Skip to content

Add four-platform Homebrew install acceptance for Formula PRs - #22

Merged
springwq merged 1 commit into
mainfrom
codex/formula-acceptance
Aug 22, 2026
Merged

Add four-platform Homebrew install acceptance for Formula PRs#22
springwq merged 1 commit into
mainfrom
codex/formula-acceptance

Conversation

@springwq

Copy link
Copy Markdown
Collaborator

Implements Phase 9 of the release plan (the remaining gap): real install/upgrade/uninstall acceptance for Homebrew.

Changes

  • New `script/accept-homebrew-formula`: installs the previous Formula from `origin/main` (skipped on the first release), upgrades to the PR Formula, then verifies version match, `brew test`, `command -v fm` resolution, uninstall behavior, and credential persistence across upgrade/uninstall/reinstall.
  • New `formula-acceptance` matrix job in ci.yml (macos-15, macos-15-intel, ubuntu-24.04, ubuntu-24.04-arm), gated on `release/fm-*` PR branches — exactly the PRs the release workflow opens, where the assets are already published.
  • Security: credentials are exercised against a loopback fake Pixel API with a sentinel token; macOS uses a throwaway keychain (default keychain + search list captured and restored in `ensure`), Linux an isolated HOME. No real keychain, no real tokens.

Verified locally (macos-arm64, real 0.1.1 assets)

```
ok: previous version 0.1.1 installed
ok: credential stored
ok: fm reports 0.1.1
ok: brew test passed
ok: command -v fm resolves into the Homebrew prefix
ok: command -v fm empty after uninstall
ok: credential survives uninstall
ok: credential survives reinstall
ok: logout removes the credential
ok: final uninstall leaves no fm
```

Two real-world findings folded into the script: the Security framework locates the default keychain via `HOME` (so HOME must stay real on macOS), and `security list-keychains -s` must be restored or subsequent lookups fail.

Phase 9 of the release plan: release/fm-* PRs now run a native-runner
matrix that installs the previous Formula from main, upgrades to the PR
Formula, runs brew test, uninstalls, and verifies credentials survive
upgrade and uninstall. Credentials are exercised against a loopback
fake API with a sentinel token, on macOS inside a throwaway keychain
(the default keychain and search list are restored afterwards) and on
Linux in an isolated HOME.

Verified end-to-end locally on macos-arm64 against the real 0.1.1
release assets.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@springwq
springwq merged commit 6448922 into main Aug 22, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant