fix: use authenticated Homebrew tap checkout - #17
Merged
Conversation
📝 WalkthroughWalkthroughThe Homebrew updater now requires an existing tap checkout from ChangesHomebrew tap update
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant update_homebrew_tap.py
participant ExistingTapCheckout
participant Git
update_homebrew_tap.py->>ExistingTapCheckout: Select --tap-directory or X52_HOMEBREW_TAP_DIRECTORY
update_homebrew_tap.py->>Git: Look up branch and fetch
update_homebrew_tap.py->>Git: Push with --set-upstream
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
robjtede
force-pushed
the
fix/homebrew-app-token-http-auth
branch
from
August 10, 2026 02:10
bc6eb5a to
e459e92
Compare
robjtede
changed the title
robjtede
marked this pull request as ready for review
August 10, 2026 02:13
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@release-tools/update-homebrew-tap.py`:
- Around line 288-290: Update the existing-branch fetch logic in
release-tools/update-homebrew-tap.py lines 288-290 to explicitly create or
update the origin/<branch> remote-tracking ref before the later git switch
--track operation, rather than relying on FETCH_HEAD. Apply the same
remote-tracking-ref fix in release-tools/test.bash lines 292-296; both sites
must ensure origin/<branch> is available after fetching.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b59a6140-00f6-420e-be3f-a413d2c5ef2f
📒 Files selected for processing (2)
release-tools/test.bashrelease-tools/update-homebrew-tap.py
Comment on lines
+288
to
+290
| if run(git, "-C", str(tap_directory), "ls-remote", "--exit-code", "--heads", "origin", branch, check=False).returncode == 0: | ||
| log(f"Reusing tap branch {branch}") | ||
| run_authenticated_git(git, gh, "-C", str(tap_directory), "fetch", "origin", branch) | ||
| run(git, "-C", str(tap_directory), "fetch", "origin", branch) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
root="$(mktemp -d)"
trap 'rm -rf "$root"' EXIT
git init --bare "$root/origin.git"
git init -b main "$root/source"
git -C "$root/source" config user.name test
git -C "$root/source" config user.email test@example.invalid
git -C "$root/source" commit --allow-empty -m initial
git -C "$root/source" branch release/test
git -C "$root/source" remote add origin "$root/origin.git"
git -C "$root/source" push origin main release/test
git clone --single-branch --branch main "$root/origin.git" "$root/checkout"
git -C "$root/checkout" fetch origin release/test
if git -C "$root/checkout" show-ref --verify --quiet refs/remotes/origin/release/test; then
echo "Unexpected remote-tracking ref" >&2
exit 1
fi
if git -C "$root/checkout" switch --track origin/release/test; then
echo "Expected switch to fail without origin/release/test" >&2
exit 1
fiRepository: x52dev/nix
Length of output: 1187
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the relevant code and fake Git command behavior enough to determine
