ci(release): bump homebrew-tap formula on dsar publish#38
Conversation
Adds a `bump-homebrew-tap` job to the release workflow that fires after a successful npm publish on `main`. When `dsar` is in `publishedPackages`, it downloads the new tarball from `registry.npmjs.org`, computes its sha256, and opens a PR against `inthhq/homebrew-tap` updating `Formula/dsar.rb`'s `url` and `sha256`. Tap CI then runs `brew audit --strict --online` and `brew test dsar` against the change before the PR can be merged. Requires repo secret TAP_GITHUB_TOKEN: a fine-grained PAT scoped to inthhq/homebrew-tap with Contents: write and Pull requests: write (GITHUB_TOKEN cannot push to another repository). Co-authored-by: Cursor <cursoragent@cursor.com>
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe PR adds automated Homebrew formula publishing to the release workflow. It exposes ChangesHomebrew Formula Automation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 148-155: The retry loop that downloads "$URL" into dsar.tgz can
exhaust all 10 attempts and then fail only at `test -s dsar.tgz` with an unclear
message; after the for-loop (before `test -s dsar.tgz`) add an explicit check
for the file and, if missing or empty, emit a clear error like "Failed to
download dsar.tgz from $URL after 10 attempts" and exit non‑zero (e.g., echo the
message and `exit 1`) so failures are immediately debuggable.
- Around line 192-212: The workflow step named "Create pull request" references
a non-existent action SHA
(peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676);
update the uses line to a valid reference by replacing that SHA with the
official tag or correct commit for v7.0.11 (e.g.,
peter-evans/create-pull-request@v7.0.11) so the step uses a known release of the
create-pull-request action.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: a62af585-411b-41ab-a4c5-5a6709c89123
📒 Files selected for processing (1)
.github/workflows/release.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Vitest (bun)
- GitHub Check: Vitest (node)
🔇 Additional comments (5)
.github/workflows/release.yml (5)
101-104: LGTM!The job outputs correctly expose the changesets action outputs for downstream consumption by the
bump-homebrew-tapjob.
110-119: LGTM!The job conditions are well-structured with appropriate guards, and the permissions follow least-privilege principles.
121-138: LGTM!The version extraction handles edge cases well—gracefully skipping when
dsarisn't in the published packages and usingprocess.stdout.writeto avoid newline issues in the output.
160-166: LGTM!The checkout step correctly uses a pinned action version and the dedicated token for cross-repository access.
168-190: LGTM!The formula update logic correctly preserves indentation, includes an idempotency check to prevent no-op PRs, and logs the diff for visibility.
Minor note: The
VERSIONenv var is passed but unused in the Node script—consider removing it from theenvblock for clarity.
| for i in 1 2 3 4 5 6 7 8 9 10; do | ||
| if curl -fSL --connect-timeout 10 --max-time 60 "$URL" -o dsar.tgz; then | ||
| break | ||
| fi | ||
| echo "Attempt $i: tarball not ready yet, sleeping..." | ||
| sleep $((i * 6)) | ||
| done | ||
| test -s dsar.tgz |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial | 💤 Low value
Consider adding an explicit failure message when all retries are exhausted.
If all 10 attempts fail, the step fails at test -s dsar.tgz with a cryptic error. Adding an explicit failure after the loop improves debuggability.
♻️ Proposed improvement
for i in 1 2 3 4 5 6 7 8 9 10; do
if curl -fSL --connect-timeout 10 --max-time 60 "$URL" -o dsar.tgz; then
break
fi
echo "Attempt $i: tarball not ready yet, sleeping..."
sleep $((i * 6))
done
- test -s dsar.tgz
+ if [ ! -s dsar.tgz ]; then
+ echo "::error::Failed to download tarball after 10 attempts: $URL"
+ exit 1
+ fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| for i in 1 2 3 4 5 6 7 8 9 10; do | |
| if curl -fSL --connect-timeout 10 --max-time 60 "$URL" -o dsar.tgz; then | |
| break | |
| fi | |
| echo "Attempt $i: tarball not ready yet, sleeping..." | |
| sleep $((i * 6)) | |
| done | |
| test -s dsar.tgz | |
| for i in 1 2 3 4 5 6 7 8 9 10; do | |
| if curl -fSL --connect-timeout 10 --max-time 60 "$URL" -o dsar.tgz; then | |
| break | |
| fi | |
| echo "Attempt $i: tarball not ready yet, sleeping..." | |
| sleep $((i * 6)) | |
| done | |
| if [ ! -s dsar.tgz ]; then | |
| echo "::error::Failed to download tarball after 10 attempts: $URL" | |
| exit 1 | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 148 - 155, The retry loop that
downloads "$URL" into dsar.tgz can exhaust all 10 attempts and then fail only at
`test -s dsar.tgz` with an unclear message; after the for-loop (before `test -s
dsar.tgz`) add an explicit check for the file and, if missing or empty, emit a
clear error like "Failed to download dsar.tgz from $URL after 10 attempts" and
exit non‑zero (e.g., echo the message and `exit 1`) so failures are immediately
debuggable.
