task: Automate external distribution repo publishing [202605012125-PXYEPC]

.agentplane/tasks/202605012125-PXYEPC/README.md

@@ -0,0 +1,138 @@
+---
+id: "202605012125-PXYEPC"
+title: "Automate external distribution repo publishing"
+status: "DOING"
+priority: "high"
+owner: "CODER"
+revision: 5
+origin:
+  system: "manual"
+depends_on: []
+tags:
+  - "ci"
+  - "release"
+  - "workflow"
+verify: []
+plan_approval:
+  state: "approved"
+  updated_at: "2026-05-01T21:26:03.962Z"
+  updated_by: "ORCHESTRATOR"
+  note: null
+verification:
+  state: "ok"
+  updated_at: "2026-05-01T21:31:43.594Z"
+  updated_by: "CODER"
+  note: "External distribution publishing automation verified."
+commit: null
+comments:
+  -
+    author: "CODER"
+    body: "Start: add automated external distribution repo publication for release modules."
+events:
+  -
+    type: "status"
+    at: "2026-05-01T21:26:16.509Z"
+    author: "CODER"
+    from: "TODO"
+    to: "DOING"
+    note: "Start: add automated external distribution repo publication for release modules."
+  -
+    type: "verify"
+    at: "2026-05-01T21:31:43.594Z"
+    author: "CODER"
+    state: "ok"
+    note: "External distribution publishing automation verified."
+doc_version: 3
+doc_updated_at: "2026-05-01T21:31:43.601Z"
+doc_updated_by: "CODER"
+description: "Publish Homebrew, Scoop, and setup-agentplane outputs to their external repositories from the release workflow when credentials are configured."
+sections:
+  Summary: |-
+    Automate external distribution repo publishing
+
+    Publish Homebrew, Scoop, and setup-agentplane outputs to their external repositories from the release workflow when credentials are configured.
+  Scope: |-
+    - In scope: Publish Homebrew, Scoop, and setup-agentplane outputs to their external repositories from the release workflow when credentials are configured.
+    - Out of scope: unrelated refactors not required for "Automate external distribution repo publishing".
+  Plan: |-
+    1. Inspect generated external distribution artifacts and current publish workflow boundaries.
+    2. Add a reusable script that publishes generated files into an external repo branch and opens or updates a PR with the configured token.
+    3. Wire Homebrew, Scoop, and setup-agentplane modules into publish.yml after artifact rendering, preserving skipped behavior when credentials are absent.
+    4. Add workflow/script contract tests for token usage, target paths, and evidence output.
+    5. Run targeted release workflow tests plus lint/routing/doctor and merge through branch_pr.
+  Verify Steps: |-
+    1. Review the requested outcome for "Automate external distribution repo publishing". Expected: the visible result matches ## Summary and stays inside approved scope.
+    2. Run the most relevant validation step for this task. Expected: it succeeds without unexpected regressions in touched behavior.
+    3. Compare the final result against ## Scope and record any residual follow-up in ## Findings. Expected: open edges are explicit rather than implicit.
+  Verification: |-
+    <!-- BEGIN VERIFICATION RESULTS -->
+    ### 2026-05-01T21:31:43.594Z — VERIFY — ok
+
+    By: CODER
+
+    Note: External distribution publishing automation verified.
+
+    VerifyStepsRef: doc_version=3, doc_updated_at=2026-05-01T21:26:16.509Z, excerpt_hash=sha256:17a734080f808ebbaa3cb657f3f59cb50c25ab7a76376dcfe3778d43c1e33493
+
+    <!-- END VERIFICATION RESULTS -->
+  Rollback Plan: |-
+    - Revert task-related commit(s).
+    - Re-run required checks to confirm rollback safety.
+  Findings: |-
