This repository was archived by the owner on May 21, 2026. It is now read-only.
Add formula template, renderer, and release workflows#1
Merged
Conversation
The release pipeline in stackhawk/hawkop does not publish .sha256 sidecar files alongside the tarballs — mirroring the hawkscan pattern of hashing the artifact locally. Update the renderer to download each tarball and compute SHA256 with shasum/sha256sum instead of fetching a sidecar. Also: - Drop the explicit `version` field from the formula template. Homebrew derives version from `hawkop-v<ver>-<target>.tar.gz` and flags the explicit field as redundant under `brew audit --strict`. - Update the PR test workflow to symlink the checkout into the Taps dir and invoke `brew audit` / `brew install` / `brew test` by the tap- qualified name `stackhawk/hawkop/hawkop`. Current Homebrew (5.1+) disabled path-based audit. - Remove the renderer's optional local brew-audit hook for the same reason; developers should tap the checkout and run audit manually. - Update the probe step to extract the version from the URL pattern. Verified end-to-end locally against v0.6.1: render, audit (clean), install, and `brew test` all pass; `hawkop --version` reports 0.6.1.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the tap from empty to release-ready.
brew install hawkopwill workas soon as the first release of
stackhawk/hawkoppublishes binaries todownload.stackhawk.com/hawkop/cli/.scripts/formula-template.rb) — Homebrew formula shapeusing modern
on_macos/on_linux+on_intel/on_armDSL. Four Unixtargets (mac x64/arm, linux x64/arm). Windows/MSI out of scope.
scripts/update-formula.sh) — POSIX shell. Validates semver,HEADs each tarball on
download.stackhawk.com, fetches.sha256sidecars,substitutes placeholders via
sed, writesFormula/hawkop.rb. Supports--dry-runand--offline. Runsbrew audit --strict --onlinelocallyif brew is on PATH.
.github/workflows/update-formula.yml) — triggeredby
workflow_dispatch(manual) orrepository_dispatch(from upstreamstackhawk/hawkop). Concurrency-guarded,contents: writescoped,injection-safe (all expression expansions routed through
env:)..github/workflows/test.yml) — PR + push. Matrix onmacOS + Ubuntu. Skips cleanly before the first release. Once binaries
are live, probes the tarball URL and runs
brew install+brew testwhen HTTP 200.
contents: readscoped. Separate lint-scripts job runsshellcheck + bats.
Error: No available formulastate.Formula/.gitkeepremoved (the release workflow creates the directoryon first run).
Release flow
Or, later,
stackhawk/hawkop's release pipeline can send arepository_dispatchof typehawkop-releasewith{"version": "X.Y.Z"}.Test plan
shellcheck scripts/update-formula.sh— cleanbats scripts/test-update-formula.bats— 9/9 passruby -ryaml -e 'YAML.load_file(...)')scripts/update-formula.sh --version 0.6.2 --offlinewrites a syntacticallyvalid
Formula/hawkop.rb(ruby -cOK)Test formulaworkflow on a throw-away PR to confirmgreen CI in the pre-release state (audit/install should skip cleanly)
stackhawk/hawkoprelease publishes binaries, rungh workflow run update-formula.yml -f version=X.Y.Zand verify thecommit lands on
mainandbrew installworks end-to-endKnown follow-ups
repository_dispatchcall fromstackhawk/hawkop's gradlereleaseBrewFormulatask (currently a TODO stub). Until then the flowis manual-only.
livecheckblock deferred —stackhawk/hawkopis private (no:github_releasesvisibility) anddownload.stackhawk.com/hawkop/manifest.json404s today. Add when a public manifest exists.