From 70d56f721e66d1abab23f9a801b50d1fa1b7c5bc Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Fri, 2 Jan 2026 22:12:05 +0000
Subject: [PATCH 01/31] ci: release

---
 .github/workflows/release.yaml | 15 ++++++++++
 Earthfile                      | 24 +++++++++++++++
 Formula/earth.rb               | 53 +++++++++++++++++++++-------------
 3 files changed, 72 insertions(+), 20 deletions(-)
 create mode 100644 .github/workflows/release.yaml
 create mode 100644 Earthfile

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..3230417
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,15 @@
+name: Release
+
+on:
+  push:
+
+jobs:
+  check:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: earthbuild/actions-setup@main
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check
+        run: earthly --ci +check
diff --git a/Earthfile b/Earthfile
new file mode 100644
index 0000000..d00d03e
--- /dev/null
+++ b/Earthfile
@@ -0,0 +1,24 @@
+VERSION 0.8
+FROM homebrew/brew:4.6.20
+ENV HOMEBREW_NO_AUTO_UPDATE=1
+WORKDIR /home/linuxbrew/earthbuild-tap
+RUN brew developer on
+
+src:
+    COPY --dir .git Formula .
+    RUN brew tap EarthBuild/tap .
+
+# lint verify the formula for code quality
+lint:
+    BUILD +audit
+    BUILD +style
+
+# audit the formula
+audit:
+    FROM +src
+    RUN brew audit --new --signing --debug --audit-debug EarthBuild/tap/earth
+
+# style check the formula
+style:
+    FROM +src
+    RUN brew style --verbose --debug EarthBuild/tap/earth
diff --git a/Formula/earth.rb b/Formula/earth.rb
index 390d62d..010f7d0 100644
--- a/Formula/earth.rb
+++ b/Formula/earth.rb
@@ -1,44 +1,57 @@
 class Earth < Formula
-  desc "Build automation tool for the container era"
-  homepage "https://github.com/earthbuild"
-  url "https://github.com/EarthBuild/earthbuild.git",
-    tag: "v0.8.17",
-      revision: "52f2da6dd7f3de24a60a76e00044ec560b0ea407"
-  license "MPL-2.0"
-  head "https://github.com/EarthBuild/earthbuild.git", branch: "main"
+  desc 'Build automation tool for the container era'
+  homepage 'https://github.com/earthbuild'
+  url 'https://github.com/EarthBuild/earthbuild.git',
+      tag: 'v0.8.17-rc-0',
+      revision: '52f2da6dd7f3de24a60a76e00044ec560b0ea407'
+  license 'MPL-2.0'
+  head 'https://github.com/EarthBuild/earthbuild.git', branch: 'main'
 
   bottle do
-    sha256 cellar: :any_skip_relocation, arm64_tahoe: "194e4b767c3d1a551453ceb3739345c84de89533768b352e3b339d116497a238"
+    sha256 cellar: :any_skip_relocation,
+           arm64_tahoe: '194e4b767c3d1a551453ceb3739345c84de89533768b352e3b339d116497a238'
+    sha256 cellar: :any_skip_relocation,
+           arm64_linux: 'f7f743e111f7791301299c304b27fa1d4eda0a48b150c6270374fb360ee29b5b'
+    sha256 cellar: :any_skip_relocation,
+           x86_64_linux: '8eba8b430051d74be92b403116c7e510225bcc3a94fb8fec7f836f2959dd4227'
   end
 
-  depends_on "go" => :build
+  depends_on 'go' => :build
 
   def install
-    ENV["CGO_ENABLED"] = "0"
+    ENV['CGO_ENABLED'] = '0'
     ldflags = %W[
       -s -w
-      -X main.DefaultBuildkitdImage=docker.io/earthly/buildkitd:v0.8.16
+      -X main.DefaultBuildkitdImage=docker.io/earthbuild/buildkitd:v0.8.17-rc-0
       -X main.Version=v#{version}
       -X main.GitSha=#{Utils.git_head}
       -X main.BuiltBy=homebrew-earthbuild
     ]
-    tags = "dfrunmount dfrunsecurity dfsecrets dfssh dfrunnetwork dfheredoc forceposix"
-    system "go", "build", "-tags", tags, *std_go_args(ldflags: ldflags, output: bin/"earth"), "./cmd/earthly"
+    tags = 'dfrunmount dfrunsecurity dfsecrets dfssh dfrunnetwork dfheredoc forceposix'
+    system 'go', 'build', '-tags', tags, *std_go_args(ldflags: ldflags, output: bin / 'earth'), './cmd/earthly'
 
-    bin.install_symlink "earth" => "earthly"
+    bin.install_symlink 'earth' => 'earthly'
 
-    generate_completions_from_executable(bin/"earth", "bootstrap", "--source", shells: [:bash, :zsh])
+    generate_completions_from_executable(bin / 'earth', 'bootstrap', '--source', shells: %i[bash zsh])
+  end
+
+  def caveats
+    <<~EOS
+      EarthBuild requires a container runtime to function.
+      If you don't have one, you can install Docker or Podman:
+        brew install --cask docker
+        OR
+        brew install podman
+    EOS
   end
 
   test do
-    # earthbuild requires docker to run; therefore doing a complete end-to-end test here is not
-    # possible; however the "earthbuild ls" command is able to run without docker.
-    (testpath/"Earthfile").write <<~EOS
+    (testpath / 'Earthfile').write <<~EOS
       VERSION 0.8
       mytesttarget:
       \tRUN echo Homebrew
     EOS
-    output = shell_output("#{bin}/earthly ls")
-    assert_match "+mytesttarget", output
+    output = shell_output("#{bin}/earth ls")
+    assert_match '+mytesttarget', output
   end
 end

From b76f9f961a8bad958756f8218eb45a039c9bc409 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Fri, 2 Jan 2026 22:16:45 +0000
Subject: [PATCH 02/31] ci: add permissions

---
 .github/workflows/release.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3230417..7786089 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -3,6 +3,9 @@ name: Release
 on:
   push:
 
+permissions:
+  contents: write
+
 jobs:
   check:
     runs-on: ubuntu-24.04-arm

From da768028da13d771497c30ebd168fa930fc3b66f Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Fri, 2 Jan 2026 22:47:07 +0000
Subject: [PATCH 03/31] chore: lint

---
 .github/workflows/release.yaml | 4 ++--
 Earthfile                      | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 7786089..811b922 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,5 +14,5 @@ jobs:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Check
-        run: earthly --ci +check
+      - name: Lint
+        run: earthly --ci +lint
diff --git a/Earthfile b/Earthfile
index d00d03e..330a16e 100644
--- a/Earthfile
+++ b/Earthfile
@@ -13,12 +13,12 @@ lint:
     BUILD +audit
     BUILD +style
 
-# audit the formula
+# audit checks for Homebrew coding style violations
 audit:
     FROM +src
     RUN brew audit --new --signing --debug --audit-debug EarthBuild/tap/earth
 
-# style check the formula
+# style checks for conformance to Homebrew style guidelines
 style:
     FROM +src
     RUN brew style --verbose --debug EarthBuild/tap/earth

From 0a382082c6bdc18d446511a1d30bf2928f62f19b Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Fri, 2 Jan 2026 23:37:15 +0000
Subject: [PATCH 04/31] chore: tidy

---
 .env             |  1 +
 Earthfile        |  9 ++++++++-
 Formula/earth.rb | 41 +++++++++++++++++++----------------------
 3 files changed, 28 insertions(+), 23 deletions(-)
 create mode 100644 .env

diff --git a/.env b/.env
new file mode 100644
index 0000000..4bd5d72
--- /dev/null
+++ b/.env
@@ -0,0 +1 @@
+EARTHLY_INSTALLATION_NAME=earthbuild-tap
\ No newline at end of file
diff --git a/Earthfile b/Earthfile
index 330a16e..4367ca1 100644
--- a/Earthfile
+++ b/Earthfile
@@ -5,7 +5,14 @@ WORKDIR /home/linuxbrew/earthbuild-tap
 RUN brew developer on
 
 src:
-    COPY --dir .git Formula .
+    COPY --dir Formula .
+    RUN \
+        git config --global init.defaultBranch main && \
+        git init && \
+        git config user.email "local@local" && \
+        git config user.name "local" && \
+        git add . && \
+        git commit -m "local snapshot"
     RUN brew tap EarthBuild/tap .
 
