@pubm/plugin-brew 0.4.7 → 0.4.9

package/dist/brew-core.d.ts

@@ -1,3 +1,3 @@
-import type { PubmPlugin } from "@pubm/core";
+import { type PubmPlugin } from "@pubm/core";
 import type { BrewCoreOptions } from "./types.js";
 export declare function brewCore(options: BrewCoreOptions): PubmPlugin;

package/dist/brew-tap.d.ts

@@ -1,3 +1,3 @@
-import type { PubmPlugin } from "@pubm/core";
+import { type PubmPlugin } from "@pubm/core";
 import type { BrewTapOptions } from "./types.js";
 export declare function brewTap(options: BrewTapOptions): PubmPlugin;

package/dist/index.js

@@ -5,6 +5,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { resolvePhases } from "@pubm/core";
 
 // src/formula.ts
 function toClassName(name) {
@@ -204,8 +205,64 @@ function brewCore(options) {
         ]
       }
     ],
+    credentials: (ctx) => {
+      if (ctx.options.mode !== "ci")
+        return [];
+      return [
+        {
+          key: "brew-github-token",
+          env: "PUBM_BREW_GITHUB_TOKEN",
+          label: "GitHub PAT for Homebrew (homebrew-core)",
+          tokenUrl: "https://github.com/settings/tokens/new?scopes=repo,workflow",
+          tokenUrlLabel: "github.com",
+          ghSecretName: "PUBM_BREW_GITHUB_TOKEN",
+          required: true
+        }
+      ];
+    },
+    checks: (ctx) => {
+      const phases = resolvePhases(ctx.options);
+      if (!phases.includes("publish") && ctx.options.mode !== "ci")
+        return [];
+      if (ctx.options.mode === "ci") {
+        return [
+          {
+            title: "Checking Homebrew core token availability",
+            phase: "conditions",
+            task: async (ctx2, task) => {
+              const token = ctx2.runtime.pluginTokens?.["brew-github-token"];
+              if (!token) {
+                throw new Error("PUBM_BREW_GITHUB_TOKEN is required for homebrew-core publishing.");
+              }
+              task.output = "Homebrew core token verified";
+            }
+          }
+        ];
+      }
+      return [
+        {
+          title: "Checking GitHub CLI access for homebrew-core",
+          phase: "conditions",
+          task: async (_ctx, task) => {
+            const { execFileSync } = await import("node:child_process");
+            try {
+              execFileSync("gh", ["auth", "status"], { stdio: "pipe" });
+              task.output = "GitHub CLI authenticated";
+            } catch {
+              throw new Error("GitHub CLI is not authenticated. Run `gh auth login` first.");
+            }
+            try {
+              execFileSync("gh", ["repo", "view", "homebrew/homebrew-core", "--json", "name"], { stdio: "pipe" });
+              task.output = "Access to homebrew/homebrew-core verified";
+            } catch {
+              throw new Error("Cannot access homebrew/homebrew-core. Check your GitHub permissions.");
+            }
+          }
+        }
+      ];
+    },
     hooks: {
-      afterRelease: async (_ctx, releaseCtx) => {
+      afterRelease: async (ctx, releaseCtx) => {
         if (options.packageName && releaseCtx.displayLabel !== options.packageName) {
           return;
         }
@@ -215,16 +272,26 @@ function brewCore(options) {
         const pkg = existsSync(pkgPath) ? JSON.parse(readFileSync(pkgPath, "utf-8")) : {};
         const name = pkg.name?.replace(/^@[^/]+\//, "") ?? "my-tool";
         const formulaAssets = releaseAssetsToFormulaAssets(releaseCtx.assets, options.assetPlatforms);
+        const token = ctx.runtime.pluginTokens?.["brew-github-token"];
+        const ghEnv = token ? { env: { ...process.env, GH_TOKEN: token } } : {};
         try {
           execSync2("gh repo fork homebrew/homebrew-core --clone=false", {
-            stdio: "pipe"
+            stdio: "pipe",
+            ...ghEnv
           });
         } catch {}
         const username = execSync2("gh api user --jq .login", {
-          encoding: "utf-8"
+          encoding: "utf-8",
+          ...ghEnv
         }).trim();
         const tmpDir = join(tmpdir(), `pubm-brew-core-${Date.now()}`);
-        execSync2(`git clone --depth 1 https://github.com/${username}/homebrew-core.git ${tmpDir}`, { stdio: "inherit" });
+        let cloneUrl = `https://github.com/${username}/homebrew-core.git`;
+        if (token) {
+          cloneUrl = `https://x-access-token:${token}@github.com/${username}/homebrew-core.git`;
+        }
+        execSync2(`git clone --depth 1 ${cloneUrl} ${tmpDir}`, {
+          stdio: "inherit"
+        });
         ensureGitIdentity(tmpDir);
         const formulaPath = join(tmpDir, "Formula", `${name}.rb`);
         let content;
@@ -251,10 +318,21 @@ function brewCore(options) {
           `git commit -m "${name} ${releaseCtx.version}"`,
