ci(release): auto-bump Homebrew tap formula on release#6
Merged
Conversation
Adds a post-release step to automatically bump the esq formula in enthus-appdev/homebrew-tap whenever a new version tag triggers a release. This removes the manual step of editing Formula/esq.rb each time and ensures the tap never drifts behind the CLI. Implementation uses dawidd6/action-homebrew-bump-formula which wraps Homebrew's `brew bump-formula-pr --version=...`. That command natively handles multi-URL formulas (darwin-arm64 / darwin-amd64 / linux-arm64 / linux-amd64), rewriting all four URLs and SHA256 checksums in a single pass — the mislav/bump-homebrew-formula-action alternative only handles one URL per invocation. Authentication uses the `enthus-appdev-tap-bumper` GitHub App via actions/create-github-app-token. The App is installed only on the homebrew-tap repo with minimal permissions (contents: read/write, pull-requests: read/write), scoped via org-level selected-repository secrets. The bot committer identity is derived dynamically from the App's user ID so commits are properly linked to the bot profile. The step is marked continue-on-error so a tap-bump failure doesn't fail the release itself — the release is the primary artifact and can be re-bumped later if needed. The release body now also mentions the Homebrew install path first, so users discover the easiest install method.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pilots the Homebrew tap auto-bump integration on
esq-cli(smallest blast radius of the three Go CLIs). Once validated on a real release, the same pattern fans out toatl-cliandn8n-cli.What changes
release.yml:homebrew-taponly)dawidd6/action-homebrew-bump-formula@v7, which wrapsbrew bump-formula-pr --version=...— the native Homebrew command for multi-URL formulascontinue-on-error: trueso a tap-bump failure never breaks the release itselfbrew install enthus-appdev/tap/esqis now the intended default install path.Why
dawidd6and notmislav/bump-homebrew-formula-actionOur tap formulas have four separate URLs (darwin-arm64, darwin-amd64, linux-arm64, linux-amd64) each with its own SHA256. The mislav action's
download-urlinput accepts only one URL per invocation, so it would update 1 of 4 URLs and leave the other 3 stale — breakingbrew installon 3 of 4 platforms.dawidd6/action-homebrew-bump-formularunsbrew bump-formula-pr --version=which natively substitutes the version into every URL in the formula, re-downloads each tarball, and computes all four fresh SHA256s in one pass. That's exactly what we need.Auth
Uses the
enthus-appdev-tap-bumperGitHub App (installed only onhomebrew-tap, permissions: contents RW + pull-requests RW). Secrets are org-scoped to the 3 CLI repos only:HOMEBREW_TAP_APP_IDHOMEBREW_TAP_APP_PRIVATE_KEYTokens are minted ephemerally per run via
actions/create-github-app-token@v2— no long-lived PAT, no rotation burden, and the token is scoped tohomebrew-taponly for the duration of the job.Test plan
python3 -c 'import yaml; yaml.safe_load(...)')v1.1.1orv1.2.0)enthus-appdev/homebrew-taptitled something likeesq 1.1.1, with all 4 URLs + SHAs updatedbrew upgrade enthus-appdev/tap/esqpicks up the new versionRollout plan
This is the pilot. Once the pipeline has been validated end-to-end on a real release, the same 3-step pattern gets copied (identically, with just the formula name changed) to:
enthus-appdev/atl-clienthus-appdev/n8n-cliEach as a separate small PR.