Publish to Homebrew #61
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to Homebrew | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tag-name: | |
| description: 'The git tag name to bump the formula to' | |
| required: true | |
| repository_dispatch: | |
| types: [ publish-release ] | |
| permissions: | |
| contents: read | |
| jobs: | |
| homebrew: | |
| permissions: | |
| contents: none | |
| name: Bump Homebrew formula | |
| runs-on: macos-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Get version | |
| id: get-version | |
| shell: pwsh | |
| run: | | |
| $version = "${{ github.event.client_payload.tag }}" | |
| if ($version -eq "") { | |
| $version = "${{ github.event.inputs.tag-name }}" | |
| } | |
| "version=$version" >> $env:GITHUB_OUTPUT | |
| - name: Load GitHub release token | |
| id: github-creds | |
| uses: gittools/cicd/github-creds@824c3d773fb5d1b00c26b474ae88b7ce9ae555ee # v5 | |
| with: | |
| op_service_account_token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} | |
| - name: Bump Homebrew formula | |
| env: | |
| HOMEBREW_GITHUB_API_TOKEN: ${{ steps.github-creds.outputs.github_release_token }} | |
| HOMEBREW_GIT_NAME: GitTools Bot | |
| HOMEBREW_GIT_EMAIL: [email protected] | |
| HOMEBREW_NO_AUTO_UPDATE: "1" | |
| run: | | |
| version="${{ steps.get-version.outputs.version }}" | |
| url="https://github.com/GitTools/GitVersion/archive/refs/tags/${version}.tar.gz" | |
| sha256="$(curl -fsSL --proto '=https' --proto-redir '=https' "$url" | shasum -a 256 | cut -d ' ' -f 1)" | |
| git config --global user.name "GitTools Bot" | |
| git config --global user.email "[email protected]" | |
| # No --fork-org: that flag requires an *organization* login, but the | |
| # publish runs as the gittools-bot *user*. Omitting it makes brew fork | |
| # to the authenticated user (gittools-bot/homebrew-core) — the same | |
| # target the old action used via push-to. | |
| brew bump-formula-pr gitversion \ | |
| --url "$url" \ | |
| --sha256 "$sha256" \ | |
| --fork-org gittools \ | |
| --no-audit \ | |
| --no-browse \ | |
| --message "For additional details see https://github.com/GitTools/GitVersion/releases/tag/${version}" |