Skip to content

Don't bump Homebrew from the release; the formula is autobumped #401

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tylervick merged 1 commit into from
Aug 7, 2026
Merged

Don't bump Homebrew from the release; the formula is autobumped #401

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 11 additions & 12 deletions .github/workflows/homebrew-bump.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,16 @@
name: Brew Bump

# Manual escape hatch only.
#
# xctesthtmlreport is on Homebrew's autobump list: BrewTestBot opens a
# version-bump PR against homebrew-core on its own roughly every 3 hours after
# a release, and `brew bump-formula-pr` refuses a manual bump for autobumped
# formulae. Every formula PR since 2.5.1 has been opened by BrewTestBot.
#
# This is kept only for the case where the formula leaves the autobump list
# (gains a `no_autobump!` or a skipped livecheck). It is deliberately not wired
# into the release workflow, because it would fail every release.
on:
# Called by the Release workflow. A `release:` event trigger cannot work
# here: the release is published by softprops/action-gh-release using
# GITHUB_TOKEN, and GitHub deliberately does not start new workflow runs
# from events created by GITHUB_TOKEN.
workflow_call:
inputs:
version:
type: string
required: true
workflow_dispatch:
inputs:
version:
Expand All @@ -27,9 +28,7 @@ jobs:
# The input reaches the shell through the environment, never through
# ${{ }} interpolation into the script body — a dispatch input is
# attacker-controllable by anyone with write access, and this job holds
# the Homebrew token. Validated against the tag shapes the release
# workflow accepts, so a malformed value fails here rather than being
# passed to Homebrew.
# the Homebrew token.
env:
RAW_VERSION: ${{ inputs.version }}
run: |
Expand Down
15 changes: 0 additions & 15 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,18 +179,3 @@ jobs:
reviewers: tylervick
base: main

homebrew:
# Called directly rather than triggered by a `release:` event, because the
# release is published with GITHUB_TOKEN and GitHub does not start new
# workflow runs from events that token creates.
needs: [build, release]
if: github.event_name == 'push' && needs.build.outputs.prerelease != 'true'
uses: ./.github/workflows/homebrew-bump.yml
with:
version: ${{ needs.build.outputs.version }}
# inherit rather than passing a named secret: the called workflow also runs
# standalone via workflow_dispatch, which cannot be passed secrets at all,
# so it must read HOMEBREW_BUMP_ACCESS_TOKEN from the repository either way.
# Inheriting keeps one code path instead of a fallback whose branches
# resolve differently depending on how the workflow was triggered.
secrets: inherit
Loading