Automate homebrew formula releases and ignore private memos - #137
Merged
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideConfigures GoReleaser to automatically publish a Homebrew formula to the yourconscience/homebrew-tap repository on every tagged release, and updates gitignore to exclude several private strategy/plan documents from version control. Sequence diagram for automated Homebrew formula release via GoReleasersequenceDiagram
actor Developer
participant GitHub
participant GitHubActions_release_workflow
participant GoReleaser
participant HomebrewTapRepo
Developer->>GitHub: push tag
GitHub->>GitHubActions_release_workflow: trigger release.yml
GitHubActions_release_workflow->>GoReleaser: release --clean
GitHubActions_release_workflow->>GoReleaser: set HOMEBREW_TAP_TOKEN
GoReleaser->>HomebrewTapRepo:
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- Consider adding an explicit check or early failure in the release workflow when HOMEBREW_TAP_TOKEN is unset so that missing credentials surface as a clear, actionable error instead of a generic goreleaser failure.
- Hardcoding the Homebrew tap owner/name in .goreleaser.yaml makes forking or reusing this config harder; you might want to derive these from environment variables or Git metadata to make the setup more portable.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider adding an explicit check or early failure in the release workflow when HOMEBREW_TAP_TOKEN is unset so that missing credentials surface as a clear, actionable error instead of a generic goreleaser failure.
- Hardcoding the Homebrew tap owner/name in .goreleaser.yaml makes forking or reusing this config harder; you might want to derive these from environment variables or Git metadata to make the setup more portable.
## Individual Comments
### Comment 1
<location path=".github/workflows/release.yml" line_range="30" />
<code_context>
args: release --clean
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Consider constraining the token scope and documenting its expected permissions
Because this token will push to `homebrew-tap`, it likely needs `contents: write` (and possibly `workflow` if that repo uses workflows). Please ensure the secret is a fine‑grained PAT with only the minimum required scopes and access restricted to that repo to limit impact if it’s ever leaked.
</issue_to_address>
### Comment 2
<location path=".goreleaser.yaml" line_range="26-27" />
<code_context>
+ - repository:
+ owner: yourconscience
+ name: homebrew-tap
+ token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
+ directory: Formula
+ description: "Sync skills, MCP servers, hooks, and roles across coding agents"
</code_context>
<issue_to_address>
**suggestion:** Handle missing `HOMEBREW_TAP_TOKEN` more explicitly to fail fast
If `HOMEBREW_TAP_TOKEN` is unset, goreleaser will use an empty token and only fail later with a confusing Git push error. Consider adding an explicit pre-check (in the workflow or via goreleaser `env`/`before` hooks) to assert this env var is set and non-empty so failures are immediate and clearer.
```suggestion
env:
- HOMEBREW_TAP_TOKEN={{ .Env.HOMEBREW_TAP_TOKEN | mustEnv "HOMEBREW_TAP_TOKEN" }}
checksum:
name_template: checksums.txt
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| args: release --clean | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} |
There was a problem hiding this comment.
🚨 suggestion (security): Consider constraining the token scope and documenting its expected permissions
Because this token will push to homebrew-tap, it likely needs contents: write (and possibly workflow if that repo uses workflows). Please ensure the secret is a fine‑grained PAT with only the minimum required scopes and access restricted to that repo to limit impact if it’s ever leaked.
Comment on lines
26
to
27
| checksum: | ||
| name_template: checksums.txt |
There was a problem hiding this comment.
suggestion: Handle missing HOMEBREW_TAP_TOKEN more explicitly to fail fast
If HOMEBREW_TAP_TOKEN is unset, goreleaser will use an empty token and only fail later with a confusing Git push error. Consider adding an explicit pre-check (in the workflow or via goreleaser env/before hooks) to assert this env var is set and non-empty so failures are immediate and clearer.
Suggested change
| checksum: | |
| name_template: checksums.txt | |
| env: | |
| - HOMEBREW_TAP_TOKEN={{ .Env.HOMEBREW_TAP_TOKEN | mustEnv "HOMEBREW_TAP_TOKEN" }} | |
| checksum: | |
| name_template: checksums.txt |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automates what is currently a manual step and keeps private memos out of the public repo.
Part of phase 1 in SPEC.md (untracked).
Summary by Sourcery
Automate Homebrew tap releases and keep private planning documents out of the public repository.
Enhancements:
CI:
Chores: