From 2c3a64de4a35a3783fbfd6064bc201bf64ba1aed Mon Sep 17 00:00:00 2001 From: Thomas Thomsen Date: Fri, 30 Oct 2026 10:29:56 +0900 Subject: [PATCH 1/2] ci(release): dispatch publish-claude-plugin after each release Releases are created with GITHUB_TOKEN, so publish-claude-plugin's release: published trigger has not fired since v0.53.1. Dispatch it from release.yml, which GitHub allows for GITHUB_TOKEN. --- .github/workflows/publish-claude-plugin.yml | 5 +++++ .github/workflows/release.yml | 19 +++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/.github/workflows/publish-claude-plugin.yml b/.github/workflows/publish-claude-plugin.yml index 4d54bb9b4..b76ef5479 100644 --- a/.github/workflows/publish-claude-plugin.yml +++ b/.github/workflows/publish-claude-plugin.yml @@ -1,6 +1,11 @@ # publish-claude-plugin syncs the generated marketplace bundle from # this repo to gortexhq/claude-plugin on every gortex release. # +# release.yml dispatches it after each release: releases are created +# with GITHUB_TOKEN, which does not fire the `release: published` +# trigger below. That trigger only covers releases published without +# GITHUB_TOKEN, such as by hand. +# # How it works: # 1. Checkout gortex at the released tag # 2. Regenerate the bundle via `make claude-plugin` diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9ccefd070..a2051de8d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -786,3 +786,22 @@ jobs: ./dist/*.rpm ./dist/*.apk update_release_body: true + + # Releases are created with GITHUB_TOKEN, and events from GITHUB_TOKEN + # do not start other workflows, so publish-claude-plugin's + # `release: published` trigger never fires for them. workflow_dispatch + # is the documented exception, so start it explicitly once the + # release exists. + publish-claude-plugin: + needs: release + runs-on: ubuntu-latest + permissions: + actions: write + steps: + - name: Dispatch publish-claude-plugin + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh workflow run publish-claude-plugin.yml \ + --repo "$GITHUB_REPOSITORY" \ + -f ref="$GITHUB_REF_NAME" From c3ca183df689b14b04117121f1c48d10df6ddb4c Mon Sep 17 00:00:00 2001 From: Thomas Thomsen Date: Fri, 30 Oct 2026 11:49:07 +0900 Subject: [PATCH 2/2] ci(cask): trust the scratch tap before loading the cask Current Homebrew refuses to load casks from an untrusted tap, and brew info does not trust one on the way like brew install does, so the cask check now fails on every run. Trust the scratch tap in a throwaway trust store so the developer's own one is left alone. --- scripts/validate-cask.sh | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/scripts/validate-cask.sh b/scripts/validate-cask.sh index 25fafef92..da5d68527 100755 --- a/scripts/validate-cask.sh +++ b/scripts/validate-cask.sh @@ -41,13 +41,32 @@ rendered="$("$repo_root/scripts/render-cask.sh" 0.0.0 \ # untouched, and the trap removes it even when brew fails. tap_user="gortexcaskcheck" tap_dir="$(brew --repository)/Library/Taps/$tap_user/homebrew-tap" -cleanup() { rm -rf "$(brew --repository)/Library/Taps/$tap_user"; } +trust_home="" +cleanup() { + rm -rf "$(brew --repository)/Library/Taps/$tap_user" + if [ -n "$trust_home" ]; then rm -rf "$trust_home"; fi +} trap cleanup EXIT cleanup mkdir -p "$tap_dir/Casks" printf '%s\n' "$rendered" >"$tap_dir/Casks/gortex.rb" +# Current Homebrew refuses to load casks from a tap nobody has trusted, and +# `brew info` does not trust it on the way like `brew install user/tap/x` +# does. Trust the scratch tap in a throwaway trust store (brew keeps it under +# $XDG_CONFIG_HOME/homebrew when that is set), so the developer's own trust +# store and brew.env are neither read nor changed. HOMEBREW_NO_REQUIRE_TAP_TRUST +# is deprecated, and its warning would trip the check below, so it is unset +# too in case a developer exported it to get past this same error. Older brew +# has no `trust` command and needs none. +trust_home="$(mktemp -d)" +export XDG_CONFIG_HOME="$trust_home" +unset HOMEBREW_NO_REQUIRE_TAP_TRUST HOMEBREW_REQUIRE_TAP_TRUST +if brew trust --help >/dev/null 2>&1; then + brew trust --tap "$tap_user/tap" +fi + echo "==> loading the rendered cask through brew" # `brew info --cask` evaluates every stanza, so an unknown one (the #639 bug) # fails here. Output is kept: a reviewer should see the artifact list change