| - name: Create pull request | ||
| if: steps.version.outputs.skip != 'true' | ||
| uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11 | ||
| with: | ||
| path: homebrew-tap | ||
| token: ${{ secrets.TAP_GITHUB_TOKEN }} | ||
| branch: bump-dsar-${{ steps.version.outputs.version }} | ||
| base: main | ||
| commit-message: "dsar ${{ steps.version.outputs.version }}" | ||
| title: "dsar ${{ steps.version.outputs.version }}" | ||
| body: | | ||
| Bump `dsar` to `${{ steps.version.outputs.version }}`. | ||
|
|
||
| - tarball: ${{ steps.sha.outputs.url }} | ||
| - sha256: `${{ steps.sha.outputs.sha256 }}` | ||
|
|
||
| Auto-generated by [inthhq/dsar](https://github.com/inthhq/dsar) release pipeline. Tap CI will run `brew audit --strict --online` and `brew test dsar` against this change before it can be merged. | ||
| delete-branch: true | ||
| labels: | | ||
| automated | ||
| release |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify peter-evans/create-pull-request SHA corresponds to v7.0.11
curl -sL "https://api.github.com/repos/peter-evans/create-pull-request/git/refs/tags/v7.0.11" | jq -r '.object.sha'Repository: inthhq/dsar
Length of output: 60
🌐 Web query:
peter-evans/create-pull-request v7.0.11 release
💡 Result:
Release v7.0.11 of peter-evans/create-pull-request contains a fix to restrict running git remote prune to self-hosted runners. Specifically, the compare page for v7.0.10...v7.0.11 shows a single commit (“fix: restrict remote prune to self-hosted runners (#4250)”) and the code change gates the prune logic behind utils.isSelfHosted() instead of running it unconditionally.[1] The repositories’ releases list also indicates v7.0.11 and the “What’s Changed” section includes this same item (“restrict remote prune to self-hosted runners”).[2] The underlying change reason is described in the diff: for self-hosted runners the repository state persists between runs, and pruning stale remote refs prevents push failures due to “stale info.”[1]
Citations:
- 1: peter-evans/create-pull-request@v7.0.10...v7.0.11
- 2: https://github.com/peter-evans/create-pull-request/releases
🏁 Script executed:
#!/bin/bash
# Try alternative API endpoint to get releases for peter-evans/create-pull-request
curl -sL "https://api.github.com/repos/peter-evans/create-pull-request/releases" | jq -r '.[0:5] | .[] | "\(.tag_name): \(.target_commitish)"'Repository: inthhq/dsar
Length of output: 113
🏁 Script executed:
#!/bin/bash
# Check if the specific commit SHA exists in the repository
curl -sL "https://api.github.com/repos/peter-evans/create-pull-request/commits/22a9089034f40e5a961c8808d113e2c98fb63676" | jq -r '.sha // "NOT_FOUND"'Repository: inthhq/dsar
Length of output: 65
🏁 Script executed:
#!/bin/bash
# Get the actual commit SHA for v7.0.11 tag
curl -sL "https://api.github.com/repos/peter-evans/create-pull-request/git/refs/tags/v7.0.11" 2>&1 | head -50Repository: inthhq/dsar
Length of output: 335
🏁 Script executed:
#!/bin/bash
# Try different API endpoint for tag info
curl -sL "https://api.github.com/repos/peter-evans/create-pull-request/releases/tags/v7.0.11" 2>&1 | jq '.target_commitish, .author.login' 2>&1 | head -10Repository: inthhq/dsar
Length of output: 65
🏁 Script executed:
#!/bin/bash
# Get commit info for the SHA in the workflow to see what it actually points to
curl -sL "https://api.github.com/repos/peter-evans/create-pull-request/commits/22a9089034f40e5a961c8808d113e2c98fb63676" 2>&1 | jq '.message // "NOT_FOUND"' 2>&1 | head -5Repository: inthhq/dsar
Length of output: 223
Fix: Invalid action SHA reference
The action SHA 22a9089034f40e5a961c8808d113e2c98fb63676 does not exist in the peter-evans/create-pull-request repository. Verify and update to the correct commit SHA for v7.0.11 or use the full release tag reference (e.g., peter-evans/create-pull-request@v7.0.11).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 192 - 212, The workflow step
named "Create pull request" references a non-existent action SHA
(peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676);
update the uses line to a valid reference by replacing that SHA with the
official tag or correct commit for v7.0.11 (e.g.,
peter-evans/create-pull-request@v7.0.11) so the step uses a known release of the
create-pull-request action.
Blocked — holding this PR until upstream publish is fixedAfter landing ``` The published tarball still contains unresolved `workspace:` and `catalog:` specifiers in `dependencies`, `devDependencies`, and `peerDependencies`. These need to be resolved to concrete versions at publish time (similar to how `c15t` and `leadtype` use a `bun scripts/resolve-workspace-deps.ts` step before `changeset publish`). What this PR needs to unblock
Converting to draft until the upstream is unblocked. |
1 participant
Summary
Adds a
bump-homebrew-tapjob to.github/workflows/release.yml. It runs after thereleasejob onmainand, ifdsaris inpublishedPackages:https://registry.npmjs.org/dsar/-/dsar-<version>.tgz(with retry while the registry catches up).inthhq/homebrew-tapupdatingFormula/dsar.rb'surlandsha256to the new version.Tap CI then runs
brew audit --strict --onlineandbrew test dsaragainst the change before the PR can be merged. The companion PR addingFormula/dsar.rbto the tap isinthhq/homebrew-tap#2.Required secret
Before merging, add a repo secret named
TAP_GITHUB_TOKEN:inthhq/homebrew-tapContents: write,Pull requests: writeThe default
GITHUB_TOKENcannot push to another repository, which is why a dedicated PAT is required.Test plan
TAP_GITHUB_TOKENto repo secrets.inthhq/homebrew-tap#2first soFormula/dsar.rbexists.dsarand confirm a bump PR appears atinthhq/homebrew-tapwith the correcturl+sha256.brew install,brew test,brew audit --strict --online) passes against the bump PR.Made with Cursor