# whether `git fetch origin <branch>` currently creates `refs/remotes/origin/<branch>`.
printf '--- release-tools/update-homebrew-tap.py relevant lines ---\n'
sed -n '250,315p' release-tools/update-homebrew-tap.py
printf '\n--- release-tools/test.bash relevant lines ---\n'
sed -n '260,310p' release-tools/test.bash
printf '\n--- fake-git command wrapper (if any) ---\n'
rg -n "real_git|git|update-homebrew-tap|switch --track|fetch origin|refs/remotes/origin" release-tools -S
printf '\n--- git version ---\n'
git --versionRepository: x52dev/nix
Length of output: 239
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- release-tools/update-homebrew-tap.py relevant lines ---'
sed -n '250,315p' release-tools/update-homebrew-tap.py
printf '%s\n' ''
printf '%s\n' '--- release-tools/test.bash relevant lines ---'
sed -n '260,310p' release-tools/test.bash
printf '%s\n' ''
printf '%s\n' '--- relevant searches ---'
rg -n "real_git|git|update-homebrew-tap|switch --track|fetch origin|refs/remotes/origin|ls-remote|push" release-tools -S || true
printf '%s\n' ''
printf '%s\n' '--- git version ---'
git --versionRepository: x52dev/nix
Length of output: 16187
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- release-tools/test.bash fake git wrapper ---'
sed -n '140,185p' release-tools/test.bash
printf '%s\n' ''
printf '%s\n' '--- behavioral probe for git fetch explicit source-only refspec ---'
root="$(mktemp -d)"
trap 'rm -rf "$root"' EXIT
git init --bare "$root/origin.git"
git init -b main "$root/source"
git -C "$root/source" config user.name test
git -C "$root/source" config user.email test@example.invalid
git -C "$root/source" commit --allow-empty -m initial
git -C "$root/source" branch release/test
git -C "$root/source" remote add origin "$root/origin.git"
git -C "$root/source" push origin main release/test
git clone --single-branch --branch main "$root/origin.git" "$root/checkout"
git -C "$root/checkout" fetch origin release/test
printf '%s\n' 'remote-tracking ref exists:'
git -C "$root/checkout" show-ref --verify --quiet refs/remotes/origin/release/test && printf 'yes\n' || printf 'no\n'
printf '%s\n' 'FETCH_HEAD:'
git -C "$root/checkout" show-ref --verify --quiet FETCH_HEAD && printf 'yes\n' || printf 'no\n'
set +e
git -C "$root/checkout" switch --track origin/release/test
rc=$?
printf '%s\n' "switch --track origin/release/test exit code: $rc"
set -eRepository: x52dev/nix
Length of output: 2810
Create the remote-tracking ref before tracking it.
git fetch origin <branch> stores the result in FETCH_HEAD when no remote tracking refspec exists, so git switch --track origin/<branch> fails with invalid reference: origin/<branch>.
Proposed fix
- run(git, "-C", str(tap_directory), "fetch", "origin", branch)
+ run(
+ git,
+ "-C",
+ str(tap_directory),
+ "fetch",
+ "origin",
+ f"refs/heads/{branch}:refs/remotes/origin/{branch}",
+ )📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| if run(git, "-C", str(tap_directory), "ls-remote", "--exit-code", "--heads", "origin", branch, check=False).returncode == 0: | |
| log(f"Reusing tap branch {branch}") | |
| run_authenticated_git(git, gh, "-C", str(tap_directory), "fetch", "origin", branch) | |
| run(git, "-C", str(tap_directory), "fetch", "origin", branch) | |
| if run(git, "-C", str(tap_directory), "ls-remote", "--exit-code", "--heads", "origin", branch, check=False).returncode == 0: | |
| log(f"Reusing tap branch {branch}") | |
| run( | |
| git, | |
| "-C", | |
| str(tap_directory), | |
| "fetch", | |
| "origin", | |
| f"refs/heads/{branch}:refs/remotes/origin/{branch}", | |
| ) |
📍 Affects 2 files
release-tools/update-homebrew-tap.py#L288-L290(this comment)release-tools/test.bash#L292-L296
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@release-tools/update-homebrew-tap.py` around lines 288 - 290, Update the
existing-branch fetch logic in release-tools/update-homebrew-tap.py lines
288-290 to explicitly create or update the origin/<branch> remote-tracking ref
before the later git switch --track operation, rather than relying on
FETCH_HEAD. Apply the same remote-tracking-ref fix in release-tools/test.bash
lines 292-296; both sites must ensure origin/<branch> is available after
fetching.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Homebrew updater now requires a caller-provided tap checkout and uses ordinary Git commands inside it. Authentication is owned by the workflow that prepared the checkout, which lets consumers pass a scoped GitHub App token through
actions/checkoutinstead of duplicating its credential handling.--tap-directoryis now a documented option and can still be supplied throughX52_HOMEBREW_TAP_DIRECTORY. The updater fails early when no checkout is provided. The fixture verifies plain Git fetch and push commands and covers the missing-checkout error.Validation:
just check.Summary by CodeRabbit