+    - Observation: Added publish-external-distribution script, wired Homebrew/Scoop/setup-agentplane PR publication steps after GitHub Release creation, and covered workflow/script contracts. Checks: bun test packages/agentplane/src/commands/release/publish-workflow-contract.test.ts packages/agentplane/src/commands/release/publish-external-distribution-script.test.ts; node scripts/publish-external-distribution.mjs --help; git diff --check; node .agentplane/policy/check-routing.mjs; bun run workflows:command-check; bun run lint:core; agentplane doctor.
+      Impact: Future release publish jobs can open/update external distribution PRs when HOMEBREW_TAP_TOKEN, SCOOP_BUCKET_TOKEN, and SETUP_AGENTPLANE_TOKEN are configured, while preserving skipped_missing_credentials evidence when they are absent.
+      Resolution: Ready for branch_pr integration.
+      Promotion: incident-candidate
+      Fixability: external
+id_source: "generated"
+---
+## Summary
+
+Automate external distribution repo publishing
+
+Publish Homebrew, Scoop, and setup-agentplane outputs to their external repositories from the release workflow when credentials are configured.
+
+## Scope
+
+- In scope: Publish Homebrew, Scoop, and setup-agentplane outputs to their external repositories from the release workflow when credentials are configured.
+- Out of scope: unrelated refactors not required for "Automate external distribution repo publishing".
+
+## Plan
+
+1. Inspect generated external distribution artifacts and current publish workflow boundaries.
+2. Add a reusable script that publishes generated files into an external repo branch and opens or updates a PR with the configured token.
+3. Wire Homebrew, Scoop, and setup-agentplane modules into publish.yml after artifact rendering, preserving skipped behavior when credentials are absent.
+4. Add workflow/script contract tests for token usage, target paths, and evidence output.
+5. Run targeted release workflow tests plus lint/routing/doctor and merge through branch_pr.
+
+## Verify Steps
+
+1. Review the requested outcome for "Automate external distribution repo publishing". Expected: the visible result matches ## Summary and stays inside approved scope.
+2. Run the most relevant validation step for this task. Expected: it succeeds without unexpected regressions in touched behavior.
+3. Compare the final result against ## Scope and record any residual follow-up in ## Findings. Expected: open edges are explicit rather than implicit.
+
+## Verification
+
+<!-- BEGIN VERIFICATION RESULTS -->
+### 2026-05-01T21:31:43.594Z — VERIFY — ok
+
+By: CODER
+
+Note: External distribution publishing automation verified.
+
+VerifyStepsRef: doc_version=3, doc_updated_at=2026-05-01T21:26:16.509Z, excerpt_hash=sha256:17a734080f808ebbaa3cb657f3f59cb50c25ab7a76376dcfe3778d43c1e33493
+
+<!-- END VERIFICATION RESULTS -->
+
+## Rollback Plan
+
+- Revert task-related commit(s).
+- Re-run required checks to confirm rollback safety.
+
+## Findings
+
+- Observation: Added publish-external-distribution script, wired Homebrew/Scoop/setup-agentplane PR publication steps after GitHub Release creation, and covered workflow/script contracts. Checks: bun test packages/agentplane/src/commands/release/publish-workflow-contract.test.ts packages/agentplane/src/commands/release/publish-external-distribution-script.test.ts; node scripts/publish-external-distribution.mjs --help; git diff --check; node .agentplane/policy/check-routing.mjs; bun run workflows:command-check; bun run lint:core; agentplane doctor.
+  Impact: Future release publish jobs can open/update external distribution PRs when HOMEBREW_TAP_TOKEN, SCOOP_BUCKET_TOKEN, and SETUP_AGENTPLANE_TOKEN are configured, while preserving skipped_missing_credentials evidence when they are absent.
+  Resolution: Ready for branch_pr integration.
+  Promotion: incident-candidate
+  Fixability: external

