From b0059ada8b5311f8fc5dba86df42e54e8d16ffa2 Mon Sep 17 00:00:00 2001 From: Guy J Grigsby Date: Fri, 16 Oct 2026 16:10:21 +0000 Subject: [PATCH 1/3] release: print the installed version in the GNU flag form install.sh called the binary it had just installed as `aperture -version`. gnuForm rewrites that single-dash long form and warns on stderr, so every fresh install ended on a deprecation notice about a flag the user never typed. `--version` works on every release install.sh can install. Pre-0.1.0 binaries parsed flags with the standard library's flag package, which treats one and two leading dashes alike. A scripts test holds the GNU form because no Go test sees the installer's output. --- install.sh | 2 +- scripts/sign_macos_test.go | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/install.sh b/install.sh index b687c1d..83b92e5 100755 --- a/install.sh +++ b/install.sh @@ -81,4 +81,4 @@ fi $sudo mkdir -p "$INSTALL_DIR" $sudo install -m 0755 "$bin" "$INSTALL_DIR/aperture" -echo "==> Installed $("$INSTALL_DIR/aperture" -version | head -1) to $INSTALL_DIR/aperture" +echo "==> Installed $("$INSTALL_DIR/aperture" --version | head -1) to $INSTALL_DIR/aperture" diff --git a/scripts/sign_macos_test.go b/scripts/sign_macos_test.go index 845b27b..9426da0 100644 --- a/scripts/sign_macos_test.go +++ b/scripts/sign_macos_test.go @@ -176,3 +176,20 @@ case "$tool $1" in ;; esac ` + +// install.sh reports the version of what it just installed. It has to use the +// GNU form: the single-dash long form is deprecated, so it both prints a +// deprecation warning on stderr and would greet every fresh install with a +// notice about a flag the user never typed. +func TestInstallScriptReportsVersionInGNUForm(t *testing.T) { + script, err := os.ReadFile("../install.sh") + if err != nil { + t.Fatal(err) + } + if strings.Contains(string(script), " -version") { + t.Error("install.sh calls the installed binary with the deprecated -version form") + } + if !strings.Contains(string(script), `aperture" --version`) { + t.Error("install.sh no longer reports the installed version") + } +} From aba6715fceb8e2b0aeada1f6a89c11f024d204c0 Mon Sep 17 00:00:00 2001 From: Guy J Grigsby Date: Tue, 27 Oct 2026 15:50:44 +0000 Subject: [PATCH 2/3] release: publish the Homebrew formula from goreleaser Hand-editing the tap formula each release means the version and both darwin sha256 values drift from the notarized archives. Goreleaser already has the final archives and hashes at the end of the release job, so it commits the formula straight to the tap's default branch with no PR to merge. The brews section is deprecated in goreleaser v2 in favour of homebrew_casks; revisit if it is removed or if the tap moves to a cask. --- .github/workflows/release.yaml | 2 ++ .goreleaser.yaml | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index e173a9d..d666725 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -49,6 +49,8 @@ jobs: args: release --clean env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # Fine-grained PAT with contents:write on the tap repo; GITHUB_TOKEN is scoped to this repo only. + HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} - name: Tear down signing keychain if: always() diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 93599d1..0693320 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -49,3 +49,21 @@ changelog: - "^docs:" - "^test:" - "^chore:" + +# Pushes the formula straight to the tap's default branch (no PR) once the +# signed archives are uploaded, so the sha256 values are the notarized ones. +brews: + - name: aperture-cli + repository: + owner: tailscale + name: homebrew-tap + token: "{{ .Env.HOMEBREW_TAP_TOKEN }}" + directory: Formula + homepage: https://github.com/tailscale/aperture-cli + description: Agentic coding launcher for Aperture by Tailscale + license: BSD-3-Clause + commit_author: + name: guygrigsby + email: guygrigsby@users.noreply.github.com + test: | + assert_match version.to_s, shell_output("#{bin}/aperture --version") From b53f0e6eeb88b0585ff0c5d1e731f41e76e5a24b Mon Sep 17 00:00:00 2001 From: Guy J Grigsby Date: Tue, 27 Oct 2026 17:14:30 +0000 Subject: [PATCH 3/3] release: authenticate to the tap with a GitHub App token A PAT is tied to one person's account and long-lived, so the release pipeline breaks when they leave and a leaked token stays valid. The App installation token is minted per run, expires within the hour and is scoped to the tap repo only. Commits use the App's bot identity via use_github_app_token. Revisit if the tap moves to a repo the App is not installed on. --- .github/workflows/release.yaml | 13 +++++++++++-- .goreleaser.yaml | 3 +-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index d666725..923a256 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -40,6 +40,15 @@ jobs: APPLE_ID: ${{ secrets.APPLE_ID }} APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }} run: bash scripts/setup-macos-signing.sh + - + name: Mint tap token + id: tap-token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + app-id: ${{ vars.HOMEBREW_TAP_APP_ID }} + private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }} + owner: tailscale + repositories: homebrew-tap - name: Run GoReleaser uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a #v6.4.0 @@ -49,8 +58,8 @@ jobs: args: release --clean env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Fine-grained PAT with contents:write on the tap repo; GITHUB_TOKEN is scoped to this repo only. - HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} + # GITHUB_TOKEN is scoped to this repo only; the tap needs the App token. + HOMEBREW_TAP_TOKEN: ${{ steps.tap-token.outputs.token }} - name: Tear down signing keychain if: always() diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 0693320..1ff0880 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -63,7 +63,6 @@ brews: description: Agentic coding launcher for Aperture by Tailscale license: BSD-3-Clause commit_author: - name: guygrigsby - email: guygrigsby@users.noreply.github.com + use_github_app_token: true test: | assert_match version.to_s, shell_output("#{bin}/aperture --version")