Skip to content

docs(d8): run homebrew-taps' updater one job per cask (S32) #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
edbfi merged 3 commits into from
Oct 12, 2026
Merged

docs(d8): run homebrew-taps' updater one job per cask (S32) #73

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2f83f77
docs(d8): run homebrew-taps' updater one job per cask (S32)
edbfi Oct 12, 2026
0158d55
docs(d8): scope rule 9's no-update to its cask
edbfi Oct 12, 2026
9ce8f7a
docs(state): set the freshness line at finalization (S32)
edbfi Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions STATE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Last updated: 1791816155 (2026-10-12T14:42:35Z)
Last updated: 1791839203 (2026-10-12T21:06:43Z)

# State

Expand Down Expand Up @@ -40,6 +40,7 @@ Take the first step whose status isn't `done` or `blocked`; a blocked step names
| S29 | open-item follow-ups | done | [comradarr#160](https://github.com/edbfi/comradarr/pull/160); [zimuarr#34](https://github.com/edbfi/zimuarr/pull/34); [EasyHDR#182](https://github.com/edbfi/EasyHDR/pull/182); [zondarr#301](https://github.com/edbfi/zondarr/pull/301); [poyo-studio#108](https://github.com/edbfi/poyo-studio/pull/108); [#68](https://github.com/edbfi/edbfi-ci/pull/68), [#69](https://github.com/edbfi/edbfi-ci/pull/69), [#70](https://github.com/edbfi/edbfi-ci/pull/70) |
| S30 | open-item follow-ups: dependabot-A2 closed, stale EasyHDR advisory ignores, Dependabot alerts on the out-of-scope repos | done | [EasyHDR#183](https://github.com/edbfi/EasyHDR/pull/183); [#71](https://github.com/edbfi/edbfi-ci/pull/71) |
| S31 | open-item follow-ups: homebrew-taps' admin-only deploy-key push verified with a probe cask; B7 and hotio/base#30 no longer tracked | done | [homebrew-taps#47](https://github.com/edbfi/homebrew-taps/pull/47), [homebrew-taps#48](https://github.com/edbfi/homebrew-taps/pull/48); [#72](https://github.com/edbfi/edbfi-ci/pull/72) |
| S32 | homebrew-taps' cask updater runs one job per cask on per-cask timeouts, verified with two probe casks | done | [homebrew-taps#49](https://github.com/edbfi/homebrew-taps/pull/49), [homebrew-taps#50](https://github.com/edbfi/homebrew-taps/pull/50), [homebrew-taps#51](https://github.com/edbfi/homebrew-taps/pull/51), [homebrew-taps#52](https://github.com/edbfi/homebrew-taps/pull/52); [#73](https://github.com/edbfi/edbfi-ci/pull/73) |

## Repos

Expand All @@ -65,7 +66,7 @@ Each repo's core rollout state is in the table below [V, 2026-10-09]; `—` mean
| printlab-project | Python | S11 | live; push CI verified | live | active | live; no Dependabot PR yet (nothing outdated) | — | — |
| EasyHDR | Native | S12, S18 | live; push CI verified (Windows tests, smoke, cargo-deny and the `fuzz/` check on the one workspace lockfile [V, 2026-10-12]); nightly audit, weekly Miri, release (verified end to end with a deleted test prerelease) and profiling workflows live | live | active | live; Dependabot merges observed ([#177](https://github.com/edbfi/EasyHDR/pull/177), [#178](https://github.com/edbfi/EasyHDR/pull/178)) | — | — |
| github-stats | Native | S12, S17 | live on `master`; push CI verified; daily stats generator live | live | active | live; Dependabot merge observed ([#32](https://github.com/edbfi/github-stats/pull/32)) | — | — |
| homebrew-taps | Native | S12, S19 | live; push CI verified (formulae on x86_64 and ARM64, macOS casks); cask updater live | live | active (admin role only; the deploy key passes it, D16) | live; Dependabot merge observed ([#41](https://github.com/edbfi/homebrew-taps/pull/41)) | — | — |
| homebrew-taps | Native | S12, S19, S32 | live; push CI verified (formulae on x86_64 and ARM64, macOS casks); cask updater live, one job per cask [V, 2026-10-12] | live | active (admin role only; the deploy key passes it, D16) | live; Dependabot merge observed ([#41](https://github.com/edbfi/homebrew-taps/pull/41)) | — | — |
| pelican-eggs | Shell | S13 | live; push CI verified | live | active | live; Dependabot merge observed ([#37](https://github.com/edbfi/pelican-eggs/pull/37)) | — | — |
| mover-status | Shell | S13 | live; push CI verified | live | active | live; Dependabot merge observed ([#60](https://github.com/edbfi/mover-status/pull/60)) | — | — |
| comradarr | Content | S13 | live; push CI verified | live | active | live; Dependabot merge observed ([#159](https://github.com/edbfi/comradarr/pull/159)) | — | — |
Expand Down
7 changes: 4 additions & 3 deletions design/d8.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,11 @@