 # lint verify the formula for code quality
diff --git a/Formula/earth.rb b/Formula/earth.rb
index 31e48a6..e881769 100644
--- a/Formula/earth.rb
+++ b/Formula/earth.rb
@@ -1,25 +1,22 @@
 class Earth < Formula
-  desc 'Build automation tool for the container era'
-  homepage 'https://github.com/earthbuild'
-  url 'https://github.com/EarthBuild/earthbuild.git',
-      tag: 'v0.8.17-rc-0',
-      revision: '52f2da6dd7f3de24a60a76e00044ec560b0ea407'
-  license 'MPL-2.0'
-  head 'https://github.com/EarthBuild/earthbuild.git', branch: 'main'
+  desc "Build automation tool for the container era"
+  homepage "https://github.com/earthbuild"
+  url "https://github.com/EarthBuild/earthbuild.git",
+      tag:      "v0.8.17-rc-0",
+      revision: "52f2da6dd7f3de24a60a76e00044ec560b0ea407"
+  license "MPL-2.0"
+  head "https://github.com/EarthBuild/earthbuild.git", branch: "main"
 
   bottle do
-    sha256 cellar: :any_skip_relocation,
-           arm64_tahoe: '194e4b767c3d1a551453ceb3739345c84de89533768b352e3b339d116497a238'
-    sha256 cellar: :any_skip_relocation,
-           arm64_linux: 'f7f743e111f7791301299c304b27fa1d4eda0a48b150c6270374fb360ee29b5b'
-    sha256 cellar: :any_skip_relocation,
-           x86_64_linux: '8eba8b430051d74be92b403116c7e510225bcc3a94fb8fec7f836f2959dd4227'
+    sha256 cellar: :any_skip_relocation, arm64_tahoe:  "194e4b767c3d1a551453ceb3739345c84de89533768b352e3b339d116497a238"
+    sha256 cellar: :any_skip_relocation, arm64_linux:  "f7f743e111f7791301299c304b27fa1d4eda0a48b150c6270374fb360ee29b5b"
+    sha256 cellar: :any_skip_relocation, x86_64_linux: "8eba8b430051d74be92b403116c7e510225bcc3a94fb8fec7f836f2959dd4227"
   end
 
-  depends_on 'go' => :build
+  depends_on "go" => :build
 
   def install
-    ENV['CGO_ENABLED'] = '0'
+    ENV["CGO_ENABLED"] = "0"
     ldflags = %W[
       -s -w
       -X main.DefaultBuildkitdImage=docker.io/earthbuild/buildkitd:v0.8.17-rc-0
@@ -27,18 +24,18 @@ def install
       -X main.GitSha=#{Utils.git_head}
       -X main.BuiltBy=homebrew-earthbuild
     ]
-    tags = 'dfrunmount dfrunsecurity dfsecrets dfssh dfrunnetwork dfheredoc forceposix'
-    system 'go', 'build', '-tags', tags, *std_go_args(ldflags: ldflags, output: bin / 'earth'), './cmd/earthly'
+    tags = "dfrunmount dfrunsecurity dfsecrets dfssh dfrunnetwork dfheredoc forceposix"
+    system "go", "build", "-tags", tags, *std_go_args(ldflags: ldflags, output: bin / "earth"), "./cmd/earthly"
 
-    bin.install_symlink 'earthly' => 'earth'
+    bin.install_symlink "earthly" => "earth"
 
-    generate_completions_from_executable(bin / 'earth', 'bootstrap', '--source', shells: %i[bash zsh])
+    generate_completions_from_executable(bin/"earth", "bootstrap", "--source", shells: [:bash, :zsh])
   end
 
   def caveats
     <<~EOS
       EarthBuild requires a container runtime to function.
-      If you don't have one, you can install Docker or Podman:
+      If you don"t have one, you can install Docker or Podman:
         brew install --cask docker
         OR
         brew install podman
@@ -46,12 +43,12 @@ def caveats
   end
 
   test do
-    (testpath / 'Earthfile').write <<~EOS
+    (testpath / "Earthfile").write <<~EOS
       VERSION 0.8
       mytesttarget:
       \tRUN echo Homebrew
     EOS
     output = shell_output("#{bin}/earth ls")
-    assert_match '+mytesttarget', output
+    assert_match "+mytesttarget", output
   end
 end

From 4457418077fcdb9b260fa85d2b6006b74969e654 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Fri, 2 Jan 2026 23:44:15 +0000
Subject: [PATCH 05/31] chore: tidy

---
 .github/workflows/release.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 811b922..e55734d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -9,10 +9,13 @@ permissions:
 jobs:
   check:
     runs-on: ubuntu-24.04-arm
+    env:
+      FORCE_COLOR: 1
     steps:
-      - uses: earthbuild/actions-setup@main
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: earthbuild/actions-setup@main
+
       - name: Lint
         run: earthly --ci +lint

From d44f5d48db3cbf9917ab229f810b9a9593b2b177 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Wed, 7 Jan 2026 17:00:46 +0000
Subject: [PATCH 06/31] chore: tidy

---
 Earthfile        | 10 +++++++++-
 Formula/earth.rb |  5 +++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/Earthfile b/Earthfile
index 4367ca1..5299eb0 100644
--- a/Earthfile
+++ b/Earthfile
@@ -15,7 +15,7 @@ src:
         git commit -m "local snapshot"
     RUN brew tap EarthBuild/tap .
 
-# lint verify the formula for code quality
+# lint checks for Homebrew code quality
 lint:
     BUILD +audit
     BUILD +style
@@ -29,3 +29,11 @@ audit:
 style:
     FROM +src
     RUN brew style --verbose --debug EarthBuild/tap/earth
+
+test-install-bin:
+    FROM +src
+    RUN brew install --debug EarthBuild/tap/earth
+
+test-install-src:
+    FROM +src
+    RUN brew install --head --build-from-source --debug EarthBuild/tap/earth
\ No newline at end of file
diff --git a/Formula/earth.rb b/Formula/earth.rb
index e881769..544d37a 100644
--- a/Formula/earth.rb
+++ b/Formula/earth.rb
@@ -3,7 +3,8 @@ class Earth < Formula
   homepage "https://github.com/earthbuild"
   url "https://github.com/EarthBuild/earthbuild.git",
       tag:      "v0.8.17-rc-0",
-      revision: "52f2da6dd7f3de24a60a76e00044ec560b0ea407"
+      revision: "0574020c3a62ef0bab81247078cb9c3e66eb51f6"
+
   license "MPL-2.0"
   head "https://github.com/EarthBuild/earthbuild.git", branch: "main"
 
@@ -25,7 +26,7 @@ def install
       -X main.BuiltBy=homebrew-earthbuild
     ]
     tags = "dfrunmount dfrunsecurity dfsecrets dfssh dfrunnetwork dfheredoc forceposix"
-    system "go", "build", "-tags", tags, *std_go_args(ldflags: ldflags, output: bin / "earth"), "./cmd/earthly"
+    system "go", "build", "-tags", tags, "-ldflags", ldflags.join(" "), "-o", "earth", "./cmd/earthly"
 
     bin.install_symlink "earthly" => "earth"
 

From 8e82c75463e69ec74ebabcc39cd1501d751cb2ec Mon Sep 17 00:00:00 2001
From: Giles Cope <gilescope@gmail.com>
Date: Sun, 1 Mar 2026 19:53:51 +0000
Subject: [PATCH 07/31] fix: update to release version

Signed-off-by: Giles Cope <gilescope@gmail.com>
---
 Earthfile        | 25 +++++++++++++++++++++++--
 Formula/earth.rb | 19 +++++++++----------
 2 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/Earthfile b/Earthfile
index 5299eb0..68bd69b 100644
--- a/Earthfile
+++ b/Earthfile
@@ -23,7 +23,7 @@ lint:
 # audit checks for Homebrew coding style violations
 audit:
     FROM +src
-    RUN brew audit --new --signing --debug --audit-debug EarthBuild/tap/earth
+    RUN brew audit --except=specs --signing --debug --audit-debug EarthBuild/tap/earth
 
 # style checks for conformance to Homebrew style guidelines
 style:
@@ -36,4 +36,25 @@ test-install-bin:
 
 test-install-src:
     FROM +src
-    RUN brew install --head --build-from-source --debug EarthBuild/tap/earth
\ No newline at end of file
+    RUN brew install --head --build-from-source --debug EarthBuild/tap/earth
+
+# bottle-arm64-linux builds an arm64 linux bottle and outputs the SHA
+bottle-arm64-linux:
+    FROM --platform=linux/arm64 +src
+    RUN brew install --build-bottle EarthBuild/tap/earth
+    RUN brew bottle --no-rebuild --json EarthBuild/tap/earth
+    SAVE ARTIFACT earth--*.bottle.tar.gz AS LOCAL ./bottles/
+    SAVE ARTIFACT earth--*.bottle.json AS LOCAL ./bottles/
+
+# bottle-x86-linux builds an x86_64 linux bottle and outputs the SHA
+bottle-x86-linux:
+    FROM --platform=linux/amd64 +src
+    RUN brew install --build-bottle EarthBuild/tap/earth
+    RUN brew bottle --no-rebuild --json EarthBuild/tap/earth
+    SAVE ARTIFACT earth--*.bottle.tar.gz AS LOCAL ./bottles/
+    SAVE ARTIFACT earth--*.bottle.json AS LOCAL ./bottles/
+
+# bottle-linux builds both linux bottles
+bottle-linux:
+    BUILD +bottle-arm64-linux
+    BUILD +bottle-x86-linux
diff --git a/Formula/earth.rb b/Formula/earth.rb
index 544d37a..f7ac289 100644
--- a/Formula/earth.rb
+++ b/Formula/earth.rb
@@ -2,16 +2,15 @@ class Earth < Formula
   desc "Build automation tool for the container era"
   homepage "https://github.com/earthbuild"
   url "https://github.com/EarthBuild/earthbuild.git",
-      tag:      "v0.8.17-rc-0",
-      revision: "0574020c3a62ef0bab81247078cb9c3e66eb51f6"
-
+      tag:      "v0.8.17",
+      revision: "6babd00c58685413912e5e92bd22bb5c7ee993e8"
+  version "0.8.17"
   license "MPL-2.0"
   head "https://github.com/EarthBuild/earthbuild.git", branch: "main"
 
   bottle do
-    sha256 cellar: :any_skip_relocation, arm64_tahoe:  "194e4b767c3d1a551453ceb3739345c84de89533768b352e3b339d116497a238"
-    sha256 cellar: :any_skip_relocation, arm64_linux:  "f7f743e111f7791301299c304b27fa1d4eda0a48b150c6270374fb360ee29b5b"
-    sha256 cellar: :any_skip_relocation, x86_64_linux: "8eba8b430051d74be92b403116c7e510225bcc3a94fb8fec7f836f2959dd4227"
+    sha256 cellar: :any_skip_relocation, arm64_tahoe: "36453907d7764f90389dda4bad8982a1fcc2efa90d459dcab43f5a2fd51e0fa8"
+    sha256 cellar: :any_skip_relocation, arm64_linux: "5abd858ae7b281e0b9f29301243af80cd80e4562c01cd7e8480bc7aab37a9d78"
   end
 
   depends_on "go" => :build
@@ -20,15 +19,15 @@ def install
     ENV["CGO_ENABLED"] = "0"
     ldflags = %W[
       -s -w
-      -X main.DefaultBuildkitdImage=docker.io/earthbuild/buildkitd:v0.8.17-rc-0
+      -X main.DefaultBuildkitdImage=docker.io/earthbuild/buildkitd:v0.8.17
       -X main.Version=v#{version}
       -X main.GitSha=#{Utils.git_head}
       -X main.BuiltBy=homebrew-earthbuild
     ]
     tags = "dfrunmount dfrunsecurity dfsecrets dfssh dfrunnetwork dfheredoc forceposix"
-    system "go", "build", "-tags", tags, "-ldflags", ldflags.join(" "), "-o", "earth", "./cmd/earthly"
-
-    bin.install_symlink "earthly" => "earth"
+    system "go", "build", "-tags", tags, "-trimpath", "-ldflags", ldflags.join(" "), "-o", "earth", "./cmd/earthly"
+    bin.install "earth"
+    bin.install_symlink "earth" => "earthly"
 
     generate_completions_from_executable(bin/"earth", "bootstrap", "--source", shells: [:bash, :zsh])
   end

From 0be1537bf8eac33309b778ef4dd7ad0a9b342fec Mon Sep 17 00:00:00 2001
From: Giles Cope <gilescope@gmail.com>
Date: Sun, 1 Mar 2026 20:17:12 +0000
Subject: [PATCH 08/31] fix: point to earthbuild fork of homebrew core

Signed-off-by: Giles Cope <gilescope@gmail.com>
---
 .github/workflows/release.yaml      |  2 +-
 .release-to-homebrew-core/Earthfile | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e55734d..80aee00 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -18,4 +18,4 @@ jobs:
       - uses: earthbuild/actions-setup@main
 
       - name: Lint
-        run: earthly --ci +lint
+        run: earth --ci +lint
diff --git a/.release-to-homebrew-core/Earthfile b/.release-to-homebrew-core/Earthfile
index a2b8aa4..dff10b5 100644
--- a/.release-to-homebrew-core/Earthfile
+++ b/.release-to-homebrew-core/Earthfile
@@ -1,38 +1,38 @@
 VERSION 0.7
-PROJECT earthly-technologies/homebrew
+PROJECT earthbuild/homebrew
 
 deps:
     FROM homebrew/brew:4.0.17 # ubuntu-based
     COPY github-keyscan /home/linuxbrew/.ssh/known_hosts
-    RUN git config --global user.email "github-service@earthly.dev" && \
-        git config --global user.name "Little Red Corvette"
+    RUN git config --global user.email "webmaster@earthbuild.dev" && \
+        git config --global user.name "earthbuildci"
 
 open-homebrew-core-pr:
     FROM +deps
 
     # do the initial setup and fetch (which can be cached)
     WORKDIR /home/linuxbrew
-    RUN --mount type=secret,id=github/littleredcorvette/id_rsa,target=.ssh/id_rsa \
+    RUN --mount type=secret,id=github/earthbuildci/id_rsa,target=.ssh/id_rsa \
         eval "$(ssh-agent)" && \
         cat .ssh/id_rsa | ssh-add - && \
         git init homebrew-core && \
         cd homebrew-core && \
         git remote add Homebrew git@github.com:Homebrew/homebrew-core.git && \
-        git remote add littleredcorvette git@github.com:littleredcorvette/homebrew-core.git && \
+        git remote add earthbuild git@github.com:EarthBuild/homebrew-core.git && \
         echo "doing initial fetch" && \
         git fetch Homebrew
 
-    # the brew bump tool requires that littleredcorvette's fork of homebrew-core be updated to match the upstream master
+    # the brew bump tool requires that EarthBuild's fork of homebrew-core be updated to match the upstream master
     # otherwise, a merge-conflict will prevent the PR from being accepted.
     WORKDIR /home/linuxbrew/homebrew-core
     RUN --no-cache \
-        --mount type=secret,id=github/littleredcorvette/id_rsa,target=.ssh/id_rsa \
-        --secret HOMEBREW_GITHUB_API_TOKEN=github/littleredcorvette/homebrew-core-classic-token \
+        --mount type=secret,id=github/earthbuildci/id_rsa,target=.ssh/id_rsa \
+        --secret HOMEBREW_GITHUB_API_TOKEN=github/earthbuildci/homebrew-core-classic-token \
         eval "$(ssh-agent)" && \
         cat .ssh/id_rsa | ssh-add - && \
         echo "doing fetch" && \
         git fetch Homebrew && \
         echo "doing push" && \
-        git push littleredcorvette Homebrew/master:master && \
+        git push earthbuild Homebrew/master:master && \
         echo "doing bump" && \
-        brew bump earthly --open-pr
+        brew bump earth --open-pr

From a3ef93a416aa660bbb023c0f0e2f0bdef6f9b3c9 Mon Sep 17 00:00:00 2001
From: Giles Cope <gilescope@gmail.com>
Date: Sun, 1 Mar 2026 20:31:02 +0000
Subject: [PATCH 09/31] fix: probably not needed

Signed-off-by: Giles Cope <gilescope@gmail.com>
---
 .github/workflows/release.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 80aee00..25dea8e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -17,5 +17,8 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
       - uses: earthbuild/actions-setup@main
 
+      - name: Bootstrap buildkitd
+        run: earth bootstrap
+
       - name: Lint
         run: earth --ci +lint

From efd47c38e90c9192c6cd2a922fa71c1118f3c007 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 26 Mar 2026 19:13:51 +0000
Subject: [PATCH 10/31] chore: +check

---
 .github/workflows/release.yaml |  3 ++
 Earthfile                      | 62 ++++++++++++++++++++++++----------
 2 files changed, 48 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 25dea8e..a8daac9 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -22,3 +22,6 @@ jobs:
 
       - name: Lint
         run: earth --ci +lint
+
+      - name: Test
+        run: earth --ci +test
diff --git a/Earthfile b/Earthfile
index 68bd69b..a6ffedc 100644
--- a/Earthfile
+++ b/Earthfile
@@ -15,46 +15,74 @@ src:
         git commit -m "local snapshot"
     RUN brew tap EarthBuild/tap .
 
+# check verifies the quality of the formula
+check:
+    BUILD +lint
+    BUILD +test
+
 # lint checks for Homebrew code quality
 lint:
+    BUILD +info
     BUILD +audit
     BUILD +style
 
 # audit checks for Homebrew coding style violations
 audit:
     FROM +src
-    RUN brew audit --except=specs --signing --debug --audit-debug EarthBuild/tap/earth
+    RUN brew audit --strict --online --except=specs --signing --debug --audit-debug EarthBuild/tap/earth
 
 # style checks for conformance to Homebrew style guidelines
 style:
     FROM +src
     RUN brew style --verbose --debug EarthBuild/tap/earth
 
+# info checks that the formula parses correctly
+info:
+    FROM +src
+    RUN brew info EarthBuild/tap/earth
+
+# livecheck checks if there is a newer version available upstream
+livecheck:
+    FROM +src
+    RUN brew livecheck EarthBuild/tap/earth
+
+# test runs all tests
+test:
+    BUILD +test-install-bin
+    BUILD +test-install-src
+    BUILD +test-formula
+
+# test-formula runs the built-in 'test do' block defined in the formula
+test-formula:
+    FROM +src
+    RUN brew install --head --build-from-source --debug EarthBuild/tap/earth
+    RUN brew test --verbose --debug EarthBuild/tap/earth
+
 test-install-bin:
     FROM +src
-    RUN brew install --debug EarthBuild/tap/earth
+    ENV HOMEBREW_DEVELOPER=1
+    COPY +bottle-linux/earth--*.bottle.tar.gz ./bottles/
+    RUN arch="$(uname -m)"; \
+        if [ "$arch" = "aarch64" ]; then \
+            bottle_file=$(ls ./bottles/earth--*.arm64_linux.bottle.tar.gz); \
+        else \
+            bottle_file=$(ls ./bottles/earth--*.x86_64_linux.bottle.tar.gz); \
+        fi; \
+        brew install --verbose "$bottle_file"
+    RUN earth --version
 
 test-install-src:
     FROM +src
     RUN brew install --head --build-from-source --debug EarthBuild/tap/earth
 
-# bottle-arm64-linux builds an arm64 linux bottle and outputs the SHA
-bottle-arm64-linux:
-    FROM --platform=linux/arm64 +src
-    RUN brew install --build-bottle EarthBuild/tap/earth
-    RUN brew bottle --no-rebuild --json EarthBuild/tap/earth
-    SAVE ARTIFACT earth--*.bottle.tar.gz AS LOCAL ./bottles/
-    SAVE ARTIFACT earth--*.bottle.json AS LOCAL ./bottles/
-
-# bottle-x86-linux builds an x86_64 linux bottle and outputs the SHA
-bottle-x86-linux:
-    FROM --platform=linux/amd64 +src
+# bottle-linux builds a linux bottle for the host arch
+bottle-linux:
+    FROM +src
     RUN brew install --build-bottle EarthBuild/tap/earth
     RUN brew bottle --no-rebuild --json EarthBuild/tap/earth
     SAVE ARTIFACT earth--*.bottle.tar.gz AS LOCAL ./bottles/
     SAVE ARTIFACT earth--*.bottle.json AS LOCAL ./bottles/
 
-# bottle-linux builds both linux bottles
-bottle-linux:
-    BUILD +bottle-arm64-linux
-    BUILD +bottle-x86-linux
+# bottle-linux-all builds linux bottles for both amd64 and arm64
+bottle-linux-all:
+    BUILD --platform=linux/amd64 --platform=linux/arm64 +bottle-linux

