From 95de6f2426473449cac72a52cb27451f526d83c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juli=C3=A1n=20Gonz=C3=A1lez?= Date: Fri, 21 Aug 2026 11:46:12 -0700 Subject: [PATCH] Add brew input to make Homebrew tap publishing skippable Every caller of the reusable release workflow currently publishes a formula to the public conductorone/homebrew-baton tap on every tag push: the brews block in the binaries goreleaser config is unconditional, and the goreleaser-binaries job that renders it always runs. Unlike docker/lambda/msi, there is no input to opt out, so connectors whose repositories are private still get a public formula pointing at release assets anonymous users cannot download - leaking the repository name, version history, and release cadence with no working install to show for it. Add a `brew` boolean input (default true) following the msi/docker convention. Because the brews block lives inside the always-running goreleaser-binaries job - which also produces the binaries, S3 uploads, and manifest the rest of the pipeline depends on - it cannot be gated at the job level like the other inputs. Instead the input is plumbed through the existing envsubst render: the "Generate configs for binaries" step exports BREW_SKIP_UPLOAD=(!brew), and the brews block gains `skip_upload: "${BREW_SKIP_UPLOAD}"`. goreleaser skips the tap push only when skip_upload is exactly "true" ("false" publishes normally, verified against the pinned v2.13 source), so all existing callers - none of which pass the input - are behaviorally unchanged. When skipped, the formula is still written to the local dist dir and everything else in the release (binaries, signing, SBOM, provenance, S3, ECR, registry record) proceeds as before. The expression uses `inputs.brew != true` rather than a &&/|| ternary deliberately: empty strings are falsy in Actions expressions, so a ternary with an empty true-branch would invert the logic. Verified: workflow YAML parses; actionlint output is identical to main (same 13 pre-existing shellcheck notes, line-shifted); envsubst render with both values produces valid goreleaser config; templates are checked out at the same sha as the invoked workflow, so older version tags are unaffected. --- .github/workflows/release.yaml | 6 ++++++ README.md | 1 + templates/.goreleaser-binaries-template.yaml.tmpl | 1 + 3 files changed, 8 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 074e268..cf81795 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -52,6 +52,11 @@ on: type: string default: "" description: "Path to a custom WXS file in the caller repo for MSI generation (relative to repo root). If not provided, uses default template." + brew: + required: false + type: boolean + default: true + description: "Whether to publish a Homebrew formula to the public conductorone/homebrew-baton tap." secrets: RELENG_GITHUB_TOKEN: required: true @@ -260,6 +265,7 @@ jobs: working-directory: _workflows env: REPO_NAME: ${{ github.event.repository.name }} + BREW_SKIP_UPLOAD: ${{ inputs.brew != true }} # For provenance predicate template WORKFLOWS_REF: ${{ needs.determine-workflows-ref.outputs.ref }} RELEASE_TAG: ${{ inputs.tag }} diff --git a/README.md b/README.md index 34d831d..f60b163 100644 --- a/README.md +++ b/README.md @@ -82,6 +82,7 @@ The release workflow accepts the following input parameters: | `docker_extra_files` | No | `""` | Comma-separated list of extra files/dirs to include in Docker build context | | `msi` | No | `true` | Whether to build MSI Windows installers | | `msi_wxs_path` | No | `""` | Path to custom WXS template for MSI installer (uses default if not set) | +| `brew` | No | `true` | Whether to publish a Homebrew formula to the public `conductorone/homebrew-baton` tap | 2. Ensure your repository has the following secrets configured: diff --git a/templates/.goreleaser-binaries-template.yaml.tmpl b/templates/.goreleaser-binaries-template.yaml.tmpl index df5cb0b..da6f509 100644 --- a/templates/.goreleaser-binaries-template.yaml.tmpl +++ b/templates/.goreleaser-binaries-template.yaml.tmpl @@ -92,6 +92,7 @@ brews: owner: conductorone name: homebrew-baton directory: Formula + skip_upload: "${BREW_SKIP_UPLOAD}" homepage: https://conductorone.com test: | system "#{bin}/${REPO_NAME} -v"