ci: fix Homebrew auto-bump (url+sha256 only, avoid PyPI 24h window) - #25
Merged
Conversation
The old action-homebrew-bump-formula step let Homebrew auto-resolve Python resources with pip's `--uploaded-prior-to = now - 24h` window, which excludes the version just published minutes earlier — so every post-release bump failed with 'Unable to determine dependencies ... update the resources manually'. Replace it with a script that only rewrites the formula's top-level url + sha256 from PyPI (with retry for CDN lag) and opens a tap PR. Resource blocks are left intact; they are regenerated by a human via the homebrew-tap-bump skill only when transitive deps drift. This removes the Homebrew/brew-trust dependency entirely and is immune to the 24h window. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Homebrew tap bump automation to avoid Homebrew’s --uploaded-prior-to=now-24h resolution window for Python virtualenv formulae by directly fetching the new sdist url + sha256 from PyPI and opening a PR that only updates those top-level fields.
Changes:
- Replace
dawidd6/action-homebrew-bump-formulausage with an inline bash script that queries the PyPI JSON API (with retries). - Update the tap formula by rewriting only the top-level
urlandsha256, leavingresourceblocks untouched. - Create/update a PR in
rgielen/homebrew-tapsviagh.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Keep URL/SHA scalar with jq first(...) // "" (guards against multiple sdists / missing entries). - Rewrite the whole url/sha256 line via awk $0= instead of sub(), avoiding awk's & replacement semantics on the interpolated URL; fail with exit 3 if either top-level line is not found so a formula-format change can't silently no-op. - Authenticate git via 'gh auth setup-git' and clone without an embedded token, so the PAT is never placed in a remote URL or .git/config. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Comment on lines
+33
to
+35
| env: | ||
| GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} | ||
| TAG: ${{ github.event.workflow_run.head_branch || inputs.tag }} |
Comment on lines
+103
to
+117
| else | ||
| gh pr create \ | ||
| --repo rgielen/homebrew-taps \ | ||
| --base main --head "${BRANCH}" \ | ||
| --title "leitum ${VERSION}" \ | ||
| --body "Bumps the \`leitum\` formula \`url\` + \`sha256\` to ${VERSION} (from PyPI). | ||
|
|
||
| The transitive Python resource blocks were **not** regenerated. If this release changed the dependency set, regenerate them before merging (see the \`homebrew-tap-bump\` skill). The tap has no CI, so verify locally first: | ||
|
|
||
| \`\`\` | ||
| brew install --build-from-source rgielen/taps/leitum | ||
| brew audit --strict rgielen/taps/leitum | ||
| brew test rgielen/taps/leitum | ||
| \`\`\`" | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Homebrew auto-bump has failed on the last several releases (most recently
run for v0.1.4):
Root cause:
dawidd6/action-homebrew-bump-formularunsbrew bump-formula-pr,which for a
Language::Python::Virtualenvformula auto-resolves the transitiveresource set via pip with
--uploaded-prior-to = now − 24h(a Homebrew safetywindow). The bump runs minutes after the release, so the just-published version
is inside the excluded window and pip cannot resolve it — the step fails every
time. The action exposes no option to disable resource resolution.
Fix
Replace the action with a small script that:
url+sha256for the new version straight from the PyPIJSON API (retrying for CDN lag), and
url+sha256(the first,2-space-indented lines; resource blocks are 4-space-indented and never match),
then opens a PR against
rgielen/homebrew-taps.Resource blocks are intentionally left untouched — they only need regenerating
when a transitive dependency drifts, which stays a human/skill responsibility
(
homebrew-tap-bump). This drops the Homebrew setup + tap-trust steps entirelyand is immune to the 24h window.
The tap has no CI, so the opened PR is verified locally (
brew install --build-from-source,brew audit --strict,brew test) before merging — samegate as today.
Test plan
runscript passesbash -nawktargeting verified on the real formula: only the top-levelurl+sha256change; all 22+ resource blocks untouchedpassed
brew install --build-from-source+brew audit --strict+brew testworkflow_dispatchwith atag) that the job opens a clean tap PR🤖 Generated with Claude Code