Publish to Homebrew #56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to Homebrew | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tag-name: | |
| description: 'The git tag name to bump the formula to' | |
| required: true | |
| repository_dispatch: | |
| types: [ publish-release ] | |
| permissions: | |
| contents: read | |
| jobs: | |
| homebrew: | |
| permissions: | |
| contents: none | |
| name: Bump Homebrew formula | |
| runs-on: macos-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Get version | |
| id: get-version | |
| shell: pwsh | |
| run: | | |
| $version = "${{ github.event.client_payload.tag }}" | |
| if ($version -eq "") { | |
| $version = "${{ github.event.inputs.tag-name }}" | |
| } | |
| "version=$version" >> $env:GITHUB_OUTPUT | |
| - name: Load GitHub release token | |
| id: github-creds | |
| uses: gittools/cicd/github-creds@824c3d773fb5d1b00c26b474ae88b7ce9ae555ee # v5 | |
| with: | |
| op_service_account_token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} | |
| # Uses Homebrew's own `brew bump-formula-pr` (preinstalled on the runner) rather than a | |
| # third-party action. mislav/bump-homebrew-formula-action breaks when GitHub's tarball | |
| # endpoint returns HTTP 303 instead of 302 (see mislav/bump-homebrew-formula-action#342); | |
| # the official CLI handles the redirect correctly and removes a pinned-action dependency. | |
| - name: Bump Homebrew formula | |
| env: | |
| HOMEBREW_GITHUB_API_TOKEN: ${{ steps.github-creds.outputs.github_release_token }} | |
| HOMEBREW_GIT_NAME: GitTools Bot | |
| HOMEBREW_GIT_EMAIL: [email protected] | |
| HOMEBREW_NO_AUTO_UPDATE: "1" | |
| run: | | |
| version="${{ steps.get-version.outputs.version }}" | |
| url="https://github.com/GitTools/GitVersion/archive/refs/tags/${version}.tar.gz" | |
| sha256="$(curl -fsSL --proto '=https' --proto-redir '=https' "$url" | shasum -a 256 | cut -d ' ' -f 1)" | |
| git config --global user.name "GitTools Bot" | |
| git config --global user.email "[email protected]" | |
| brew bump-formula-pr gitversion \ | |
| --url "$url" \ | |
| --sha256 "$sha256" \ | |
| --fork-org gittools-bot \ | |
| --no-audit \ | |
| --no-browse \ | |
| --message "For additional details see https://github.com/GitTools/GitVersion/releases/tag/${version}" |