Skip to content

Land formula and bottle commits on main through an approved PR - #15

Open
samyakLambda wants to merge 1 commit into
mainfrom
chore/homebrew-pr-flow
Open

samyakLambda wants to merge 1 commit into
mainfrom
chore/homebrew-pr-flow

Conversation

@samyakLambda

Copy link
Copy Markdown
Collaborator

Since 2 Nov 2026 this tap's main is under the org's "PR required" ruleset: one approval, the approver can't be the last pusher, and nobody can bypass it. update-formula.yml and build-bottles.yml both pushed straight to main, so the next CLI release would stop at the tap.

What changes

  • scripts/merge-via-pr.sh replaces both pushes:
    1. Pushes the commit to chore/rook-<version>[-bottles]-run-<run id>-<attempt>.
    2. Opens a PR and prints its link as a notice and in the job summary.
    3. Merges it (squash) once a maintainer approves. A maintainer merging it by hand works too.
  • Guards:
    • Never lands over a main that moved after checkout, as the old non-fast-forward push refused to. It closes the PR and fails instead.
    • A re-run closes an earlier run's open PR for the same version.
    • Gives up after 5½ hours, inside the jobs' new 6-hour timeout. The PR stays open, and the error says which step to run by hand after merging it.
  • MAINTAINING.md describes the approval step. Each release now has two PRs to approve: the formula, then the bottle block. The bot is the last pusher, so whoever cut the release can approve both.

No new secrets: the repo already lets GITHUB_TOKEN open and merge PRs, and the workflows add pull-requests: write.

Tests

  • scripts/test-merge-via-pr.sh (new): runs the real script end to end against a bare remote, with scripts/fixtures/fake-gh standing in for gh pr. 26 checks: approved, hand-merged, closed, timeout, merge refused, main moved, and a superseded earlier run.
    • Each guard was checked by breaking it on purpose: dropping the moved-main check, the superseded close, the head-commit pin, or the branch cleanup turns the harness red.
  • test-version-order.mjs: the competing-push case now runs through the PR path.
  • All 7 harnesses pass locally. actionlint is clean.
  • Not testable before a real release:
    • whether GitHub reports the approval as APPROVED under the org ruleset; if it doesn't, a hand merge still completes the run
    • the ruleset's "extra approval for unattributed changes" setting

Related

The private release pipeline's Homebrew step gives up after 5 minutes. A separate private PR makes it end green once the formula PR is open and waiting. Until that ships, a release run goes red at that step even though the tap PR is fine to approve.

🤖 Generated with Claude Code

Since 2 Nov 2026 the org's "PR required" ruleset covers this tap's main:
one approval, the approver is not the last pusher, no bypass. Both release
workflows pushed straight to main, so the next release would stop at the
tap.

scripts/merge-via-pr.sh replaces those pushes. It pushes HEAD to
chore/rook-<version>[-bottles]-run-<run id>-<attempt>, opens a PR, prints
the link, and merges it once a maintainer approves (or notices a hand
merge). It closes an earlier run's open PR for the same prefix, refuses to
land if main moved since checkout (as the non-fast-forward push did), and
gives up after 5h30m inside the jobs' new 6-hour timeout, leaving the PR
open with the next step to run by hand.

scripts/test-merge-via-pr.sh runs it end to end against a bare remote and
scripts/fixtures/fake-gh; test-version-order.mjs's competing-push case now
goes through it. MAINTAINING.md describes the approval step.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant