Support Homebrew install#279
Conversation
Add Homebrew tap formula for clickhousectl using prebuilt binaries from builds.clickhouse.com. Includes: - homebrew/clickhousectl.rb.tmpl: formula template with per-platform url/sha256 blocks (macOS/Linux x86_64/aarch64), chctl symlink, --version test - scripts/update-homebrew-formula.sh: release-time script that downloads GitHub release archives, computes SHA256, renders the template, and pushes to ClickHouse/homebrew-tap via SSH deploy key - .github/workflows/release.yml: publish-homebrew job (release-publishing env) - .github/workflows/test-install.yml: CI job for Ruby syntax + shellcheck - README.md, AGENTS.md, bug_report.yml: docs/template updates
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
- Add HEAD check for each builds.clickhouse.com URL before publishing the formula. Fails fast with a clear message if the mirror hasn't propagated the release yet, instead of shipping 404 URLs. - Guard git commit with diff --cached --quiet so a re-run of the release job doesn't fail under set -e when the formula is already up to date.
| - name: Update Homebrew formula | ||
| env: | ||
| HOMEBREW_TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }} | ||
| run: ./scripts/update-homebrew-formula.sh "${{ steps.version.outputs.version }}" |
There was a problem hiding this comment.
Homebrew ignores Cargo tag alignment
Medium Severity
The new publish-homebrew job sets the formula version from the git tag and runs brew test-style checks against the binary, but release archives still come from the existing build job, which never realigns crates/clickhousectl/Cargo.toml to the tag. The build-wheels job already documents and fixes that mismatch for PyPI; Homebrew can publish a tap version that does not match --version from the shipped binary when the tag was pushed without a Cargo bump.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 84d0f9f. Configure here.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 9e8d2d6. Configure here.
| exit 1 | ||
| fi | ||
| echo " OK" | ||
| done |
There was a problem hiding this comment.
Mirror SHA256 never verified
Medium Severity
The update script records SHA256 from GitHub release downloads but only sends HTTP HEAD to builds.clickhouse.com before publishing the formula. Homebrew installs fetch those builds URLs and verify the embedded checksum. If mirror bytes differ from GitHub, the tap can ship with hashes that fail every install.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 9e8d2d6. Configure here.
1 participant
Closes #276.
Summary
Adds Homebrew tap support for clickhousectl using prebuilt binaries from
builds.clickhouse.com.homebrew/clickhousectl.rb.tmpl— formula template with per-platformurl/sha256blocks (macOS/Linux x86_64/aarch64),chctlsymlink,--versiontestscripts/update-homebrew-formula.sh— release-time script that downloads the 4 GitHub release archives, computes SHA256, renders the template, and pushes toClickHouse/homebrew-tapvia SSH deploy key.github/workflows/release.yml—publish-homebrewjob in therelease-publishingenvironment.github/workflows/test-install.yml— CI job for Ruby syntax check + shellcheckREADME.md,AGENTS.md,bug_report.yml— docs and template updatesSetup completed
ClickHouse/homebrew-taprepo created and populated withFormula/clickhousectl.rb(v0.3.1)ClickHouse/homebrew-tap(write access)HOMEBREW_TAP_DEPLOY_KEYsecret set inrelease-publishingenvironmentbrew install clickhouse/tap/clickhousectl→--version→brew testall passInstall