needs tap context). Offline audit (no --online) keeps
+          # CI deterministic and network-independent while still catching the
+          # structural/ComponentsOrder class of formula defects.
+          tap_dir="$(brew --repository)/Library/Taps/modernrelay/homebrew-tap"
+          mkdir -p "$(dirname "$tap_dir")"
+          ln -sfn "$PWD" "$tap_dir"
+          brew style modernrelay/tap/omnigraph
+          brew audit --strict modernrelay/tap/omnigraph