.agentplane/tasks/202605012125-PXYEPC/pr/diffstat.txt

@@ -0,0 +1,5 @@
+ .github/workflows/publish.yml                      |  49 ++++
+ .../publish-external-distribution-script.test.ts   | 121 ++++++++++
+ .../release/publish-workflow-contract.test.ts      |  31 +++
+ scripts/publish-external-distribution.mjs          | 251 +++++++++++++++++++++
+ 4 files changed, 452 insertions(+)

.agentplane/tasks/202605012125-PXYEPC/pr/github-body.md

@@ -0,0 +1,40 @@
+Task: `202605012125-PXYEPC`
+Title: Automate external distribution repo publishing
+
+## Summary
+
+Automate external distribution repo publishing
+
+Publish Homebrew, Scoop, and setup-agentplane outputs to their external repositories from the release workflow when credentials are configured.
+
+## Scope
+
+- In scope: Publish Homebrew, Scoop, and setup-agentplane outputs to their external repositories from the release workflow when credentials are configured.
+- Out of scope: unrelated refactors not required for "Automate external distribution repo publishing".
+
+## Verification
+
+- State: ok
+- Note: External distribution publishing automation verified.
+- Full verification checklist lives in local review.md.
+
+## Handoff Notes
+
+- No handoff notes recorded yet. Use `agentplane pr note ...` to append one.
+
+<details>
+<summary>Raw evidence</summary>
+
+- Updated: 2026-05-01T21:31:57.672Z
+- Branch: task/202605012125-PXYEPC/external-distribution-publish
+- Head: 9b6156d62117
+
+```text
+ .github/workflows/publish.yml                      |  49 ++++
+ .../publish-external-distribution-script.test.ts   | 121 ++++++++++
+ .../release/publish-workflow-contract.test.ts      |  31 +++
+ scripts/publish-external-distribution.mjs          | 251 +++++++++++++++++++++
+ 4 files changed, 452 insertions(+)
+```
+
+</details>

.agentplane/tasks/202605012125-PXYEPC/pr/github-title.txt

@@ -0,0 +1 @@
+task: Automate external distribution repo publishing [202605012125-PXYEPC]

.agentplane/tasks/202605012125-PXYEPC/pr/meta.json

@@ -0,0 +1,14 @@
+{
+  "base": "main",
+  "branch": "task/202605012125-PXYEPC/external-distribution-publish",
+  "created_at": "2026-05-01T21:26:16.551Z",
+  "head_sha": "9b6156d62117ba0b48e3adde5f1a35613d8be308",
+  "last_verified_at": "2026-05-01T21:31:43.594Z",
+  "last_verified_sha": "0a141dfaeb7908364fd189895ff84a60f0c22cf2",
+  "schema_version": 1,
+  "task_id": "202605012125-PXYEPC",
+  "updated_at": "2026-05-01T21:31:57.672Z",
+  "verify": {
+    "status": "pass"
+  }
+}

