mcpp/.github/workflows/tmp-brew-macos-probe.yml at d0106deea31c24431e0b7b361b6aea032ad600c1 · mcpp-community/mcpp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
name: tmp-brew-macos-probe

# TEMPORARY. Delete before merging.
#
# Round 2 found it. Homebrew 6.0.x gates third-party taps behind explicit
# trust:
#
#   Refusing to load formula mcpp-community/mcpp/mcpp-m from untrusted tap
#   mcpp-community/mcpp.
#   Run `brew trust --formula …` or `brew trust mcpp-community/mcpp`.
#
# macos-14 / 15 / 26 all hit it (Homebrew 6.0.5 / 6.0.12 / 6.0.13). The
# documented one-liner still passes because `brew install <user>/<repo>/<f>`
# on an UNTAPPED repo taps and installs in one go, and Homebrew reads that as
# explicit intent. Everything after the tap exists is refused.
#
# Round 3 answers the two questions that decide the fix:
#   1. WHICH user-facing paths are actually broken (short form, re-running the
#      documented command, `brew upgrade`, the alias)
#   2. Does `brew trust <tap>` actually repair all of them — i.e. is the fix
#      "document one command", or something more
#
# Exit codes are captured before any pipe. Round 1 reported `cmd | tail` and
# read tail's status, which turned a failure into a green line.

on:
  pull_request:
  workflow_dispatch:

jobs:
  brew-trust:
    name: "trust gate ${{ matrix.os }}"
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    continue-on-error: true
    strategy:
      fail-fast: false
      matrix:
        os: [macos-14, macos-26]
    steps:
      - name: Environment
        run: |
          echo "runner: ${{ matrix.os }} | macOS $(sw_vers -productVersion) | $(uname -m)"
          brew --version | head -1
          echo "── does this brew even have \`trust\`? ──"
          brew trust --help 2>&1 | head -25 || echo "(no brew trust subcommand)"

      # ① the documented one-liner on a machine that has never tapped
      - name: "1. documented one-liner (untapped machine)"
        run: |
          set +e
          brew install mcpp-community/mcpp/mcpp-m > s1.log 2>&1
          echo "STEP1_rc=$?"
          tail -5 s1.log

      # ② the SAME documented command again, now that the tap exists. This is
      #    what a user hits on their second machine-state, and what CI would
      #    hit on a warm image.
      - name: "2. documented one-liner AGAIN (tap now present)"
        run: |
          set +e
          brew uninstall --force mcpp-m > /dev/null 2>&1
          brew install mcpp-community/mcpp/mcpp-m > s2.log 2>&1
          echo "STEP2_rc=$?"
          tail -5 s2.log

      # ③ the short form the tap README advertises once tapped
      - name: "3. short form: brew install mcpp-m"
        run: |
          set +e
          brew uninstall --force mcpp-m > /dev/null 2>&1
          brew install mcpp-m > s3.log 2>&1
          echo "STEP3_rc=$?"
          tail -5 s3.log

      # ④ the alias spelling (tap README line 30)
      - name: "4. alias: brew install …/mcpp"
        run: |
          set +e
          brew uninstall --force mcpp-m > /dev/null 2>&1
          brew install mcpp-community/mcpp/mcpp > s4.log 2>&1
          echo "STEP4_rc=$?"
          tail -5 s4.log

      # ⑤ THE FIX, if it is one. Everything below must pass after this.
      - name: "5. brew trust mcpp-community/mcpp"
        run: |
          set +e
          brew trust mcpp-community/mcpp > s5.log 2>&1
          echo "STEP5_rc=$?"
          cat s5.log

      - name: "6. after trust: short form"
        run: |
          set +e
          brew uninstall --force mcpp-m > /dev/null 2>&1
          brew install mcpp-m > s6.log 2>&1
          echo "STEP6_rc=$?"
          tail -5 s6.log

      - name: "7. after trust: alias"
        run: |
          set +e
          brew uninstall --force mcpp-m > /dev/null 2>&1
          brew install mcpp-community/mcpp/mcpp > s7.log 2>&1
          echo "STEP7_rc=$?"
          tail -5 s7.log

      - name: "8. after trust: upgrade path + the binary still works"
        run: |
          set +e
          brew upgrade mcpp-m > s8.log 2>&1
          echo "STEP8_rc=$?"
          tail -5 s8.log
          mcpp --version; echo "VERSION_rc=$?"
          cd "$(mktemp -d)" && mcpp new t > /dev/null 2>&1; echo "NEW_rc=$?"
          cd t && mcpp run > s8run.log 2>&1; echo "RUN_rc=$?"
          tail -6 s8run.log