Skip to content

Replace Homebrew bump action with direct formula update #184

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
helizaga merged 2 commits into from
Jun 12, 2026
+42 −12
Merged

Replace Homebrew bump action with direct formula update #184

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9009031
Replace Homebrew bump action with direct formula update
helizaga Jun 12, 2026
05cc9dd
Allow manual formula bump via workflow_dispatch
helizaga Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 42 additions & 12 deletions .github/workflows/homebrew.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,25 +3,55 @@ name: Update Homebrew Formula
on:
release:
types: [published]
workflow_dispatch:
inputs:
tag-name:
description: Release tag to bump the formula to (e.g. v2.8.0)
required: true
type: string

permissions: read-all

# mislav/bump-homebrew-formula-action rejects the HTTP 303 redirects GitHub
# now serves for tarball URLs (mislav/bump-homebrew-formula-action#340), so
# the formula is bumped directly via the tap's contents API instead.
jobs:
homebrew:
name: Bump Homebrew formula
runs-on: ubuntu-latest
if: ${{ !github.event.release.prerelease }}
steps:
- uses: mislav/bump-homebrew-formula-action@56a283fa15557e9abaa4bdb63b8212abc68e655c # v3
with:
formula-name: git-gtr
formula-path: Formula/git-gtr.rb
homebrew-tap: coderabbitai/homebrew-tap
tag-name: ${{ github.event.release.tag_name }}
create-pullrequest: false
commit-message: |
{{formulaName}} {{version}}

Automated update from https://github.com/coderabbitai/git-worktree-runner
- name: Bump Formula/git-gtr.rb in coderabbitai/homebrew-tap
env:
COMMITTER_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
TAG_NAME: ${{ github.event.release.tag_name || inputs.tag-name }}
run: |
set -euo pipefail

version="${TAG_NAME#v}"
url="https://github.com/coderabbitai/git-worktree-runner/archive/refs/tags/${TAG_NAME}.tar.gz"
Comment on lines +26 to +32

@coderabbitai coderabbitai Bot Jun 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate or escape TAG_NAME before use in sed patterns.

TAG_NAME originates from github.event.release.tag_name and is embedded directly into the url variable, which is later used unescaped in sed substitution patterns (lines 40-41). Git tags can contain characters like | (the sed delimiter), & (replacement metacharacter), or backslashes that could break the sed command or cause unintended substitutions.

While the curl download will likely fail for malformed URLs (providing implicit validation), consider adding explicit validation:

Proposed fix: validate tag format 
          set -euo pipefail

+         # Validate tag format (vX.Y.Z)
+         if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+           echo "Invalid tag format: $TAG_NAME" >&2
+           exit 1
+         fi
+
          version="${TAG_NAME#v}"
          url="https://github.com/coderabbitai/git-worktree-runner/archive/refs/tags/${TAG_NAME}.tar.gz"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
TAG_NAME: ${{ github.event.release.tag_name }}
run: |
set -euo pipefail
version="${TAG_NAME#v}"
url="https://github.com/coderabbitai/git-worktree-runner/archive/refs/tags/${TAG_NAME}.tar.gz"
GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
TAG_NAME: ${{ github.event.release.tag_name }}
run: |
set -euo pipefail
# Validate tag format (vX.Y.Z)
if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "Invalid tag format: $TAG_NAME" >&2
exit 1
fi
version="${TAG_NAME#v}"
url="https://github.com/coderabbitai/git-worktree-runner/archive/refs/tags/${TAG_NAME}.tar.gz"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/homebrew.yml around lines 20 - 26, TAG_NAME is inserted
directly into url and later used in sed substitutions; validate or escape it
before use. Add a validation step for TAG_NAME (e.g., require a safe pattern
like an optional leading "v" followed by alphanumerics, ., _, -) and exit with
an error if it doesn't match; alternatively, escape sed metacharacters in
TAG_NAME (and derived version/url) before any sed command by replacing
characters like | / & \ with escaped versions so the sed substitution won't
break. Ensure these checks/escapes are applied to the TAG_NAME -> version/url
flow and before the sed commands that reference those variables.


curl -fsSL --retry 3 "$url" -o release.tar.gz
sha256=$(sha256sum release.tar.gz | awk '{print $1}')

gh api repos/coderabbitai/homebrew-tap/contents/Formula/git-gtr.rb > formula.json
blob_sha=$(jq -r '.sha' formula.json)
jq -r '.content' formula.json | base64 -d > git-gtr.rb

if grep -qF " url \"${url}\"" git-gtr.rb; then
echo "Formula already at ${TAG_NAME}; nothing to do."
exit 0
fi

sed -i "s|^ url \".*\"$| url \"${url}\"|" git-gtr.rb
sed -i "s|^ sha256 \".*\"$| sha256 \"${sha256}\"|" git-gtr.rb

grep -qF " url \"${url}\"" git-gtr.rb
grep -qF " sha256 \"${sha256}\"" git-gtr.rb

message="$(printf 'git-gtr %s\n\nAutomated update from https://github.com/coderabbitai/git-worktree-runner' "$version")"

gh api --method PUT repos/coderabbitai/homebrew-tap/contents/Formula/git-gtr.rb \
-f message="$message" \
-f content="$(base64 -w0 git-gtr.rb)" \
-f sha="$blob_sha"
Loading