diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6bd09e6..3783c85 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,6 +50,42 @@ jobs: env: CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} + # Update the Homebrew tap formula (only when release is published, like crates.io) + publish-homebrew: + name: Update Homebrew Tap + runs-on: ubuntu-latest + if: github.event_name == 'release' && github.event.action == 'published' && !github.event.release.prerelease + steps: + - name: Compute release tarball SHA256 + id: tarball + run: | + TAG="${{ github.event.release.tag_name }}" + VERSION="${TAG#v}" + curl -sL --fail "https://github.com/${{ github.repository }}/archive/refs/tags/${TAG}.tar.gz" -o ftr.tar.gz + echo "version=${VERSION}" >> "$GITHUB_OUTPUT" + echo "sha256=$(sha256sum ftr.tar.gz | cut -d' ' -f1)" >> "$GITHUB_OUTPUT" + + - name: Checkout homebrew-ftr tap + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + repository: dweekly/homebrew-ftr + token: ${{ secrets.HOMEBREW_TAP_TOKEN }} + + - name: Update formula and push + run: | + VERSION="${{ steps.tarball.outputs.version }}" + SHA256="${{ steps.tarball.outputs.sha256 }}" + sed -i -E "s|^ url \".*\"| url \"https://github.com/dweekly/ftr/archive/refs/tags/v${VERSION}.tar.gz\"|" ftr.rb + sed -i -E "s|^ sha256 \".*\"| sha256 \"${SHA256}\"|" ftr.rb + if git diff --quiet ftr.rb; then + echo "Formula already at v${VERSION}, nothing to do" + exit 0 + fi + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git commit -am "Update ftr to v${VERSION}" + git push + build-deb: name: Build Debian Package runs-on: ubuntu-latest diff --git a/docs/RELEASE_PROCESS.md b/docs/RELEASE_PROCESS.md index 75e1c24..a158620 100644 --- a/docs/RELEASE_PROCESS.md +++ b/docs/RELEASE_PROCESS.md @@ -107,17 +107,27 @@ When you push the tag, the following automated processes will run: - Link to the full CHANGELOG - Credit contributors -4. **Publish the release** (this triggers the crates.io publish) +4. **Publish the release** (this triggers the crates.io publish and the Homebrew tap update) ### 7. Verify the Release After publishing: 1. Check that the release appears on crates.io -2. Test installation methods: +2. Check that [dweekly/homebrew-ftr](https://github.com/dweekly/homebrew-ftr) got the automated formula bump commit +3. Test installation methods: - `cargo install ftr` + - `brew upgrade ftr` (builds from source) - Debian package installation - Windows binary execution -3. Update any documentation that references the version +4. Update any documentation that references the version + +## Required Secrets + +The release workflow depends on these repository secrets: +- `CARGO_REGISTRY_TOKEN` — crates.io API token for `cargo publish` +- `HOMEBREW_TAP_TOKEN` — GitHub personal access token with push access to + `dweekly/homebrew-ftr` (fine-grained PAT scoped to that repo with + Contents: read/write). The default `GITHUB_TOKEN` cannot push cross-repo. ## Security Considerations @@ -163,6 +173,15 @@ If the crates.io publish fails: - Missing or invalid API token - Cargo.toml metadata issues +### Homebrew tap update fails + +If the `Update Homebrew Tap` job fails: +1. Check that the `HOMEBREW_TAP_TOKEN` secret exists and has not expired +2. Fall back to a manual bump in `dweekly/homebrew-ftr`: update the `url` and + `sha256` lines in `ftr.rb` (download the tarball first, then + `shasum -a 256 ` — don't pipe curl into shasum; that produced a + wrong hash for v0.6.0) and push + ## Emergency Release Process In case of critical security fixes: