Skip to content

feat(ci): add automatic Homebrew tap publishing#23

Merged
platinummonkey merged 4 commits into
mainfrom
feat/add-homebrew-tap-publishing
Feb 11, 2026
Merged

feat(ci): add automatic Homebrew tap publishing#23
platinummonkey merged 4 commits into
mainfrom
feat/add-homebrew-tap-publishing

Conversation

@platinummonkey
Copy link
Copy Markdown
Collaborator

Summary

Configures automatic Homebrew formula publishing to DataDog/homebrew-pack when releases are tagged. Users will be able to install pup via brew install datadog/pack/pup for easier distribution and automatic updates.

Changes

  • .goreleaser.yml: Added brews configuration for homebrew-pack tap with formula metadata, install instructions, and test commands
  • .github/workflows/release.yml: Added HOMEBREW_TAP_TOKEN environment variable to GoReleaser step
  • README.md: Updated installation section to feature Homebrew as primary method
  • CLAUDE.md: Updated Quick Start with Homebrew installation instructions
  • docs/HOMEBREW_TAP_SETUP.md: New comprehensive setup guide with prerequisites, PAT creation, testing procedures, and troubleshooting

Manual Steps Required

Before this can work in production, the following manual setup is needed:

1. Create Fine-grained Personal Access Token

2. Add GitHub Secret

3. Verify homebrew-pack Repository

Testing Plan

The setup guide includes instructions for testing with a pre-release:

# Create test release
git tag -a v0.9.0-beta.1 -m "Test Homebrew tap"
git push origin v0.9.0-beta.1

# Verify formula was published
# Check: https://github.com/DataDog/homebrew-pack/blob/main/Formula/pup.rb

# Test installation
brew tap datadog/pack
brew install pup
pup version

Documentation

See docs/HOMEBREW_TAP_SETUP.md for:

  • Complete step-by-step setup instructions
  • Testing procedures
  • Troubleshooting common errors
  • Security best practices
  • Token maintenance guidelines

References


🤖 Generated with Claude Code

Configure GoReleaser and GitHub Actions to automatically publish formula
updates to DataDog/homebrew-pack on releases. This enables users to install
via `brew install datadog/pack/pup` for easier distribution and updates.

Changes:
- .goreleaser.yml: Add brews configuration for homebrew-pack tap
- .github/workflows/release.yml: Add HOMEBREW_TAP_TOKEN to env
- README.md: Add Homebrew as primary installation method
- CLAUDE.md: Update Quick Start with Homebrew instructions
- docs/HOMEBREW_TAP_SETUP.md: Comprehensive setup guide with:
  - Prerequisites and repository requirements
  - Step-by-step PAT creation instructions
  - GitHub secret configuration
  - Testing procedure with pre-releases
  - Troubleshooting common issues
  - Security best practices

Manual steps required:
1. Create fine-grained PAT with Contents: Read and Write on homebrew-pack
2. Add PAT as HOMEBREW_TAP_TOKEN secret to pup repository
3. Ensure homebrew-pack repository exists and is public

See docs/HOMEBREW_TAP_SETUP.md for complete instructions.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@platinummonkey platinummonkey requested a review from a team as a code owner February 10, 2026 17:41
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Feb 10, 2026

📊 Test Coverage Report

Overall Coverage: 80.4% Coverage

Threshold: 80% ✅

Coverage by Package
## Coverage by Package

- github.com/DataDog/pup/pkg/auth/callback/server.go:40: 81.2%
- github.com/DataDog/pup/pkg/auth/dcr/client.go:28: 100.0%
- github.com/DataDog/pup/pkg/auth/dcr/types.go:24: 100.0%
- github.com/DataDog/pup/pkg/auth/oauth/client.go:22: 100.0%
- github.com/DataDog/pup/pkg/auth/oauth/pkce.go:24: 85.7%
- github.com/DataDog/pup/pkg/auth/storage/factory.go:53: 94.7%
- github.com/DataDog/pup/pkg/auth/storage/keychain.go:44: 42.9%
- github.com/DataDog/pup/pkg/auth/storage/storage.go:58: 71.4%
- github.com/DataDog/pup/pkg/auth/types/types.go:23: 100.0%
- github.com/DataDog/pup/pkg/client/client.go:32: 94.4%
- github.com/DataDog/pup/pkg/config/config.go:22: 100.0%
- github.com/DataDog/pup/pkg/formatter/formatter.go:31: 100.0%
- github.com/DataDog/pup/pkg/useragent/useragent.go:32: 100.0%
- github.com/DataDog/pup/pkg/util/time.go:20: 95.8%

## Summary

total:								(statements)		80.4%

📈 Coverage Status: ✅ PASSED - Coverage meets minimum threshold

Updated for commit c5a1ff0

platinummonkey and others added 3 commits February 10, 2026 12:03
Replace long-lived Personal Access Token with dd-octo-sts for more secure,
short-lived token access to homebrew-pack repository. This eliminates the
need for secret storage and manual token rotation.

Security improvements:
- Short-lived tokens (1 hour expiration, auto-revoked)
- No credential storage required (OIDC federation)
- Scoped to specific workflow and semantic version tags
- Defense-in-depth with claim pattern validation

Changes:
- .github/workflows/release.yml: Add dd-octo-sts-action step to get token
- docs/HOMEBREW_TAP_SETUP.md: Complete rewrite for dd-octo-sts approach
- docs/homebrew-pack-trust-policy.yaml: Trust policy template for homebrew-pack

Setup required:
1. Add trust policy to DataDog/homebrew-pack at .github/chainguard/pup-release.sts.yaml
2. Merge policy to default branch (no GitHub secrets needed!)

See docs/HOMEBREW_TAP_SETUP.md for complete setup instructions.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Complete rewrite of HOMEBREW_TAP_SETUP.md to use dd-octo-sts instead of PATs:

- Replaced PAT-based authentication with dd-octo-sts OIDC federation
- Added comprehensive tag protection setup instructions (Step 3)
- Included troubleshooting for tag protection scenarios
- Added security best practices for release management
- Documented both tag rulesets and protected environments approaches
- Updated comparison table showing dd-octo-sts advantages

Tag protection (recommended but optional):
- Prevents unauthorized release creation
- Aligns with dd-octo-sts security guardrails
- Ensures privileged permissions only on protected refs

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@platinummonkey
Copy link
Copy Markdown
Collaborator Author

depends on datadog-labs/homebrew-pack#3

@platinummonkey platinummonkey merged commit 8ad650e into main Feb 11, 2026
4 checks passed
@platinummonkey platinummonkey deleted the feat/add-homebrew-tap-publishing branch February 11, 2026 11:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant