feat(release): auto-bump the Homebrew cask on each published release#10
Merged
Conversation
The homebrew-tap cask pins a version + SHA-256, so `brew install` served the old version until someone hand-edited it. Add a release-job step that, after the GitHub Release is published, recomputes the DMG's SHA-256, renders Casks/capsule.rb via a new pure `update-homebrew-cask.sh`, and pushes it to capsule-native/homebrew-tap. Gated on a HOMEBREW_TAP_TOKEN secret (a PAT scoped to the tap, since the job's own GITHUB_TOKEN can't write another repo); absent — on forks — it's skipped with a warning, mirroring the existing signing-availability gate. Idempotent: re-running a release whose cask is unchanged is a no-op (no empty commit). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
homebrew-tapcask pins aversion+sha256, sobrew install --cask capsule-native/tap/capsulekeeps serving the old version after a release until someone hand-edits the cask. (Existing installs are fine —auto_updates truelets Sparkle update them in place — but fresh brew installs go stale.) This closes that gap.What
After Publish GitHub Release, the release job now:
Determine Homebrew tap availability— checks for theHOMEBREW_TAP_TOKENsecret; absent (forks), it skips with a warning, mirroring the existing signing-availability gate.Bump the Homebrew cask— reads the version fromApp/Info.plist(per the repo's "version comes from the app" rule), recomputes the DMG's SHA-256, rendersCasks/capsule.rbwith the new pureScripts/release/update-homebrew-cask.sh, and pushes it tocapsule-native/homebrew-tap. Idempotent — an unchanged cask is a no-op (no empty commit), so re-running a release is safe.update-homebrew-cask.shis network-free and secret-free (just renders the cask to stdout), keeping this repo the single source of truth for the cask template.This is a safe no-op until a secret is added — merge anytime. To turn it on, add a repo secret
HOMEBREW_TAP_TOKENoncapsule-native/capsule:capsule-native, Repository access → onlycapsule-native/homebrew-tap, Permissions → Contents: Read and write (Metadata: Read-only is auto-included). Nothing else.reposcope — simpler but grants all your repos; fine-grained is tighter.Verification
update-homebrew-cask.sh 0.1.0 <real v0.1.0 DMG>renders byte-identical to the live tap cask → first CI run is a clean no-op.brew styleon the rendered cask at aCasks/path: no offenses.make checkgreen (swift-format, architecture, license headers);bash -nclean; YAML parses with both new steps andtimeout-minutes: 60intact.🤖 Generated with Claude Code