From bb2f4c903e422c7af11b0c941c7babb524548585 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 26 Mar 2026 19:17:00 +0000
Subject: [PATCH 11/31] ci: use macos in GHA

---
 .github/workflows/release.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a8daac9..4d80e79 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   check:
-    runs-on: ubuntu-24.04-arm
+    runs-on: macos-26
     env:
       FORCE_COLOR: 1
     steps:

From b9ff7f8bafe4e66f88fa8a5412c4683effa9a8ce Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 26 Mar 2026 19:25:33 +0000
Subject: [PATCH 12/31] chore: +check

---
 .github/workflows/release.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 4d80e79..b52a094 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -16,6 +16,8 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
       - uses: earthbuild/actions-setup@main
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Bootstrap buildkitd
         run: earth bootstrap

From 0c60b7b56efd489b685a16c459e44838281b0a21 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 26 Mar 2026 19:26:17 +0000
Subject: [PATCH 13/31] chore: tidy

---
 .github/workflows/release.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b52a094..3ee0e37 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -17,7 +17,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
       - uses: earthbuild/actions-setup@main
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Bootstrap buildkitd
         run: earth bootstrap

From a6da627603bb20cf0b1c28744c1d45aacd796015 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 26 Mar 2026 19:33:15 +0000
Subject: [PATCH 14/31] chore: tidy

---
 .github/workflows/release.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3ee0e37..af89391 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   check:
-    runs-on: macos-26
+    runs-on: ubuntu-24.04-arm
     env:
       FORCE_COLOR: 1
     steps:

From 4fc3b92f88e2638e93c9ad6330a1a06106c264df Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Fri, 15 May 2026 16:43:18 +0100
Subject: [PATCH 15/31] chore: tidy

---
 Earthfile | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/Earthfile b/Earthfile
index a6ffedc..dfb3020 100644
--- a/Earthfile
+++ b/Earthfile
@@ -1,8 +1,17 @@
 VERSION 0.8
-FROM homebrew/brew:4.6.20
+FROM debian
+ENV NONINTERACTIVE=1
 ENV HOMEBREW_NO_AUTO_UPDATE=1
+ENV PATH="/home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin:${PATH}"
 WORKDIR /home/linuxbrew/earthbuild-tap
-RUN brew developer on
+RUN apt-get update && apt-get install -y curl git ca-certificates procps sudo build-essential
+RUN useradd -m -s /bin/bash linuxbrew && \
+    echo 'linuxbrew ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers && \
+    chown -R linuxbrew:linuxbrew /home/linuxbrew
+USER linuxbrew
+RUN \
+    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" && \
+    /home/linuxbrew/.linuxbrew/bin/brew developer on
 
 src:
     COPY --dir Formula .

From d7d0577019f709f60b986942306f4153ab16045f Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Fri, 15 May 2026 16:51:58 +0100
Subject: [PATCH 16/31] chore: tidy

---
 .github/workflows/release.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index af89391..1e9158c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: earthbuild/actions-setup@main
+      - uses: earthbuild/actions-setup@cec13796de0f8178bfeed4ef3ea2e9d90d96fc7f # main
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

From 59f23851bf7758a134319a8777561ed1a59a89a8 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Fri, 15 May 2026 16:53:59 +0100
Subject: [PATCH 17/31] chore: tidy

---
 .github/workflows/release.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1e9158c..ec20df0 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   check:
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-24.04
     env:
       FORCE_COLOR: 1
     steps:

From 038fe2f6e9fe6a8e73db2661b03715af1d4a2a38 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Fri, 15 May 2026 17:08:50 +0100
Subject: [PATCH 18/31] chore: tidy

---
 Earthfile | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/Earthfile b/Earthfile
index dfb3020..d8db138 100644
--- a/Earthfile
+++ b/Earthfile
@@ -32,8 +32,11 @@ check:
 # lint checks for Homebrew code quality
 lint:
     BUILD +info
+    BUILD +readall
     BUILD +audit
     BUILD +style
+    BUILD +fetch
+    BUILD +livecheck
 
 # audit checks for Homebrew coding style violations
 audit:
@@ -50,6 +53,16 @@ info:
     FROM +src
     RUN brew info EarthBuild/tap/earth
 
+# readall checks that all formulae in the tap can be successfully parsed
+readall:
+    FROM +src
+    RUN brew readall EarthBuild/tap
+
+# fetch verifies source URLs and sha256 checksums
+fetch:
+    FROM +src
+    RUN brew fetch --build-from-source EarthBuild/tap/earth
+
 # livecheck checks if there is a newer version available upstream
 livecheck:
     FROM +src

From 1612e8aebc39c907a85cc9ea6e2c283b123433b6 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Wed, 1 Jul 2026 15:37:56 +0100
Subject: [PATCH 19/31] chore: publish to GH packages

---
 .github/renovate.json5         | 19 +++++++++++++
 .github/workflows/release.yaml | 33 ++++++++++++++++++++++
 .gitignore                     |  3 +-
 Earthfile                      | 51 +++++++++++++++++++++++++++-------
 Formula/earth.rb               |  4 +--
 5 files changed, 97 insertions(+), 13 deletions(-)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 1003708..a98dc38 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -7,4 +7,23 @@
     ":semanticCommits",
   ],
   labels: ["renovate"],
+  customManagers: [
+    {
+      customType: "regex",
+      fileMatch: ["^Formula/earth\\.rb$"],
+      matchStrings: [
+        "url\\s+\"https://github\\.com/(?<depName>EarthBuild/earthbuild)\\.git\",\\s+tag:\\s+\"v(?<currentValue>.*?)\",\\s+revision:\\s+\"(?<currentDigest>.*?)\"",
+        "version\\s+\"(?<currentValue>.*?)\"",
+        "docker\\.io/earthbuild/buildkitd:v(?<currentValue>[0-9.]+)"
+      ],
+      datasourceTemplate: "github-tags",
+      depNameTemplate: "EarthBuild/earthbuild"
+    }
+  ],
+  packageRules: [
+    {
+      matchPackageNames: ["EarthBuild/earthbuild"],
+      branchName: "release-v{{{newVersion}}}"
+    }
+  ],
 }
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ec20df0..bf73eb8 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -2,9 +2,16 @@ name: Release
 
 on:
   push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize]
+    branches:
+      - main
 
 permissions:
   contents: write
+  packages: write
 
 jobs:
   check:
@@ -27,3 +34,29 @@ jobs:
 
       - name: Test
         run: earth --ci +test
+
+  publish:
+    needs: check
+    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-v')
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: earthbuild/actions-setup@main
+      - name: Set up Homebrew
+        uses: Homebrew/actions/setup-homebrew@master
+      
+      - name: Build Linux Bottles
+        run: earth --ci +bottle-linux-all
+        
+      - name: Build macOS Bottle
+        run: earth --ci +bottle-mac
+        
+      - name: Publish all Bottles
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          earth --ci \
+            --secret GITHUB_TOKEN=$GITHUB_TOKEN \
+            --build-arg GITHUB_REF=${{ github.head_ref }} \
+            --build-arg GITHUB_SHA=${{ github.event.pull_request.head.sha }} \
+            +publish
diff --git a/.gitignore b/.gitignore
index f410c0c..393b62a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 *.txt
 earthbuild*.json
-earthbuild*.tar.gz
\ No newline at end of file
+earthbuild*.tar.gz
+bottles
\ No newline at end of file
diff --git a/Earthfile b/Earthfile
index d8db138..adb71ac 100644
--- a/Earthfile
+++ b/Earthfile
@@ -9,20 +9,13 @@ RUN useradd -m -s /bin/bash linuxbrew && \
     echo 'linuxbrew ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers && \
     chown -R linuxbrew:linuxbrew /home/linuxbrew
 USER linuxbrew
-RUN \
+RUN git config --global --add safe.directory /home/linuxbrew/earthbuild-tap && \
     /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" && \
     /home/linuxbrew/.linuxbrew/bin/brew developer on
 
 src:
-    COPY --dir Formula .
-    RUN \
-        git config --global init.defaultBranch main && \
-        git init && \
-        git config user.email "local@local" && \
-        git config user.name "local" && \
-        git add . && \
-        git commit -m "local snapshot"
-    RUN brew tap EarthBuild/tap .
+    COPY --dir .git Formula .
+    RUN brew tap EarthBuild/tap . && brew trust EarthBuild/tap
 
