chore: prepare v0.8.2 and guard the flake version against the tag - #4
Merged
Conversation
v0.8.1 published its binaries, tarballs and a working checksums.txt, but not the Homebrew cask: HOMEBREW_TAP_TOKEN was not set yet, so the cask pipe got 401 Bad credentials. Re-running with the secret in place cannot fix it. Releases here are immutable, and the `release` pipe runs before `cask` -- goreleaser bails with "already exists and is immutable, it cannot be updated" before it ever reaches the cask. There is a `homebrew` skip key but none for the SCM release, so the cask cannot be published on its own. The tap therefore needs a fresh tag, which is what the version bump is for. Immutability makes any tag-time mistake permanent, so add a preflight check for the one input that can silently disagree with the tag: flake.nix states its version literally, since Nix builds from a source tree with no .git and `git describe` is unavailable there. Nothing else would catch a stale value -- the flake would just build and report the wrong version forever. The check reads the tag from the environment rather than interpolating it into the script, matching a72d115. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
v0.8.1 shipped most of what #3 set out to fix — 8 assets, and a
checksums.txtthat actually verifies (sha256sum -cexits 0 on clean assets, 1 on a tampered one; the v0.8.0 file matched nothing and exited 0 anyway). Intel and Apple Silicon binaries both run and reportmcli version 0.8.1.The cask didn't publish.
HOMEBREW_TAP_TOKENwasn't set at the time, so the cask pipe got401 Bad credentials. The secret exists now, but re-running the job can't recover it:Releases in this repo are immutable, and
release.Pipe{}runs beforecask.Pipe{}(goreleaser orders it that way deliberately — "brew et al use the release URL, so, they should be last"). So the re-run dies before reaching the cask. goreleaser's check is unconditional, with the comment "retrying will never succeed", and while there's ahomebrewskip key, there's no skip for the SCM release — the cask can't be published by itself. A fresh tag is the only path, hence the bump.The guard
Immutability means a tag-time mistake is permanent, so this adds a preflight check for the one input that can silently disagree with the tag.
flake.nixhas to state its version literally — Nix builds from a source tree with no.git, sogit describeisn't available. Nothing else would catch a stale value: the Go build is unaffected, CI onmastercan't compare against a tag, and the flake would keep building and reporting the wrong version indefinitely. This bit immediately: bumping to v0.8.2 required remembering to editflake.nix.The step runs before Go is even set up, so it fails in seconds and nothing gets published. It reads the tag from
env:rather than interpolating${{ }}into the script, consistent with a72d115.Verification
v0.8.2, rejectsv0.8.1andv1.0.0(exit 1 with an::error file=flake.nix::annotation).nix build .#mcli→mcli version 0.8.2.After merge
Tag
v0.8.2. With the secret in place this exercises the whole path end to end, and populatesCasks/mcli.rbin the tap — which is the part still unproven in production.🤖 Generated with Claude Code