ci: Publish a Homebrew cask on release - #83
Conversation
`brew install Flagsmith/tap/flagsmith`, from our own tap rather than homebrew-core: core needs 30 forks, 30 watchers or 75 stars, and does not take submissions from a project's own authors. A cask, not a formula, because we ship prebuilt binaries — and because goreleaser removed the `brews` (formula) section in v2.16 in favour of `homebrew_casks`. The workflow pins `~> v2`, so `brews` was never an option. The tap enforces the same no-direct-push rule as everywhere else, so `pull_request.enabled` puts the cask on a `flagsmith-cli-<version>` branch and opens a PR. Without it goreleaser commits straight to the tap's default branch; setting it also defaults the head branch, so no branch config here. `GITHUB_TOKEN` cannot reach another repo, so the cask push borrows the engineering GitHub App, scoped to `homebrew-tap` and to the two permissions the PR needs. Same pattern as flagsmith/flagsmith's renovate and update-flagsmith-environment workflows. The postflight `xattr` strips the quarantine attribute Homebrew sets on what it downloads: our macOS binaries are unsigned, so without it the first run dies with "flagsmith is damaged and can't be opened". `install.sh` never hit this because curl does not set the attribute. Notarisation is the real fix. Verified with `goreleaser check` and a snapshot build. `flagsmith completion` runs without config or auth, so install-time completion generation is safe. beep boop
📝 WalkthroughWalkthroughThe release workflow generates a scoped GitHub App token for the Estimated code review effort: 2 (Simple) | ~10 minutes Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 20b96c2d-37b4-46ce-921e-b5eb83f37130
📒 Files selected for processing (3)
.github/workflows/release.yml.goreleaser.yamlREADME.md
2 participants
In this PR, we add support for
brew install Flagsmith/tap/flagsmith.Goreleaser is configured to open PRs against Flagsmith/homebrew-tap so Vanta's branch protection rule requirement is maintained. Flagsmith Engineering bot credentials are used.
Prerequisites:
FLAGSMITH_ENGINEERING_GH_APP_IDand..._PRIVATE_KEYshould be set org-level — confirmed.