.agentplane/tasks/202605012125-PXYEPC/pr/review.md

@@ -0,0 +1,61 @@
+# PR Review
+
+Created: 2026-05-01T21:26:16.551Z
+Branch: task/202605012125-PXYEPC/external-distribution-publish
+
+## Summary
+
+Automate external distribution repo publishing
+
+Publish Homebrew, Scoop, and setup-agentplane outputs to their external repositories from the release workflow when credentials are configured.
+
+## Scope
+
+- In scope: Publish Homebrew, Scoop, and setup-agentplane outputs to their external repositories from the release workflow when credentials are configured.
+- Out of scope: unrelated refactors not required for "Automate external distribution repo publishing".
+
+## Verification
+
+### Plan
+
+1. Review the requested outcome for "Automate external distribution repo publishing". Expected: the visible result matches ## Summary and stays inside approved scope.
+2. Run the most relevant validation step for this task. Expected: it succeeds without unexpected regressions in touched behavior.
+3. Compare the final result against ## Scope and record any residual follow-up in ## Findings. Expected: open edges are explicit rather than implicit.
+
+### Current Status
+
+- State: ok
+- Note: External distribution publishing automation verified.
+
+## Risks
+
+- Risk level: not recorded
+- Breaking change: no
+
+### Rollback
+
+- Revert task-related commit(s).
+- Re-run required checks to confirm rollback safety.
+
+## Handoff Notes
+
+- No handoff notes recorded yet. Use `agentplane pr note ...` to append one.
+
+<!-- BEGIN AUTO SUMMARY -->
+<details>
+<summary>Raw evidence</summary>
+
+- Updated: 2026-05-01T21:31:57.672Z
+- Branch: task/202605012125-PXYEPC/external-distribution-publish
+- Head: 9b6156d62117
+
+```text
+ .github/workflows/publish.yml                      |  49 ++++
+ .../publish-external-distribution-script.test.ts   | 121 ++++++++++
+ .../release/publish-workflow-contract.test.ts      |  31 +++
+ scripts/publish-external-distribution.mjs          | 251 +++++++++++++++++++++
+ 4 files changed, 452 insertions(+)
+```
+
+</details>
+<!-- END AUTO SUMMARY -->

.github/workflows/publish.yml

@@ -391,6 +391,55 @@ jobs:
             .agentplane/.release/publish/distribution/install.ps1
             .agentplane/.release/publish/distribution/SHA256SUMS
             .agentplane/.release/publish/distribution/release-distribution.json
+      - name: Publish Homebrew tap PR
+        shell: bash
+        env:
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN || '' }}
+        run: |
+          set -euo pipefail
+          node scripts/publish-external-distribution.mjs \
+            --module homebrew \
+            --repo basilisk-labs/homebrew-tap \
+            --source .agentplane/.release/publish/homebrew \
+            --copy Formula/agentplane.rb:Formula/agentplane.rb \
+            --version "${{ needs.detect.outputs.version }}" \
+            --tag "${{ needs.detect.outputs.tag }}" \
+            --sha "${{ needs.detect.outputs.sha }}" \
+            --token-env HOMEBREW_TAP_TOKEN \
+            --out .agentplane/.release/publish/homebrew/homebrew-publish-result.json
+      - name: Publish Scoop bucket PR
+        shell: bash
+        env:
+          SCOOP_BUCKET_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN || '' }}
+        run: |
+          set -euo pipefail
+          node scripts/publish-external-distribution.mjs \
+            --module scoop \
+            --repo basilisk-labs/scoop-bucket \
+            --source .agentplane/.release/publish/scoop \
+            --copy agentplane.json:bucket/agentplane.json \
+            --version "${{ needs.detect.outputs.version }}" \
+            --tag "${{ needs.detect.outputs.tag }}" \
+            --sha "${{ needs.detect.outputs.sha }}" \
+            --token-env SCOOP_BUCKET_TOKEN \
+            --out .agentplane/.release/publish/scoop/scoop-publish-result.json
+      - name: Publish setup-agentplane PR
+        shell: bash
+        env:
+          SETUP_AGENTPLANE_TOKEN: ${{ secrets.SETUP_AGENTPLANE_TOKEN || '' }}
+        run: |
+          set -euo pipefail
+          node scripts/publish-external-distribution.mjs \
+            --module setup-agentplane \
+            --repo basilisk-labs/setup-agentplane \
+            --source .agentplane/.release/publish/setup-agentplane \
+            --copy action.yml:action.yml \
+            --copy README.md:README.md \
+            --version "${{ needs.detect.outputs.version }}" \
+            --tag "${{ needs.detect.outputs.tag }}" \
+            --sha "${{ needs.detect.outputs.sha }}" \
+            --token-env SETUP_AGENTPLANE_TOKEN \
+            --out .agentplane/.release/publish/setup-agentplane/setup-agentplane-publish-result.json
       - name: Upload release-distribution artifact
         if: always()
         uses: actions/upload-artifact@v7