### homebrew-taps updater

8. It MUST run every six hours, serialised, committing updates straight to main without PRs and without force-pushes, pushing with the repo's deploy key (rule 12, D16).
9. Job 1 (unprivileged, macOS) MUST fetch the app, compute the checksum, generate and validate the recipe, and output only the version and checksum. For qBittorrent, a valid latest stable release without `qbittorrent-X.Y.Z.dmg` (the `_lt20` DMG doesn't count) MUST end the run as a logged no-update with jobs 2-4 skipped; malformed metadata, duplicate matches and lookup errors MUST fail.
8. It MUST run every six hours, serialised, committing updates straight to main without PRs and without force-pushes, pushing with the repo's deploy key (rule 12, D16). Jobs 1-4 MUST each run one cask per job, on that cask's own timeout, so no timeout depends on the number of casks and a failing cask stops no other.
9. Job 1 (unprivileged, macOS) MUST fetch the app, compute the checksum, generate and validate the recipe, and output only the version and checksum. For qBittorrent, a valid latest stable release without `qbittorrent-X.Y.Z.dmg` (the `_lt20` DMG doesn't count) MUST end that cask's update as a logged no-update with its jobs 2-4 skipped; malformed metadata, duplicate matches and lookup errors MUST fail.
10. Job 2 (privileged) MUST run the repo's own discovery script from main, require job 1's version to equal the latest and be newer than the cask's current one (`sort -V`), fetch the app itself, require the checksum to match, and publish the release from its own copy.
11. Job 3 (unprivileged) MUST run the checks that need the published download.
12. Job 4 (privileged) MUST rewrite only the cask's `version` and `sha256`, and push as a plain fast-forward over SSH with the deploy key: a mode-600 temp key, `IdentitiesOnly=yes`, and `known_hosts` built from GitHub's published host keys, never `StrictHostKeyChecking=no`.
12. Job 4 (privileged) MUST run one cask at a time, rewrite only the cask's `version` and `sha256`, and push as a plain fast-forward over SSH with the deploy key: a mode-600 temp key, `IdentitiesOnly=yes`, and `known_hosts` built from GitHub's published host keys, never `StrictHostKeyChecking=no`.
13. A retry after a failed run MUST finish what that run left undone: the release, or the recipe push after it. A retry is a new run: a re-run would reuse an attempt's artifacts, so the privileged jobs refuse it.
14. Linux formulae (D13): changed formulae MUST be built and tested natively on x86_64 and ARM64, feeding `ci-ok`.
15. homebrew-taps MUST publish Linux bottles only for the formulae in `pipelines/bottles.json`; publication is deferred ([homebrew-taps#44](https://github.com/edbfi/homebrew-taps/issues/44)).
Expand All @@ -47,6 +47,7 @@
- A homebrew-taps deploy-key push to main is accepted by the ruleset and starts `push` CI ([settings.md](settings.md#parameters)).
- In homebrew-taps' `update-casks.yml`, `privileged-jobs` passes and the `publish` and `push` jobs have no `uses:` lines. The hook covers only `push`: `publish` holds `contents: write` but no secret and has no PR trigger, so [security.md](security.md#contract) rule 1 doesn't count it as privileged.
- homebrew-taps: a new run after a failed recipe push publishes nothing twice and pushes the recipe [V, 2026-10-09, playground].
- homebrew-taps with eight casks and unchanged timeouts: two casks updating in one run publish in parallel and push one after the other, each a deploy-key fast-forward logged as `bypass` with push CI passing; a failing publish stops only its own cask, and a run without updates skips jobs 2-4 [V, 2026-10-12, homebrew-taps probe casks, runs 38306466691, 38306834966 and 38306986072].
- poyo-studio: removing one media tool fails the macOS job.

## Open
Expand Down
Loading