ci: add formula validation, gitleaks, and dependabot - #3
Merged
Conversation
Add a minimal CI baseline to the previously workflow-less tap.
ci.yml runs on push/PR to main: brew style plus brew audit --strict on the
tapped formula (ubuntu, Homebrew/actions/setup-homebrew). --online is dropped
to stay reliable on this machine-bumped tap; the rationale is in the workflow.
gitleaks.yml runs a full-history secret scan with the open-source binary,
matching the sibling repos, backed by a minimal .gitleaks.toml that extends the
default ruleset.
dependabot.yml enables weekly github-actions updates.
The formula is also fixed so it passes the new audit and, more importantly, so
it installs at all. version carried a leading 'v' ("v2.3.0"), which the strict
audit rejects and which the download-URL template ("download/v#{version}/")
turns into a broken ".../download/vv2.3.0/..." returning HTTP 404. Dropping the
'v' restores the correct URL and switches livecheck to the idiomatic
url :stable plus strategy :github_latest.
The elnora-cli release bot writes version "vX.Y.Z" on each bump, so the next
automated bump reintroduces both problems. The durable fix belongs in the CLI
release automation (emit version "X.Y.Z"); until then CI flags it on main
without blocking the bot's push.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgHf9qf7dcDzguCkqGRJzz
`brew tap <name> <local-path>` fails on the runner with a tap remote mismatch because Homebrew already maps elnora-ai/cli to the GitHub remote. Instead, copy the checkout into Homebrew's tap path (its origin already matches) and audit the formula by name. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgHf9qf7dcDzguCkqGRJzz
setup-homebrew already symlinks the checkout in as the elnora-ai/cli tap and trusts it, so no manual tap or copy is needed. Drop that step and audit the formula directly by name. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgHf9qf7dcDzguCkqGRJzz
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the tap to a minimal CI baseline. It previously had no workflows.
What this adds
.github/workflows/ci.yml— on push/PR tomain, runsbrew styleandbrew audit --strictagainst the tapped formula on an ubuntu runner (Homebrew/actions/setup-homebrew).--onlineis intentionally dropped (rationale inline): it would fetch every release URL and the homepage on each run, which is rate-limit-prone on a tap that is machine-bumped on every CLI release. Checksums are pinned in the formula, and the strict offline audit still catches the failure that matters here..github/workflows/gitleaks.yml— full-history secret scan using the open-source gitleaks binary, matching the sibling repos, backed by a minimal.gitleaks.tomlthat extends the default ruleset..github/dependabot.yml— weeklygithub-actionsupdates.This runs on push so the bot's bump commits are validated, but the tap has no branch protection, so CI is informational on
mainand cannot block the bot.Formula fix (required for the audit to pass, and it fixes a live install break)
versioncarried a leadingv("v2.3.0"). The strict audit rejects that, and the download-URL templatedownload/v#{version}/turned it into.../download/vv2.3.0/..., which returns HTTP 404 — sobrew installfrom this tap was broken. Dropping thev(version "2.3.0") restores the correctdownload/v2.3.0/URL (HTTP 200) and clears the audit. Livecheck is switched to the idiomaticurl :stable+strategy :github_latest.Verification (local)
brew style Formula/*.rb— cleanbrew audit --strict elnora-ai/cli/elnora— clean (and confirmed it fails on the pre-fix leading-v)v2.3.0→ 200, pre-fixvv2.3.0→ 404🤖 Generated with Claude Code