 # check verifies the quality of the formula
 check:
@@ -108,3 +101,41 @@ bottle-linux:
 # bottle-linux-all builds linux bottles for both amd64 and arm64
 bottle-linux-all:
     BUILD --platform=linux/amd64 --platform=linux/arm64 +bottle-linux
+
+# bottle-mac builds a macos bottle natively
+bottle-mac:
+    LOCALLY
+    RUN mkdir -p bottles/
+    RUN brew install --build-bottle EarthBuild/tap/earth
+    RUN brew bottle --no-rebuild --json EarthBuild/tap/earth
+    RUN mv earth--*.bottle.* bottles/
+
+publish:
+    FROM +src
+    ARG GITHUB_REF
+    ARG GITHUB_SHA
+    ARG --required GIT_USER_EMAIL
+    ARG --required GIT_USER_NAME
+
+    # Copy the bottles built by the workflow
+    COPY ./bottles ./bottles
+
+    # Upload bottles to GHCR and update the formula bottle block
+    RUN --secret HOMEBREW_GITHUB_PACKAGES_TOKEN=GITHUB_TOKEN \
+        git config --global user.email "$GIT_USER_EMAIL" && \
+        git config --global user.name "$GIT_USER_NAME" && \
+        cd ./bottles && \
+        brew pr-upload --debug --verbose
+
+    # Merge into main and delete release branch
+    # RUN --secret GITHUB_TOKEN=GITHUB_TOKEN \
+    #     set -e && \
+    #     GITHUB_REPOSITORY=$(git remote get-url origin | sed -E 's|.*github.com[:/]([^/]+/[^/.]+)(\.git)?|\1|') && \
+    #     SHA=$(git rev-parse HEAD) && \
+    #     git remote set-url origin https://x-access-token:$GITHUB_TOKEN@github.com/"$GITHUB_REPOSITORY" && \
+    #     git fetch -a && \
+    #     git checkout main && \
+    #     git reset --hard origin/main && \
+    #     git merge "$SHA" && \
+    #     git push origin main && \
+    #     git push origin --delete "$GITHUB_REF"
diff --git a/Formula/earth.rb b/Formula/earth.rb
index f7ac289..e155f62 100644
--- a/Formula/earth.rb
+++ b/Formula/earth.rb
@@ -1,6 +1,6 @@
 class Earth < Formula
   desc "Build automation tool for the container era"
-  homepage "https://github.com/earthbuild"
+  homepage "https://earthbuild.dev"
   url "https://github.com/EarthBuild/earthbuild.git",
       tag:      "v0.8.17",
       revision: "6babd00c58685413912e5e92bd22bb5c7ee993e8"
@@ -9,7 +9,7 @@ class Earth < Formula
   head "https://github.com/EarthBuild/earthbuild.git", branch: "main"
 
   bottle do
-    sha256 cellar: :any_skip_relocation, arm64_tahoe: "36453907d7764f90389dda4bad8982a1fcc2efa90d459dcab43f5a2fd51e0fa8"
+    sha256 cellar: :any_skip_relocation, arm64_tahoe: "b1a590e3413b2461acf6c5eff91b6a92785198bfb043cf30794f24eba19e925e"
     sha256 cellar: :any_skip_relocation, arm64_linux: "5abd858ae7b281e0b9f29301243af80cd80e4562c01cd7e8480bc7aab37a9d78"
   end
 

From 8a6a29c4221c9b586f5716fda71797c74f24a257 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Wed, 1 Jul 2026 15:41:07 +0100
Subject: [PATCH 20/31] chore: rm version

---
 Formula/earth.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Formula/earth.rb b/Formula/earth.rb
index e155f62..b181bb1 100644
--- a/Formula/earth.rb
+++ b/Formula/earth.rb
@@ -4,7 +4,6 @@ class Earth < Formula
   url "https://github.com/EarthBuild/earthbuild.git",
       tag:      "v0.8.17",
       revision: "6babd00c58685413912e5e92bd22bb5c7ee993e8"
-  version "0.8.17"
   license "MPL-2.0"
   head "https://github.com/EarthBuild/earthbuild.git", branch: "main"
 

From e22790b3d2955580cdc347a8bc8e597e3b7032d0 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 17:10:44 +0100
Subject: [PATCH 21/31] chore: WIP

---
 .github/workflows/release.yaml         |  26 -----
 .github/workflows/test-and-publish.yml | 128 -------------------------
 Earthfile                              |  80 ++--------------
 Formula/earth.rb                       |  49 ++++++----
 README.md                              |  21 ++--
 5 files changed, 50 insertions(+), 254 deletions(-)
 delete mode 100644 .github/workflows/test-and-publish.yml

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index bf73eb8..47be845 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -34,29 +34,3 @@ jobs:
 
       - name: Test
         run: earth --ci +test
-
-  publish:
-    needs: check
-    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-v')
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: earthbuild/actions-setup@main
-      - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@master
-      
-      - name: Build Linux Bottles
-        run: earth --ci +bottle-linux-all
-        
-      - name: Build macOS Bottle
-        run: earth --ci +bottle-mac
-        
-      - name: Publish all Bottles
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          earth --ci \
-            --secret GITHUB_TOKEN=$GITHUB_TOKEN \
-            --build-arg GITHUB_REF=${{ github.head_ref }} \
-            --build-arg GITHUB_SHA=${{ github.event.pull_request.head.sha }} \
-            +publish
diff --git a/.github/workflows/test-and-publish.yml b/.github/workflows/test-and-publish.yml
deleted file mode 100644
index a3885d5..0000000
--- a/.github/workflows/test-and-publish.yml
+++ /dev/null
@@ -1,128 +0,0 @@
-name: brew test and publish bot
-on:
-  push:
-    branches:
-      - release-*
-jobs:
-  release:
-    runs-on: macos-latest
-    steps:
-      - name: Set up Homebrew
-        id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
-
-      - name: Set up git
-        uses: Homebrew/actions/git-user-config@master
-
-      - name: Cache Homebrew Bundler RubyGems
-        id: cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
-        with:
-          path: ${{ steps.set-up-homebrew.outputs.gems-path }}
-          key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}
-          restore-keys: ${{ runner.os }}-rubygems-
-
-      - name: Install Homebrew Bundler RubyGems
-        if: steps.cache.outputs.cache-hit != 'true'
-        run: brew install-bundler-gems
-
-      - name: cleanup
-        env:
-          HOMEBREW_GITHUB_API_TOKEN: ${{ github.token }}
-        run: brew test-bot --only-cleanup-before
-
-      - name: setup
-        env:
-          HOMEBREW_GITHUB_API_TOKEN: ${{ github.token }}
-        run: brew test-bot --only-setup
-
-      - name: syntax check
-        env:
-          HOMEBREW_GITHUB_API_TOKEN: ${{ github.token }}
-        run: brew test-bot --only-tap-syntax
-
-      - name: brew update
-        env:
-          HOMEBREW_NO_INSTALL_FROM_API: 1
-        run: brew update
-
-      - name: build earthly bottles
-        env:
-          HOMEBREW_GITHUB_API_TOKEN: ${{ github.token }}
-        run: brew test-bot --only-formulae earthly
-
-      # homebrew intentially adds in two hyphens under
-      # https://github.com/Homebrew/brew/blob/b55498269f1fb0380cfd7122f6bbc0fc0125c35f/Library/Homebrew/software_spec.rb#L279
-      - name: remove double hyphens which are produced by test-bot
-        run: find earthly--*.bottle.* | awk -F "--" '{print "mv " $0 " " $1"-"$2}' | sh
-
-      - name: move bottles into bottles/ dir
-        run: mkdir bottles/ && mv ./*.bottle.* bottles/
-
-      - name: merge bottles
-        env:
-          HOMEBREW_GITHUB_API_TOKEN: ${{ github.token }}
-        run: brew bottle --merge --root-url "https://github.com/$GITHUB_REPOSITORY/releases/download/" --write bottles/*.json
-
-      # "brew test-bot" removes dependencies; we must re-install them here
-      - name: (re)install dependencies
-        run: brew install jq npm
-
-      - name: setup github-release
-        run: npm install -g github-release-cli@v1.3.1
-
-      - name: release bottles
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |-
-          set -e
-          # shellcheck disable=SC2153
-          VERSION="${GITHUB_REF#refs/heads/release-v}"
-          if ! echo "$VERSION" | grep '^[0-9]\+\.[0-9]\+\.[0-9]\+$' >/dev/null; then
-            echo "ERROR: failed to detect semantic version; got $VERSION"
-            exit 1
-          fi
-          RELEASE_TAG="earthly-$VERSION"
-          # first delete any previously released files (needed in case the previous upload attempt failed)
-          PREV_RELEASE_ID=$(curl -s -H "Authorization: token $GITHUB_TOKEN" "https://api.github.com/repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" | jq .id)
-          if [ -n "$PREV_RELEASE_ID" ] && [ "$PREV_RELEASE_ID" != "null" ]; then
-            echo "deleting previous release ID $PREV_RELEASE_ID"
-            curl -s -H "Authorization: token $GITHUB_TOKEN" --request DELETE "https://api.github.com/repos/$GITHUB_REPOSITORY/releases/$PREV_RELEASE_ID"
-          fi
-          # next make sure any previous tag is deleted (otherwise github will create an untagged release name vX.Y.Z)
-          echo "deleting tag $RELEASE_TAG (in case it already exists)"
-          curl -s -H "Authorization: token $GITHUB_TOKEN" --request DELETE "https://api.github.com/repos/$GITHUB_REPOSITORY/git/refs/tags/$RELEASE_TAG"
-          GITHUB_OWNER=$(dirname "$GITHUB_REPOSITORY")
-          GITHUB_REPO=$(basename "$GITHUB_REPOSITORY")
-          github-release upload \
-          --owner "$GITHUB_OWNER" \
-          --repo "$GITHUB_REPO" \
-          --prerelease false \
-          --commitish "$GITHUB_SHA" \
-          --tag "$RELEASE_TAG" \
-          --name "$RELEASE_TAG" \
-          --body "earthly: update $VERSION bottle." \
-          ./bottles/*.tar.gz 2>&1 | tee /tmp/release.log
-          if grep -i error /tmp/release.log > /dev/null; then
-            echo "ERROR: github-release upload failed: check the above release.log output" && exit 1
-          fi
-
-      - name: merge into main and delete release branch
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |-
-          # this should be different than GITHUB_SHA, due to brew bottle comitting a change
-          SHA=$(git rev-parse HEAD)
-          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/"$GITHUB_REPOSITORY"
-          git fetch -a
-          git checkout main
-          git reset --hard origin/main
-          git merge "$SHA"
-          git push origin main
-          git push origin --delete "$GITHUB_REF"
-          curl -s -X POST -H 'Content-type: application/json' --data '{"text":"homebrew-earthly: Successfully merged release branch into main"}' "${{ secrets.SLACK_RELEASE_WEBHOOK_URL }}"
-
-      - name: post to slack on failure
-        run: |-
-          curl -s -X POST -H 'Content-type: application/json' --data '{ "attachments": [ { "fallback": "Failed to build release", "title": "earthly/homebrew-earthly tap", "title_link": "'"$GITHUB_SERVER_URL"'/'"$GITHUB_REPOSITORY"'/actions/runs/'"$GITHUB_RUN_ID"', "text": "Failed to build release!", "color": "#CC0000" } ] }' "${{ secrets.SLACK_RELEASE_WEBHOOK_URL }}"
-        if: ${{ failure() }}
diff --git a/Earthfile b/Earthfile
index adb71ac..661228b 100644
--- a/Earthfile
+++ b/Earthfile
@@ -16,6 +16,8 @@ RUN git config --global --add safe.directory /home/linuxbrew/earthbuild-tap && \
 src:
     COPY --dir .git Formula .
     RUN brew tap EarthBuild/tap . && brew trust EarthBuild/tap
+    SAVE ARTIFACT Formula
+    SAVE ARTIFACT .git
 
 # check verifies the quality of the formula
 check:
@@ -63,79 +65,17 @@ livecheck:
 
 # test runs all tests
 test:
-    BUILD +test-install-bin
-    BUILD +test-install-src
+    BUILD +test-install
     BUILD +test-formula
 
-# test-formula runs the built-in 'test do' block defined in the formula
-test-formula:
-    FROM +src
-    RUN brew install --head --build-from-source --debug EarthBuild/tap/earth
-    RUN brew test --verbose --debug EarthBuild/tap/earth
-
-test-install-bin:
+# test-install installs the pre-compiled binary
+test-install:
     FROM +src
-    ENV HOMEBREW_DEVELOPER=1
-    COPY +bottle-linux/earth--*.bottle.tar.gz ./bottles/
-    RUN arch="$(uname -m)"; \
-        if [ "$arch" = "aarch64" ]; then \
-            bottle_file=$(ls ./bottles/earth--*.arm64_linux.bottle.tar.gz); \
-        else \
-            bottle_file=$(ls ./bottles/earth--*.x86_64_linux.bottle.tar.gz); \
-        fi; \
-        brew install --verbose "$bottle_file"
+    RUN brew install EarthBuild/tap/earth
     RUN earth --version
 
-test-install-src:
-    FROM +src
-    RUN brew install --head --build-from-source --debug EarthBuild/tap/earth
-
-# bottle-linux builds a linux bottle for the host arch
-bottle-linux:
-    FROM +src
-    RUN brew install --build-bottle EarthBuild/tap/earth
-    RUN brew bottle --no-rebuild --json EarthBuild/tap/earth
-    SAVE ARTIFACT earth--*.bottle.tar.gz AS LOCAL ./bottles/
-    SAVE ARTIFACT earth--*.bottle.json AS LOCAL ./bottles/
-
-# bottle-linux-all builds linux bottles for both amd64 and arm64
-bottle-linux-all:
-    BUILD --platform=linux/amd64 --platform=linux/arm64 +bottle-linux
-
-# bottle-mac builds a macos bottle natively
-bottle-mac:
-    LOCALLY
-    RUN mkdir -p bottles/
-    RUN brew install --build-bottle EarthBuild/tap/earth
-    RUN brew bottle --no-rebuild --json EarthBuild/tap/earth
-    RUN mv earth--*.bottle.* bottles/
-
-publish:
+# test-formula runs the built-in 'test do' block defined in the formula
+test-formula:
     FROM +src
-    ARG GITHUB_REF
-    ARG GITHUB_SHA
-    ARG --required GIT_USER_EMAIL
-    ARG --required GIT_USER_NAME
-
-    # Copy the bottles built by the workflow
-    COPY ./bottles ./bottles
-
-    # Upload bottles to GHCR and update the formula bottle block
-    RUN --secret HOMEBREW_GITHUB_PACKAGES_TOKEN=GITHUB_TOKEN \
-        git config --global user.email "$GIT_USER_EMAIL" && \
-        git config --global user.name "$GIT_USER_NAME" && \
-        cd ./bottles && \
-        brew pr-upload --debug --verbose
-
-    # Merge into main and delete release branch
-    # RUN --secret GITHUB_TOKEN=GITHUB_TOKEN \
-    #     set -e && \
-    #     GITHUB_REPOSITORY=$(git remote get-url origin | sed -E 's|.*github.com[:/]([^/]+/[^/.]+)(\.git)?|\1|') && \
-    #     SHA=$(git rev-parse HEAD) && \
-    #     git remote set-url origin https://x-access-token:$GITHUB_TOKEN@github.com/"$GITHUB_REPOSITORY" && \
-    #     git fetch -a && \
-    #     git checkout main && \
-    #     git reset --hard origin/main && \
-    #     git merge "$SHA" && \
-    #     git push origin main && \
-    #     git push origin --delete "$GITHUB_REF"
+    RUN brew install EarthBuild/tap/earth
+    RUN brew test --verbose --debug EarthBuild/tap/earth
diff --git a/Formula/earth.rb b/Formula/earth.rb
index b181bb1..45d2757 100644
--- a/Formula/earth.rb
+++ b/Formula/earth.rb
@@ -1,31 +1,40 @@
 class Earth < Formula
   desc "Build automation tool for the container era"
   homepage "https://earthbuild.dev"
-  url "https://github.com/EarthBuild/earthbuild.git",
-      tag:      "v0.8.17",
-      revision: "6babd00c58685413912e5e92bd22bb5c7ee993e8"
+  version "0.8.17"
   license "MPL-2.0"
-  head "https://github.com/EarthBuild/earthbuild.git", branch: "main"
 
-  bottle do
-    sha256 cellar: :any_skip_relocation, arm64_tahoe: "b1a590e3413b2461acf6c5eff91b6a92785198bfb043cf30794f24eba19e925e"
-    sha256 cellar: :any_skip_relocation, arm64_linux: "5abd858ae7b281e0b9f29301243af80cd80e4562c01cd7e8480bc7aab37a9d78"
+  on_macos do
+    on_arm do
+      url "https://github.com/EarthBuild/earthbuild/releases/download/v0.8.17/earth-darwin-arm64"
+      sha256 "2e0a5e7b5623e2bfdab3e0be6bbbcb772f1d2ad6562132fbc3c9ce5564a939c1"
+    end
+    on_intel do
+      url "https://github.com/EarthBuild/earthbuild/releases/download/v0.8.17/earth-darwin-amd64"
+      sha256 "4ba8af21431b276edfacf8730e9372da1842ead0bc9bf0f6a014896afca97c96"
+    end
   end
 
-  depends_on "go" => :build
+  on_linux do
+    on_arm do
+      url "https://github.com/EarthBuild/earthbuild/releases/download/v0.8.17/earth-linux-arm64"
+      sha256 "bdc776167083e1bc4ec01379e88c6ae6372f52e4ea034e931865ff4ba030df63"
+    end
+    on_intel do
+      url "https://github.com/EarthBuild/earthbuild/releases/download/v0.8.17/earth-linux-amd64"
+      sha256 "85b7f31020be220493c1ef89fe4e976985a72e54dd12b7dfcf17544c8d4fd880"
+    end
+  end
 
   def install
-    ENV["CGO_ENABLED"] = "0"
-    ldflags = %W[
-      -s -w
-      -X main.DefaultBuildkitdImage=docker.io/earthbuild/buildkitd:v0.8.17
-      -X main.Version=v#{version}
-      -X main.GitSha=#{Utils.git_head}
-      -X main.BuiltBy=homebrew-earthbuild
-    ]
-    tags = "dfrunmount dfrunsecurity dfsecrets dfssh dfrunnetwork dfheredoc forceposix"
-    system "go", "build", "-tags", tags, "-trimpath", "-ldflags", ldflags.join(" "), "-o", "earth", "./cmd/earthly"
-    bin.install "earth"
+    binary_name = if OS.mac?
+      Hardware::CPU.arm? ? "earth-darwin-arm64" : "earth-darwin-amd64"
+    else
+      Hardware::CPU.arm? ? "earth-linux-arm64" : "earth-linux-amd64"
+    end
+
+    system "chmod", "+x", binary_name
+    bin.install binary_name => "earth"
     bin.install_symlink "earth" => "earthly"
 
     generate_completions_from_executable(bin/"earth", "bootstrap", "--source", shells: [:bash, :zsh])
@@ -34,7 +43,7 @@ def install
   def caveats
     <<~EOS
       EarthBuild requires a container runtime to function.
-      If you don"t have one, you can install Docker or Podman:
+      If you don't have one, you can install Docker or Podman:
         brew install --cask docker
         OR
         brew install podman
diff --git a/README.md b/README.md
index df59643..82465f8 100644
--- a/README.md
+++ b/README.md
@@ -1,27 +1,28 @@
-# homebrew-earthbuild
+# homebrew-tap
 
-Before you begin, ensure you have Homebrew installed on your macOS system. If you don't, you can install it by following the instructions on the [official Homebrew website](https://brew.sh/).
+This repository contains the homebrew formula required to install `earth` on MacOS and Linux via `brew`.
+
+Before you begin, ensure you have Homebrew installed on your macOS or Linux system. If you don't, you can install it by following the instructions on the [official Homebrew website](https://brew.sh/).
 
-This repository contains the homebrew formula required to install `EarthBuild` on MacOS via `brew`.
 
