Skip to content

release.md

Latest commit

 

History

History
182 lines (133 loc) · 5.62 KB

release.md

File metadata and controls

182 lines (133 loc) · 5.62 KB
Raw

Release Process

Overview

git-all is distributed via Homebrew tap using prebuilt binaries. This approach is language-agnostic - the formula downloads architecture-specific binaries regardless of whether they were built with Rust, Zig, or Crystal.

Architecture

rsanheim/git-all                rsanheim/homebrew-tap
├── .github/workflows/          ├── Formula/
│   └── release.yml  ──────────►│   └── git-all.rb
└── script/                     └── .github/workflows/
    ├── release                     └── lint.yml
    └── update-homebrew

Artifact naming (language-agnostic):

git-all-{version}-darwin-arm64.tar.gz
git-all-{version}-darwin-x86_64.tar.gz
git-all-{version}-linux-arm64.tar.gz
git-all-{version}-linux-x86_64.tar.gz

Release Steps

1. Create Release

From the git-all repo:

# Dry-run first
script/release --dry-run 0.6.0

# Create the release
script/release 0.6.0

This will:

  • Update version in rust/Cargo.toml
  • Commit the version bump
  • Create and push a v0.6.0 tag
  • GitHub Actions builds binaries and creates a GitHub Release

2. Update Homebrew Tap

After GitHub Actions completes (~5 min):

# Dry-run to see SHA256 hashes
script/update-homebrew --dry-run 0.6.0

# Update the formula
script/update-homebrew 0.6.0

# Commit and push the tap
cd ~/src/rsanheim/homebrew-tap
git diff  # verify changes
git add -A && git commit -m "git-all 0.6.0" && git push

3. Verify Installation

brew update
brew upgrade git-all  # or: brew install rsanheim/tap/git-all
git-all --version

Local Testing

Before releasing, test the formula locally:

cd ~/src/rsanheim/homebrew-tap
brew style Formula/git-all.rb
brew readall rsanheim/tap
brew test rsanheim/tap/git-all

# Optional extra lint pass. Homebrew 6 rejects path-based audit.
brew audit --strict rsanheim/tap/git-all

Changing Implementation Language

When switching from Rust to Zig (or Crystal):

Component Changes No Changes
release.yml cargo build → zig build Artifact names, upload step
script/release Cargo.toml → build.zig Tag/push logic
Formula/git-all.rb None Downloads same artifacts

The formula never knows what language built the binary.

TODO

Make git-all repo public

Audit for sensitive content

Secrets and Credentials:

  • Search for API keys, tokens, passwords: git log -p --all -S "password\|secret\|token\|api_key\|credential"
  • Check for AWS/GCP/Azure credential patterns (e.g., AKIA, azure_, service account JSON)
  • Verify no .env files in history: git log --all --diff-filter=A --name-only | grep -i env
  • Search for private key headers: git log -p --all -S "BEGIN.*PRIVATE KEY"

Personal Information:

  • Search for hardcoded home paths: git log -p --all -S "/Users/\|/home/"
  • Check for email addresses in code (not commits): grep -r "@" --include="*.rs" --include="*.zig" --include="*.cr"
  • Look for internal hostnames or IP addresses

Private Dependencies:

  • Verify Cargo.toml uses only public crates (no private git URLs)
  • Verify shard.yml uses only public shards
  • Check for private git URLs in build configs (build.zig.zon, etc.)

Configuration Files:

  • Confirm .gitignore covers local config files
  • Add .claude/settings.local.json to .gitignore
  • Verify no IDE configs with personal paths are tracked

Review git history

File History Analysis:

  • List deleted files: git log --all --diff-filter=D --name-only --oneline
  • Check for sensitive file patterns (.env, credentials, secrets, *.pem)
  • Verify no config files with secrets were ever tracked

Commit Message Review:

  • Scan messages for sensitive keywords: git log --all --oneline | grep -iE "secret|password|token|key"
  • Check for internal project or private repo references

Binary Artifacts:

Early commits include nit-crystal/bin/nit (543KB) and nit-crystal/bin/nit.dwarf (1MB) - ~1.5MB total bloat.

Decision: Skip cleanup - The cost outweighs the benefit:

  • 13 PRs exist (11 merged, 2 open) - rewriting would orphan all commit references
  • Open PRs (#3, #13) would break and need manual rebasing
  • 1.5MB is negligible for a CLI tool repo
  • No security risk - binaries contain no sensitive data

If cleanup is ever needed, use git-filter-repo (the modern, git-recommended replacement for BFG):

# Install
brew install git-filter-repo

# Create fresh mirror clone (required)
git clone --mirror git@github.com:rsanheim/git-all.git git-all-cleanup
cd git-all-cleanup

# Remove the files
git filter-repo --invert-paths \
  --path nit-crystal/bin/nit \
  --path nit-crystal/bin/nit.dwarf

# Re-add origin (filter-repo removes it) and force push
git remote add origin git@github.com:rsanheim/git-all.git
git push origin --force --all
git push origin --force --tags

Warning: This rewrites all commit SHAs, breaks PR references, and requires all clones to be re-fetched.

Finalize for public release

  • Add LICENSE file (MIT)
  • Review and clean up documentation
  • Update README with project overview and usage
  • Make repo public on GitHub

Homebrew distribution

  • Create rsanheim/homebrew-tap repository on GitHub
  • Push homebrew-tap initial commit
  • Merge release-workflow branch in git-all repo
  • Create first release (script/release 0.5.0)
  • Update tap with real SHA256 hashes (script/update-homebrew 0.6.0)
  • Test installation: brew tap rsanheim/tap && brew install git-all