Homebrew 7 - #25
Merged
Merged
Homebrew 7#25
Conversation
Homebrew 7 deprecated Ruby `postflight` blocks in casks and warns on
every brew run that loads the tap. Replace the block with the
declarative `postflight_steps` DSL (available since Homebrew 5.1.14).
The steps run in Homebrew's sandbox with a throwaway HOME, so file
steps use `base: :home` instead of "~", and the plist render becomes
`copy` + `inreplace` with the `{{appdir}}` token. `run` args have no
home token, so launchctl paths are spelled /Users/{{user}}. On a
relocated home the plist is still written correctly and only the
immediate best-effort `launchctl load` no-ops; the agent then starts
at next login.
Verified with `brew style` and `brew audit --strict` via
toolkit/homebrew/verify-tap.sh --offline. The install smoke test still
needs an interactive terminal: the cask's `uninstall delete:` stanza
always invokes sudo.
Resolves Dependabot alerts 16 (GHSA-r28c-9q8g-f849) and 19 (GHSA-fxqj-rqcc-2cmp). postcss is transitive via vite; lockfile-only refresh, also lifts nanoid to 3.3.19.
Resolves Dependabot alert 21 (GHSA-9rgm-9g3h-6x36). devalue is transitive via svelte; lockfile-only refresh.
Supersedes Dependabot PR 22. v7 is an ESM migration with no input changes; we only pass node-version.
Supersedes Dependabot PR 24. SHA verified against the v3.0.3 tag.
Supersedes Dependabot PR 23, which rewrote the floating @v2 tag to a patch pin that would be reopened weekly. Major bumps still get a PR.
Reviewer's GuideMigrates the Homebrew cask to declarative, real-home-aware postflight steps, bumps all product metadata and workspace versions to 3.1.1, and incorporates security, CI, release-action, and Dependabot maintenance updates. Sequence diagram for Homebrew cask postflight installationsequenceDiagram
participant Homebrew
participant Filesystem
participant Launchctl
participant Pluginkit
Homebrew->>Filesystem: if_path_exists Library/LaunchAgents/com.zaai.git-same.daemon.plist base: :home
opt legacy plist exists
Homebrew->>Launchctl: run /bin/launchctl unload /Users/{{user}}/Library/LaunchAgents/com.zaai.git-same.daemon.plist
Homebrew->>Filesystem: remove legacy plist base: :home
end
Homebrew->>Filesystem: copy monitor plist source_base: :appdir target_base: :home
Homebrew->>Filesystem: inreplace monitor binary with {{appdir}} path base: :home
Homebrew->>Launchctl: run /bin/launchctl unload monitor plist
Homebrew->>Launchctl: run /bin/launchctl load monitor plist
Homebrew->>Pluginkit: run /usr/bin/pluginkit ignore stale FinderSync id
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (9)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. WalkthroughThe pull request prepares version 3.1.1, updates GitHub Actions and Dependabot configuration, and converts Homebrew cask postflight logic to sandbox-safe declarative steps. ChangesRelease and packaging maintenance
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~15 minutes Change: Other 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the release trail, Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. The cask now writes and loads a persistent LaunchAgent and changes FinderSync registration, so a wrong path or rendered plist could leave a user with a broken or stale background service after the PR is reverted. The damage is bounded and repairable by removing or reinstalling the LaunchAgent, unlike a payment, deletion, or access-control change.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Create ~/Library/LaunchAgents before copying the monitor plist.
Review effort: Lite
Findings: None
What changed in this PR
Migrates the Homebrew cask lifecycle, prepares the 3.1.1 release, and refreshes dependencies and CI actions.
Changes:
- Replaces cask
postflightlogic with sandbox-safepostflight_steps. - Synchronizes project and package versions to 3.1.1.
- Updates dependencies, GitHub Actions, and Dependabot configuration.
| File | Reviewed change |
|---|---|
toolkit/homebrew/cask.rb.tmpl |
Declarative sandbox-safe postflight operations |
macos/GitSameBadges/Info.plist |
Finder extension version bump |
crates/git-same-cli/Cargo.toml |
Core dependency version bump |
crates/git-same-app/ui/pnpm-lock.yaml |
Frontend dependency refresh |
crates/git-same-app/ui/package.json |
UI version bump |
crates/git-same-app/tauri.conf.json |
Tauri version bump |
Cargo.toml |
Workspace version bump |
Cargo.lock |
Locked package version updates |
.github/workflows/S2-Release-GitHub.yml |
Release action updates |
.github/workflows/S1-Test-CI.yml |
CI Node setup update |
.github/dependabot.yml |
Install-action update policy |
Files not reviewed (1)
- crates/git-same-app/ui/pnpm-lock.yaml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
manuelgruber
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rewrites the Homebrew cask's Ruby
postflightblock as declarativepostflight_steps, which clears the cask audit warning and survives the steps sandbox's throwawayHOMEby addressing files throughbase: :home/{{appdir}}and spellinglaunchctlpaths as/Users/{{user}}(alllaunchctlandpluginkitcalls stay best-effort, since the agent also loads at next login).Bumps the workspace to 3.1.1 across
Cargo.toml,crates/git-same-cli/Cargo.toml,tauri.conf.json,ui/package.json, andmacos/GitSameBadges/Info.plist.Picks up security-driven dependency bumps (postcss 8.5.28, devalue 5.9.2, actions/setup-node v7, action-gh-release 3.0.3) and adds a Dependabot ignore rule so minor/patch releases of
taiki-e/install-actionstop reopening the same PR every week, while major bumps still get one.Summary by Sourcery
Prepare the 3.1.1 release with a sandbox-safe Homebrew cask migration and refreshed dependencies and automation.
Enhancements:
Build:
CI:
Chores:
Summary by cubic
Migrates the Homebrew cask from the Ruby
postflightblock to declarativepostflight_steps, sobrewno longer warns on every tap load and the steps keep working under the sandbox's throwaway HOME. Also bumps the workspace to 3.1.1 and updates dependencies flagged by Dependabot.Bug Fixes
postflight_stepswrites the monitor plist viabase: :homeand{{appdir}}instead ofDir.home, and spellslaunchctlpaths as/Users/{{user}}.launchctlandpluginkitcalls remain best-effort, so the agent still loads at next login if immediate load fails.Dependencies
postcssto 8.5.28,devalueto 5.9.2,actions/setup-nodeto v7, andaction-gh-releaseto 3.0.3 for security and compatibility fixes.taiki-e/install-actionso its floating@v2reference stops generating weekly PRs; major bumps still get one.Written for commit 25f6789. Summary will update on new commits.
Summary by CodeRabbit
Release
Bug Fixes