-## Installation
 
-**Only alpha version is available at the moment. Stable version coming soon.**
+## Installation
 
-First, add this tap to your local Homebrew setup. This makes the formulas within it available for installation.
+You can install `earth` directly from this tap using:
 
 ```shell
-brew tap earthbuild/earthbuild
+brew install earthbuild/tap/earth
 ```
 
-For the latest stable version, run:
+Or you can tap the repository first and then install:
 
 ```shell
+brew tap earthbuild/tap
 brew install earth
 ```
 
-To install the alpha version directly from the main branch (which may be unstable), run:
+To install the latest development version directly from the main branch (which may be unstable), run:
 
 ```shell
-brew install --HEAD earth
+brew install --HEAD earthbuild/tap/earth
 ```

From 0a5d26471755a1c27686413158f35ee07ae2ea25 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 17:12:07 +0100
Subject: [PATCH 22/31] chore: fix rubocop style warning for chmod

---
 Formula/earth.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Formula/earth.rb b/Formula/earth.rb
index 45d2757..14b4417 100644
--- a/Formula/earth.rb
+++ b/Formula/earth.rb
@@ -33,7 +33,7 @@ def install
       Hardware::CPU.arm? ? "earth-linux-arm64" : "earth-linux-amd64"
     end
 
-    system "chmod", "+x", binary_name
+    chmod 0755, binary_name
     bin.install binary_name => "earth"
     bin.install_symlink "earth" => "earthly"
 

From 77c3df3067761aabae123ec07ca4d2fb6e58a92e Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 17:15:46 +0100
Subject: [PATCH 23/31] chore: update homepage to github repo

---
 Formula/earth.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Formula/earth.rb b/Formula/earth.rb
index 14b4417..0c6dc6d 100644
--- a/Formula/earth.rb
+++ b/Formula/earth.rb
@@ -1,6 +1,6 @@
 class Earth < Formula
   desc "Build automation tool for the container era"
-  homepage "https://earthbuild.dev"
+  homepage "https://github.com/EarthBuild/earthbuild"
   version "0.8.17"
   license "MPL-2.0"
 

From eace42b0e5118071c68bf756fbc69aa44734332c Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 17:19:15 +0100
Subject: [PATCH 24/31] feat: automate Renovate GHA SHA256 checksum updates for
 binary-only release

---
 .github/renovate.json5                 |  4 +-
 .github/workflows/update-checksums.yml | 35 +++++++++++++++
 Formula/earth.rb                       |  8 ++--
 scripts/update-checksums.py            | 61 ++++++++++++++++++++++++++
 4 files changed, 101 insertions(+), 7 deletions(-)
 create mode 100644 .github/workflows/update-checksums.yml
 create mode 100644 scripts/update-checksums.py

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index a98dc38..d709947 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -12,9 +12,7 @@
       customType: "regex",
       fileMatch: ["^Formula/earth\\.rb$"],
       matchStrings: [
-        "url\\s+\"https://github\\.com/(?<depName>EarthBuild/earthbuild)\\.git\",\\s+tag:\\s+\"v(?<currentValue>.*?)\",\\s+revision:\\s+\"(?<currentDigest>.*?)\"",
-        "version\\s+\"(?<currentValue>.*?)\"",
-        "docker\\.io/earthbuild/buildkitd:v(?<currentValue>[0-9.]+)"
+        "version\\s+\"(?<currentValue>.*?)\""
       ],
       datasourceTemplate: "github-tags",
       depNameTemplate: "EarthBuild/earthbuild"
diff --git a/.github/workflows/update-checksums.yml b/.github/workflows/update-checksums.yml
new file mode 100644
index 0000000..ca4060c
--- /dev/null
+++ b/.github/workflows/update-checksums.yml
@@ -0,0 +1,35 @@
+name: Update Release Checksums
+
+on:
+  pull_request:
+    branches:
+      - 'release-v*'
+
+permissions:
+  contents: write
+
+jobs:
+  update-sha:
+    runs-on: ubuntu-latest
+    if: github.actor == 'renovate[bot]'
+    steps:
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          ref: ${{ github.event.pull_request.head.ref }}
+
+      - name: Run checksum update script
+        run: python3 scripts/update-checksums.py
+
+      - name: Commit and push changes
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if ! git diff --exit-code Formula/earth.rb; then
+            git add Formula/earth.rb
+            git commit -m "chore: update sha256 checksums"
+            git push
+          else
+            echo "No checksum changes detected."
+          fi
diff --git a/Formula/earth.rb b/Formula/earth.rb
index 0c6dc6d..bf634c0 100644
--- a/Formula/earth.rb
+++ b/Formula/earth.rb
@@ -6,22 +6,22 @@ class Earth < Formula
 
   on_macos do
     on_arm do
-      url "https://github.com/EarthBuild/earthbuild/releases/download/v0.8.17/earth-darwin-arm64"
+      url "https://github.com/EarthBuild/earthbuild/releases/download/v#{version}/earth-darwin-arm64"
       sha256 "2e0a5e7b5623e2bfdab3e0be6bbbcb772f1d2ad6562132fbc3c9ce5564a939c1"
     end
     on_intel do
-      url "https://github.com/EarthBuild/earthbuild/releases/download/v0.8.17/earth-darwin-amd64"
+      url "https://github.com/EarthBuild/earthbuild/releases/download/v#{version}/earth-darwin-amd64"
       sha256 "4ba8af21431b276edfacf8730e9372da1842ead0bc9bf0f6a014896afca97c96"
     end
   end
 
   on_linux do
     on_arm do
-      url "https://github.com/EarthBuild/earthbuild/releases/download/v0.8.17/earth-linux-arm64"
+      url "https://github.com/EarthBuild/earthbuild/releases/download/v#{version}/earth-linux-arm64"
       sha256 "bdc776167083e1bc4ec01379e88c6ae6372f52e4ea034e931865ff4ba030df63"
     end
     on_intel do
-      url "https://github.com/EarthBuild/earthbuild/releases/download/v0.8.17/earth-linux-amd64"
+      url "https://github.com/EarthBuild/earthbuild/releases/download/v#{version}/earth-linux-amd64"
       sha256 "85b7f31020be220493c1ef89fe4e976985a72e54dd12b7dfcf17544c8d4fd880"
     end
   end
diff --git a/scripts/update-checksums.py b/scripts/update-checksums.py
new file mode 100644
index 0000000..90fc541
--- /dev/null
+++ b/scripts/update-checksums.py
@@ -0,0 +1,61 @@
+import urllib.request
+import re
+import sys
+
+def main():
+    # 1. Parse version from Formula/earth.rb
+    with open("Formula/earth.rb", "r") as f:
+        content = f.read()
+
+    m = re.search(r'version "([0-9.]+)"', content)
+    if not m:
+        print("Error: version not found in Formula/earth.rb")
+        sys.exit(1)
+    version = m.group(1)
+
+    print(f"Detected version: {version}")
+
+    # 2. Fetch checksum.asc
+    url = f"https://github.com/EarthBuild/earthbuild/releases/download/v{version}/checksum.asc"
+    print(f"Fetching checksums from: {url}")
+    try:
+        with urllib.request.urlopen(url) as response:
+            checksums_text = response.read().decode('utf-8')
+    except Exception as e:
+        print(f"Error fetching checksums: {e}")
+        sys.exit(1)
+
+    # 3. Parse hashes
+    hashes = {}
+    for line in checksums_text.splitlines():
+        parts = line.split()
+        if len(parts) == 2:
+            hashes[parts[1]] = parts[0]
+
+    required_binaries = [
+        "earth-darwin-arm64",
+        "earth-darwin-amd64",
+        "earth-linux-arm64",
+        "earth-linux-amd64"
+    ]
+    for b in required_binaries:
+        if b not in hashes:
+            print(f"Error: checksum for {b} not found in checksum.asc")
+            sys.exit(1)
+
+    # 4. Update sha256 hashes in earth.rb
+    for b in required_binaries:
+        pattern = rf'(url\s+"https://github\.com/EarthBuild/earthbuild/releases/download/v#{{version}}/{b}"\s+sha256\s+")[a-f0-9]+(")'
+        content, count = re.subn(pattern, rf'\g<1>{hashes[b]}\g<2>', content)
+        if count == 0:
+            print(f"Error: failed to replace sha256 for {b} in Formula/earth.rb")
+            sys.exit(1)
+        print(f"Updated {b} sha256 to {hashes[b]}")
+
+    with open("Formula/earth.rb", "w") as f:
+        f.write(content)
+
+    print("Formula/earth.rb updated successfully!")
+
+if __name__ == "__main__":
+    main()

From 6a9c60aefcf76c9e287087b962e57878de9eb422 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 18:02:33 +0100
Subject: [PATCH 25/31] chore: tidy

---
 .github/renovate.json5                 |  3 +-
 .github/workflows/ci.yaml              | 27 ++++++++++++++++++
 .github/workflows/release.yaml         | 39 +++++++++++++-------------
 .github/workflows/update-checksums.yml | 35 -----------------------
 4 files changed, 48 insertions(+), 56 deletions(-)
 create mode 100644 .github/workflows/ci.yaml
 delete mode 100644 .github/workflows/update-checksums.yml

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index d709947..fe3b20b 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -21,7 +21,8 @@
   packageRules: [
     {
       matchPackageNames: ["EarthBuild/earthbuild"],
-      branchName: "release-v{{{newVersion}}}"
+      branchName: "release-v{{{newVersion}}}",
+      automerge: true
     }
   ],
 }
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..0d16210
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: earthbuild/actions-setup@5d323543fa1d7b963384b46b2cbaef0bf6d88216 # v2.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Bootstrap buildkitd
+        run: earth bootstrap
+
+      - name: Lint
+        run: earth --ci +lint
+
+      - name: Test
+        run: earth --ci +test
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 47be845..e1043f8 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -1,36 +1,35 @@
 name: Release
 
 on:
-  push:
-    branches:
-      - main
   pull_request:
-    types: [opened, synchronize]
     branches:
       - main
 
 permissions:
   contents: write
-  packages: write
 
 jobs:
-  check:
-    runs-on: ubuntu-24.04
-    env:
-      FORCE_COLOR: 1
+  update-sha:
+    runs-on: ubuntu-24.04-arm
+    if: github.actor == 'renovate[bot]' && startsWith(github.head_ref, 'release-v')
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: earthbuild/actions-setup@cec13796de0f8178bfeed4ef3ea2e9d90d96fc7f # main
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Bootstrap buildkitd
-        run: earth bootstrap
+          ref: ${{ github.event.pull_request.head.ref }}
 
