From 46dcfe0d38ad98bdb877bfbd7f06ad75dbeb2379 Mon Sep 17 00:00:00 2001 From: oratis Date: Thu, 2 Jul 2026 14:33:49 +0800 Subject: [PATCH] docs(publish): add no-clone gh-api Homebrew bump (used for v0.14.0) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The manual fallback already documented a clone→edit→push flow; add the API-only variant used to ship v0.14.0 (the release-homebrew workflow failed on an unset HOMEBREW_TAP_TOKEN secret). Requires gh authed with write to oratis/homebrew-tap. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/PUBLISH.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/PUBLISH.md b/docs/PUBLISH.md index fc25cf1..9d015c6 100644 --- a/docs/PUBLISH.md +++ b/docs/PUBLISH.md @@ -200,6 +200,22 @@ git commit -m "lisa ${VERSION}" git push ``` +**No-clone alternative** (used for v0.14.0 — edits `Formula/lisa.rb` straight over the +GitHub API, so you don't need a local checkout of `homebrew-tap`; `gh` must be authed +with write access to the tap repo). Do this only *after* `npm publish` lands the tarball: + +```sh +VERSION=$(node -p 'require("./package.json").version') +SHA=$(curl -sL "https://registry.npmjs.org/@oratis/lisa/-/lisa-${VERSION}.tgz" | shasum -a 256 | cut -d' ' -f1) +BLOB=$(gh api repos/oratis/homebrew-tap/contents/Formula/lisa.rb --jq .sha) +NEW=$(gh api repos/oratis/homebrew-tap/contents/Formula/lisa.rb --jq .content | base64 -d \ + | sed -E "s#lisa-[0-9][0-9.]*\.tgz#lisa-${VERSION}.tgz#g; s#sha256 \"[a-f0-9]{64}\"#sha256 \"${SHA}\"#" | base64) +gh api -X PUT repos/oratis/homebrew-tap/contents/Formula/lisa.rb \ + -f message="lisa ${VERSION}" -f content="$NEW" -f sha="$BLOB" +# Verify the pinned hash matches the live tarball before trusting it: +gh api repos/oratis/homebrew-tap/contents/Formula/lisa.rb --jq .content | base64 -d | grep -E 'url "|sha256 "' +``` + Users running `brew update` (next time their auto-update fires) will see the new version. ### Install path for users