feat: add Homebrew formula and macOS binary releases by sonupreetam · Pull Request #742 · complytime/complyctl

sonupreetam · 2026-07-16T16:05:38Z

Summary

Add a source-build Homebrew Formula and macOS binary releases for complyctl.

Changes:

Add darwin/amd64 and darwin/arm64 to the GoReleaser build matrix
Add a "Publish Homebrew formula" step to the release workflow that
generates a source-build Formula and pushes it to complytime/homebrew-tap
Mint a short-lived GitHub App token via actions/create-github-app-token
for cross-repo push (uses existing APP_ID/PRIVATE_KEY secrets)
Fix deprecated archives.format → formats (GoReleaser v2)
Document Homebrew and go install as installation methods
Include OpenSpec artifacts documenting the architectural decisions

After merge, users install with:

brew install complytime/tap/complyctl

The Formula builds from source on the user's machine (Homebrew auto-installs
Go). This avoids macOS Gatekeeper/signing entirely — no Apple Developer
certificate, no xattr workaround needed.

Related Issues

Closes Publish complyctl on homebrew #713

Review Hints

The key design decision (Formula vs Cask) is documented in
openspec/changes/homebrew-formula-and-go-install/design.md — start there
for context on why source-build was chosen over pre-built binary distribution.
The release workflow's "Publish Homebrew formula" step uses a heredoc to
template the Ruby Formula file. The YAML indentation is handled by the |
block scalar (18 spaces stripped by YAML, leaving correct Ruby formatting).

Test results:

goreleaser check passes clean (zero deprecation warnings)
goreleaser release --snapshot --clean produces all 4 archives
(darwin/amd64, darwin/arm64, linux/amd64, linux/arm64)
darwin/arm64 binary runs locally (complyctl version reports correct metadata)
complyctl completion {bash,zsh,fish} generates completions successfully
CI passes on this PR
First release after merge publishes formula to complytime/homebrew-tap

Important

Admin pre-merge checklist:

Verify the GitHub App (APP_ID/PRIVATE_KEY) has Contents: write
permission on the homebrew-tap repository
If the App installation is scoped to specific repos (not all org repos),
add homebrew-tap to the list

sonupreetam · 2026-07-17T12:16:11Z

The lint issues are not from this PR. https://github.com/complytime/complyctl/actions/runs/29576984198/job/87873581142?pr=742
PR #750 fixes the error.

trevor-vaughan · 2026-07-21T20:18:51Z

Hi @sonupreetam. I'm happy to do an LLM-driven review of this if you like and review the results but I have almost no experience in the Homebrew/Mac ecosystem so I'm not sure I'm the best reviewer for this. Let me know if you'd like me to proceed anyway and happy to do so!

sonupreetam · 2026-07-22T06:37:39Z

No worries @trevor-vaughan, added @marcusburghardt & @jpower432 as the primary reviewers.

sonupreetam · 2026-07-30T11:01:18Z

@hbraswelrh I would need a re-review on this PR.

hbraswelrh · 2026-07-30T12:43:42Z

@hbraswelrh I would need a re-review on this PR.

Will do. Thanks, Sonu!

hbraswelrh

PR Review: #742 — feat: add Homebrew formula and macOS binary releases

Well-structured PR. Design decisions documented in OpenSpec ADR. All CI passes.
No runtime code changes — CI/CD, docs, and testing only.

Findings: 1 HIGH (auth header leak risk), 1 MEDIUM (template fragility — informational).
Verdict: COMMENT — no blocking issues, but the HIGH finding merits evaluation before merge.

This review was generated by /review-pr (AI-assisted).

sonupreetam · 2026-07-31T14:49:14Z

Hi @gxmiranda, would you take a look at the pre-merge checklist before this merges?

gxmiranda

LGTM

hbraswelrh

LGTM.

hbraswelrh · 2026-08-04T14:57:34Z

+The `homebrew` job in the release workflow automatically publishes or updates `Formula/complyctl.rb` in the [homebrew-tap](https://github.com/complytime/homebrew-tap) repository.
+
+**Prerequisites:**
+- The GitHub App (secrets: `APP_ID_HOMEBREW_FORMULA_PUBLISHER`, `PRIVATE_KEY_APP_HOMEBREW_FORMULA_PUBLISHER`) must have `Contents:write` permission on `complytime/homebrew-tap`


@sonupreetam as discussed this morning the indication of repo-scoped secrets are here

@hbraswelrh Did you mean that the docs need to indicate that we would be using the org-level secrets? If so, I would have to add that advisory.

- Add darwin/amd64 and darwin/arm64 to GoReleaser build matrix - Add Homebrew formula publishing step to release workflow - Use validated preflight tag (not raw inputs.tag) for homebrew job - Add explicit if guard on homebrew job matching release job pattern - Mint short-lived GitHub App token for cross-repo push - Fix deprecated archives.format -> formats (GoReleaser v2) - Document Homebrew and go install as installation methods - Add CHANGELOG entries for macOS binaries, Homebrew formula, go install - Include OpenSpec artifacts for architectural decisions Closes complytime#713 Signed-off-by: sonupreetam <spreetam@redhat.com>

Replace deprecated app-id input with client-id in actions/create-github-app-token. Rename secrets to descriptive names scoped to the Homebrew publishing use case: - APP_ID -> secrets.APP_ID_HOMEBREW_FORMULA_PUBLISHER - PRIVATE_KEY -> secrets.PRIVATE_KEY_APP_HOMEBREW_FORMULA_PUBLISHER Admin action required: create both secrets in GitHub Settings before the next release. Signed-off-by: sonupreetam <spreetam@redhat.com>

sonupreetam · 2026-08-04T16:18:47Z

@hbraswelrh & @gxmiranda I just rebased and new a re-review.

sonupreetam requested a review from a team as a code owner July 16, 2026 16:05

sonupreetam requested review from trevor-vaughan and yvonnedevlinrh July 16, 2026 16:05

sonupreetam force-pushed the feat/homebrew-tap branch 2 times, most recently from b28a9ac to b7e8fca Compare July 17, 2026 10:26

sonupreetam changed the title ~~feat: add Homebrew cask and macOS binary releases~~ feat: add Homebrew formula and macOS binary releases Jul 17, 2026

sonupreetam force-pushed the feat/homebrew-tap branch 3 times, most recently from 1adab71 to 53abb4f Compare July 17, 2026 11:29

This was referenced Jul 17, 2026

docs: complyctl Homebrew formula and macOS binary installation unbound-force/website#188

Open

blog: complyctl now available via Homebrew — one-command install for macOS and Linux unbound-force/website#189

Open

sonupreetam marked this pull request as draft July 17, 2026 12:19

sonupreetam force-pushed the feat/homebrew-tap branch 4 times, most recently from ef14585 to d9b86b2 Compare July 20, 2026 12:20

sonupreetam marked this pull request as ready for review July 20, 2026 13:01

sonupreetam force-pushed the feat/homebrew-tap branch from d9b86b2 to dce1421 Compare July 20, 2026 13:02

sonupreetam marked this pull request as draft July 20, 2026 13:08

sonupreetam force-pushed the feat/homebrew-tap branch 2 times, most recently from ed7f106 to d9b2d33 Compare July 20, 2026 13:46

sonupreetam marked this pull request as ready for review July 20, 2026 14:21

sonupreetam force-pushed the feat/homebrew-tap branch from d9b2d33 to 688f6e3 Compare July 21, 2026 13:10

sonupreetam requested review from jpower432 and marcusburghardt and removed request for trevor-vaughan and yvonnedevlinrh July 22, 2026 06:34

sonupreetam force-pushed the feat/homebrew-tap branch 2 times, most recently from 22e6695 to 98c4394 Compare July 30, 2026 10:52

hbraswelrh reviewed Jul 30, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

Comment thread .github/workflows/release.yml

sonupreetam dismissed yvonnedevlinrh’s stale review via c07a3a2 July 31, 2026 09:50

sonupreetam force-pushed the feat/homebrew-tap branch 2 times, most recently from c07a3a2 to 59cf6ef Compare July 31, 2026 10:19

sonupreetam requested a review from hbraswelrh July 31, 2026 10:28

sonupreetam mentioned this pull request Jul 31, 2026

feat: add GitHub Actions security linter (zizmor/actionlint) to pre-flight skill and adversary agent unbound-force/unbound-force#390

Open

4 tasks

sonupreetam force-pushed the feat/homebrew-tap branch from 59cf6ef to 41c12ef Compare July 31, 2026 11:58

gxmiranda reviewed Aug 3, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

gxmiranda reviewed Aug 3, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

sonupreetam force-pushed the feat/homebrew-tap branch from eb09fb2 to 6e1ea6d Compare August 4, 2026 08:45

gxmiranda previously approved these changes Aug 4, 2026

View reviewed changes

This was referenced Aug 4, 2026

[Task] Reusable Homebrew workflow for source-build formula publishing complytime/org-infra#500

Open

Adopt org-infra reusable Homebrew workflow for formula publishing #805

Open

hbraswelrh previously approved these changes Aug 4, 2026

View reviewed changes

sonupreetam added 2 commits August 4, 2026 18:06

sonupreetam force-pushed the feat/homebrew-tap branch from 6e1ea6d to bbd07e0 Compare August 4, 2026 16:07

sonupreetam enabled auto-merge (squash) August 4, 2026 16:07

sonupreetam disabled auto-merge August 4, 2026 16:08

sonupreetam dismissed stale reviews from hbraswelrh and gxmiranda via 349503d August 4, 2026 16:12

sonupreetam force-pushed the feat/homebrew-tap branch from 349503d to bbd07e0 Compare August 4, 2026 16:17

sonupreetam requested review from gxmiranda and hbraswelrh August 4, 2026 16:18

Uh oh!

Conversation

sonupreetam commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issues

Review Hints

Uh oh!

sonupreetam commented Jul 17, 2026

Uh oh!

trevor-vaughan commented Jul 21, 2026

Uh oh!

sonupreetam commented Jul 22, 2026

Uh oh!

sonupreetam commented Jul 30, 2026

Uh oh!

hbraswelrh commented Jul 30, 2026

Uh oh!

hbraswelrh left a comment

Choose a reason for hiding this comment

PR Review: #742 — feat: add Homebrew formula and macOS binary releases

Uh oh!

Uh oh!

Uh oh!

sonupreetam commented Jul 31, 2026

Uh oh!

Uh oh!

Uh oh!

gxmiranda left a comment

Choose a reason for hiding this comment

Uh oh!

hbraswelrh left a comment

Choose a reason for hiding this comment

Uh oh!

hbraswelrh Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

sonupreetam Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonupreetam commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sonupreetam commented Jul 16, 2026 •

edited

Loading

sonupreetam Aug 4, 2026 •

edited

Loading