-      - name: Lint
-        run: earth --ci +lint
+      - name: Update checksums
+        run: python3 scripts/update-checksums.py
 
-      - name: Test
-        run: earth --ci +test
+      - name: Commit and push changes
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if ! git diff --exit-code Formula/earth.rb; then
+            git add Formula/earth.rb
+            git commit -m "chore: update sha256 checksums"
+            git push
+          else
+            echo "No checksum changes detected."
+          fi
diff --git a/.github/workflows/update-checksums.yml b/.github/workflows/update-checksums.yml
deleted file mode 100644
index ca4060c..0000000
--- a/.github/workflows/update-checksums.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: Update Release Checksums
-
-on:
-  pull_request:
-    branches:
-      - 'release-v*'
-
-permissions:
-  contents: write
-
-jobs:
-  update-sha:
-    runs-on: ubuntu-latest
-    if: github.actor == 'renovate[bot]'
-    steps:
-      - name: Checkout PR branch
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          ref: ${{ github.event.pull_request.head.ref }}
-
-      - name: Run checksum update script
-        run: python3 scripts/update-checksums.py
-
-      - name: Commit and push changes
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          if ! git diff --exit-code Formula/earth.rb; then
-            git add Formula/earth.rb
-            git commit -m "chore: update sha256 checksums"
-            git push
-          else
-            echo "No checksum changes detected."
-          fi

From e1f985b64b849b787b73729f08dbebf9e21ae35d Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 18:16:56 +0100
Subject: [PATCH 26/31] chore: tidy

---
 Earthfile                   | 2 +-
 README.md                   | 6 ------
 scripts/update-checksums.py | 5 +++--
 3 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/Earthfile b/Earthfile
index 661228b..02970ee 100644
--- a/Earthfile
+++ b/Earthfile
@@ -56,7 +56,7 @@ readall:
 # fetch verifies source URLs and sha256 checksums
 fetch:
     FROM +src
-    RUN brew fetch --build-from-source EarthBuild/tap/earth
+    RUN brew fetch EarthBuild/tap/earth
 
 # livecheck checks if there is a newer version available upstream
 livecheck:
diff --git a/README.md b/README.md
index 82465f8..e3d7871 100644
--- a/README.md
+++ b/README.md
@@ -20,9 +20,3 @@ Or you can tap the repository first and then install:
 brew tap earthbuild/tap
 brew install earth
 ```
-
-To install the latest development version directly from the main branch (which may be unstable), run:
-
-```shell
-brew install --HEAD earthbuild/tap/earth
-```
diff --git a/scripts/update-checksums.py b/scripts/update-checksums.py
index 90fc541..3914b03 100644
--- a/scripts/update-checksums.py
+++ b/scripts/update-checksums.py
@@ -19,7 +19,7 @@ def main():
     url = f"https://github.com/EarthBuild/earthbuild/releases/download/v{version}/checksum.asc"
     print(f"Fetching checksums from: {url}")
     try:
-        with urllib.request.urlopen(url) as response:
+        with urllib.request.urlopen(url, timeout=60) as response:
             checksums_text = response.read().decode('utf-8')
     except Exception as e:
         print(f"Error fetching checksums: {e}")
@@ -30,7 +30,8 @@ def main():
     for line in checksums_text.splitlines():
         parts = line.split()
         if len(parts) == 2:
-            hashes[parts[1]] = parts[0]
+            filename = parts[1].lstrip('*')
+            hashes[filename] = parts[0]
 
     required_binaries = [
         "earth-darwin-arm64",

From 653e0ab1f0d783f8ead09280452f440197ace0db Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 18:18:22 +0100
Subject: [PATCH 27/31] chore: tidy

---
 scripts/update-checksums.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/update-checksums.py b/scripts/update-checksums.py
index 3914b03..c15c1e0 100644
--- a/scripts/update-checksums.py
+++ b/scripts/update-checksums.py
@@ -46,7 +46,7 @@ def main():
 
     # 4. Update sha256 hashes in earth.rb
     for b in required_binaries:
-        pattern = rf'(url\s+"https://github\.com/EarthBuild/earthbuild/releases/download/v#{{version}}/{b}"\s+sha256\s+")[a-f0-9]+(")'
+        pattern = r'(url\s+"https://github\.com/EarthBuild/earthbuild/releases/download/v#\{version\}/%s"\s+sha256\s+")[a-f0-9]+(")' % b
         content, count = re.subn(pattern, rf'\g<1>{hashes[b]}\g<2>', content)
         if count == 0:
             print(f"Error: failed to replace sha256 for {b} in Formula/earth.rb")

From 9a15c9b47c0f7d2ebef3a7284181daddb9f4c757 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 18:21:21 +0100
Subject: [PATCH 28/31] chore: tidy

---
 .release-to-homebrew-core/Earthfile | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.release-to-homebrew-core/Earthfile b/.release-to-homebrew-core/Earthfile
index dff10b5..dbb9514 100644
--- a/.release-to-homebrew-core/Earthfile
+++ b/.release-to-homebrew-core/Earthfile
@@ -1,5 +1,4 @@
-VERSION 0.7
-PROJECT earthbuild/homebrew
+VERSION 0.8
 
 deps:
     FROM homebrew/brew:4.0.17 # ubuntu-based

From a9cd98a505d9f3f58aa8c521f8eb2671ddb9c152 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 18:21:55 +0100
Subject: [PATCH 29/31] chore: tidy

---
 .release-to-homebrew-core/Earthfile | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/.release-to-homebrew-core/Earthfile b/.release-to-homebrew-core/Earthfile
index dbb9514..a2b8aa4 100644
--- a/.release-to-homebrew-core/Earthfile
+++ b/.release-to-homebrew-core/Earthfile
@@ -1,37 +1,38 @@
-VERSION 0.8
+VERSION 0.7
+PROJECT earthly-technologies/homebrew
 
 deps:
     FROM homebrew/brew:4.0.17 # ubuntu-based
     COPY github-keyscan /home/linuxbrew/.ssh/known_hosts
-    RUN git config --global user.email "webmaster@earthbuild.dev" && \
-        git config --global user.name "earthbuildci"
+    RUN git config --global user.email "github-service@earthly.dev" && \
+        git config --global user.name "Little Red Corvette"
 
 open-homebrew-core-pr:
     FROM +deps
 
     # do the initial setup and fetch (which can be cached)
     WORKDIR /home/linuxbrew
-    RUN --mount type=secret,id=github/earthbuildci/id_rsa,target=.ssh/id_rsa \
+    RUN --mount type=secret,id=github/littleredcorvette/id_rsa,target=.ssh/id_rsa \
         eval "$(ssh-agent)" && \
         cat .ssh/id_rsa | ssh-add - && \
         git init homebrew-core && \
         cd homebrew-core && \
         git remote add Homebrew git@github.com:Homebrew/homebrew-core.git && \
-        git remote add earthbuild git@github.com:EarthBuild/homebrew-core.git && \
+        git remote add littleredcorvette git@github.com:littleredcorvette/homebrew-core.git && \
         echo "doing initial fetch" && \
         git fetch Homebrew
 
-    # the brew bump tool requires that EarthBuild's fork of homebrew-core be updated to match the upstream master
+    # the brew bump tool requires that littleredcorvette's fork of homebrew-core be updated to match the upstream master
     # otherwise, a merge-conflict will prevent the PR from being accepted.
     WORKDIR /home/linuxbrew/homebrew-core
     RUN --no-cache \
-        --mount type=secret,id=github/earthbuildci/id_rsa,target=.ssh/id_rsa \
-        --secret HOMEBREW_GITHUB_API_TOKEN=github/earthbuildci/homebrew-core-classic-token \
+        --mount type=secret,id=github/littleredcorvette/id_rsa,target=.ssh/id_rsa \
+        --secret HOMEBREW_GITHUB_API_TOKEN=github/littleredcorvette/homebrew-core-classic-token \
         eval "$(ssh-agent)" && \
         cat .ssh/id_rsa | ssh-add - && \
         echo "doing fetch" && \
         git fetch Homebrew && \
         echo "doing push" && \
-        git push earthbuild Homebrew/master:master && \
+        git push littleredcorvette Homebrew/master:master && \
         echo "doing bump" && \
-        brew bump earth --open-pr
+        brew bump earthly --open-pr

From bfcd527562b768bdcfdf509321fc3b10a0c68bdb Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 18:23:48 +0100
Subject: [PATCH 30/31] chore: tidy

---
 .gitignore | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 393b62a..2211df6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1 @@
 *.txt
-earthbuild*.json
-earthbuild*.tar.gz
-bottles
\ No newline at end of file

From 8cd4d9779d911af64a881ff8894c8b0a558d9ed1 Mon Sep 17 00:00:00 2001
From: Janis Horsts <janis.horsts@gmail.com>
Date: Thu, 2 Jul 2026 18:25:45 +0100
Subject: [PATCH 31/31] chore: tidy

---
 .github/workflows/ci.yaml      | 5 +++--
 .github/workflows/release.yaml | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0d16210..2d59de3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -3,12 +3,13 @@ name: CI
 on:
   pull_request:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   check:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e1043f8..4d549d9 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -5,11 +5,12 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
+permissions: {}
 
 jobs:
   update-sha:
+    permissions:
+      contents: write
     runs-on: ubuntu-24.04-arm
     if: github.actor == 'renovate[bot]' && startsWith(github.head_ref, 'release-v')
     steps: