Skip to content

fix(release): trust homebrew tap before install in test-install #483

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ZdenekSrotyr wants to merge 1 commit into
base: main
Choose a base branch
from
+5 −0
Open

fix(release): trust homebrew tap before install in test-install #483

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/workflows/release-kbagent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -485,6 +485,11 @@ jobs:
docker run --rm -e VERSION homebrew/brew bash -c '
set -e
brew tap keboola/keboola-cli2 https://github.com/keboola/homebrew-keboola-cli2
# brew now refuses to load a formula from a third-party tap until the tap is
# explicitly trusted ("Refusing to load formula ... from untrusted tap ...").
# First observed on the v0.66.1 run (github.com/keboola/cli, release-kbagent
# #29430278032) -- this is a real end-user install step too, not CI-only.
brew trust keboola/keboola-cli2

@devin-ai-integration devin-ai-integration Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Validity of brew trust subcommand cannot be verified from repo context

The added brew trust keboola/keboola-cli2 at .github/workflows/release-kbagent.yml:492 is not a Homebrew subcommand that existed in widely-known Homebrew versions (up to ~early 2025). The homebrew/brew Docker image at line 485 is unpinned (uses latest), so the exact Homebrew version depends on when the workflow runs. The PR comment references a real CI failure on v0.66.1 (run #29430278032) with the error "Refusing to load formula ... from untrusted tap", which suggests this is a newer Homebrew feature. If brew trust does not exist in the image version pulled at runtime, set -e (line 486) will cause the entire Homebrew test leg to fail — but since this is a smoke-test step (not a publish step), the blast radius is limited to a red CI check rather than a broken release. Worth confirming that brew trust is the correct invocation (vs. e.g. brew tap --trust or another syntax) by checking Homebrew's current docs or the referenced CI run logs.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

brew install keboola-cli2
kbagent --version | grep -q "${VERSION}"
'