Repository navigation
ci(release): merge the Homebrew bump PR as soon as it opens - #135
Merged
Merged
Conversation
dg-coreylweathers
changed the title
dg-coreylweathers
force-pushed
the
fix/homebrew-bump-automerge
branch
2 times, most recently
from
October 12, 2026 12:51
878d858 to
070680b
Compare
The formula is generated from PyPI metadata and the tap has no checks or reviewers, so the open PR only delayed Homebrew users: the 0.3.1, 0.3.2 and 0.3.3 bumps all sat unmerged while the tap served 0.2.26. The merged PR remains the audit trail. GitHub computes mergeability after a PR is created and gh does not wait for it, so the merge is attempted up to five times and the job fails loudly if it still cannot merge.
dg-coreylweathers
force-pushed
the
fix/homebrew-bump-automerge
branch
from
October 12, 2026 12:55
070680b to
ca68f6f
Compare
…e-run Serialize the bump-brew-formula job, skip unless the new version is strictly newer than what the tap serves, and fail on unexpected version strings or a regenerated formula that does not match the tag. Syntax-check the formula with ruby -c, force-push the bump branch, reuse an existing open PR only when it is a same-repo PR from the PAT owner, treat an already-merged PR as success in the merge retry loop, and best-effort close older bump PRs superseded by this one.
dg-coreylweathers
requested review from
GregHolmes and
deepgram-kiley
as code owners
November 12, 2026 16:44
dg-coreylweathers
added a commit
that referenced
this pull request
Nov 12, 2026
Bring the 0.4.1 release into 0.5.0: the @deepgram/cli npm launcher (#146), the Homebrew bump that merges itself (#135), and the 0.4.1 fixes (#159). How the two sides fit: - src/deepctl/main.py is 0.5.0's. Its main() reads and removes DEEPCTL_LAUNCHER before deepctl_core is imported and keeps the value in LAUNCHER / LAUNCHER_CAPTURED, which deepctl_core._launcher (from 0.4.1) and deepctl_cmd_update.channel both read. Crash tracebacks still never show frame locals (install(show_locals=False), now installed lazily). - deepctl-cmd-update is 0.5.0's, which already detects npm and npx installs; 0.4.1's duplicate detection there is dropped. The plugin command keeps 0.4.1's isolated venv for npm installs, and the skills prompt keeps 0.4.1's rule that an npm launch is not one-shot. - Versions are lockstep at 0.4.1 (what main last released); the plugin example stays at its released 0.1.13. release-please now also moves npm/package.json with the root version. - scripts/check_release_bumps.py and its release-bump-gate are removed: with lockstep versions every release bumps every package, so no package's code can reach PyPI under an already-published version. The build job checks lockstep versions once more before publishing. - release.yml keeps 0.5.0's re-pin jobs, trusted publishing and tag recovery, and adds 0.4.1's pinned build tools, fresh-venv PyPI check, Homebrew auto-merge and publish-npm. test.yml adds the three npm launcher jobs to All checks. - conftest.py forgets the launcher main() captured between tests, so a test that ran main() no longer decides what later launcher tests see.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
After the release workflow opens the "Bump deepctl to X" PR on deepgram/homebrew-tap, it now merges that PR in the same step, using the same
CLI_TAP_SYNC_PATthat pushed the branch. The step is also made safe to re-run and safe against two releases racing on the tap.Why
The tap has no branch protection, no checks and no reviewers, so an open bump PR only delays Homebrew users. The 0.3.1, 0.3.2 and 0.3.3 bumps (homebrew-tap #9, #10, #11) all sat unmerged while the tap's formula stayed at 0.2.26. #11 was merged by hand; this keeps that from happening again.
The formula is generated from PyPI metadata by
scripts/bump_brew_formula.py, so there is nothing for a reviewer to judge in the tap PR itself. The merged PR stays as the audit trail, and a broken formula is fixed by editing the template, as the generated PR body already says.What changed (
bump-brew-formulajob only)concurrency: {group: homebrew-tap-bump, cancel-in-progress: false}, so two root releases in quick succession bump the tap one after the other instead of both reading the same starting formula.git show HEAD:Formula/deepgram.rb(the regenerate step has already overwritten the working tree, so HEAD is the tap's state) and the regenerated version from the working tree.X.Y.Zversion, or if the regenerated formula does not point at the tagged version.ruby -c Formula/deepgram.rbruns before the commit. This is a Ruby syntax check only: it catches a broken template or a mangled resource block, not a wrong sha256 or a failingbrew install.--force, so a re-run replaces a branch left behind by an earlier failed attempt. If an open PR for that branch already exists, it is reused instead ofgh pr createfailing on the duplicate.isCrossRepository == false) authored by the PAT's own login. The tap is public, so anyone can open a fork PR whose head branch is namedbump-deepctl-X; an unfiltered lookup could have merged it with the PAT.https://github.com/deepgram/homebrew-tap/pull/Nor the job fails.gh pr merge <url> --merge --delete-branchis tried up to five times with a short backoff. If a merge attempt fails but the PR's state isMERGED(merged by hand mid-loop, or merged and then the branch delete failed), that counts as success. After five failed attempts the job fails with an error annotation.bump-deepctl-*PRs that are same-repo, authored by the PAT owner, and for a strictly older plainX.Y.Zversion are closed with their branch deleted and a comment linking the superseding PR. This is best effort: listing or closing failures emit a warning and never fail the job.Checked
bash -npasses on the extracted step script..github/workflows/release.yml. The one intentional single-quoted jq$logincarries ashellcheck disable=SC2016with a comment.bump-brew-formulais modified.ci:so release-please adds no changelog line and bumps no version for CI plumbing (precedent: ci(release): gate mark-latest and web deploy on PyPI publish #66, ci(release): switch PyPI watch to JSON API instead of pip index #70).🤖 Generated with Claude Code