           `git push origin ${branchName}`
         ].join(" && "), { stdio: "inherit" });
-        execSync2([
+        const prUrl = execSync2([
           `cd ${tmpDir}`,
           `gh pr create --repo homebrew/homebrew-core --title "${name} ${releaseCtx.version}" --body "Update ${name} formula to version ${releaseCtx.version}"`
-        ].join(" && "), { stdio: "inherit" });
+        ].join(" && "), { encoding: "utf-8", ...ghEnv }).trim();
+        const prNumber = prUrl.match(/\/pull\/(\d+)/)?.[1];
+        if (prNumber) {
+          ctx.runtime.rollback.add({
+            label: `Close homebrew-core PR #${prNumber}`,
+            fn: async () => {
+              const { execSync: execSyncRb } = await import("node:child_process");
+              execSyncRb(`gh pr close ${prNumber} --repo homebrew/homebrew-core --comment "Closed by pubm rollback"`, { stdio: "inherit", ...ghEnv });
+            },
+            confirm: true
+          });
+        }
         console.log(`PR created to homebrew/homebrew-core for ${name} ${releaseCtx.version}`);
       }
     }
@@ -263,6 +341,7 @@ function brewCore(options) {
 // src/brew-tap.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, resolve as resolve2 } from "node:path";
+import { resolvePhases as resolvePhases2 } from "@pubm/core";
 function brewTap(options) {
   return {
     name: "@pubm/plugin-brew-tap",
@@ -299,8 +378,72 @@ function brewTap(options) {
         ]
       }
     ],
+    credentials: (ctx) => {
+      if (!options.repo || ctx.options.mode !== "ci")
+        return [];
+      return [
+        {
+          key: "brew-github-token",
+          env: "PUBM_BREW_GITHUB_TOKEN",
+          label: "GitHub PAT for Homebrew tap",
+          tokenUrl: "https://github.com/settings/tokens/new?scopes=repo",
+          tokenUrlLabel: "github.com",
+          ghSecretName: "PUBM_BREW_GITHUB_TOKEN",
+          required: true
+        }
+      ];
+    },
+    checks: (ctx) => {
+      const phases = resolvePhases2(ctx.options);
+      if (!phases.includes("publish") && ctx.options.mode !== "ci")
+        return [];
+      if (ctx.options.mode === "ci") {
+        if (!options.repo)
+          return [];
+        return [
+          {
+            title: "Checking Homebrew tap token availability",
+            phase: "conditions",
+            task: async (ctx2, task) => {
+              const token = ctx2.runtime.pluginTokens?.["brew-github-token"];
+              if (!token) {
+                throw new Error("PUBM_BREW_GITHUB_TOKEN is required for Homebrew tap publishing.");
+              }
+              task.output = "Homebrew tap token verified";
+            }
+          }
+        ];
+      }
+      if (!options.repo)
+        return [];
+      const targetRepo = options.repo;
+      return [
+        {
+          title: "Checking git/gh access for Homebrew tap",
+          phase: "conditions",
+          task: async (_ctx, task) => {
+            const { execFileSync } = await import("node:child_process");
+            try {
+              execFileSync("gh", ["auth", "status"], { stdio: "pipe" });
+              task.output = "GitHub CLI authenticated";
+            } catch {
+              throw new Error("GitHub CLI is not authenticated. Run `gh auth login` first.");
+            }
+            const repoName = /^[^/]+\/[^/]+$/.test(targetRepo) ? targetRepo : targetRepo.match(/github\.com[/:]([^/]+\/[^/.]+)/)?.[1];
+            if (repoName) {
+              try {
+                execFileSync("gh", ["repo", "view", repoName, "--json", "name"], { stdio: "pipe" });
+                task.output = `Access to ${repoName} verified`;
+              } catch {
+                throw new Error(`Cannot access tap repository '${targetRepo}'. Check your GitHub permissions.`);
+              }
+            }
+          }
+        }
+      ];
+    },
     hooks: {
-      afterRelease: async (_ctx, releaseCtx) => {
+      afterRelease: async (ctx, releaseCtx) => {
         if (options.packageName && releaseCtx.displayLabel !== options.packageName) {
           return;
         }
@@ -327,7 +470,7 @@ function brewTap(options) {
         mkdirSync2(dirname2(formulaPath), { recursive: true });
         writeFileSync2(formulaPath, content);
         console.log(`Formula updated at ${options.formula}`);
-        if (!options.repo) {
+        {
           const { execSync: execSync2 } = await import("node:child_process");
           ensureGitIdentity();
           execSync2(`git add ${formulaPath}`, { stdio: "inherit" });
@@ -338,16 +481,24 @@ function brewTap(options) {
             const branch = `pubm/brew-formula-v${releaseCtx.version}`;
             execSync2(`git checkout -b ${branch}`, { stdio: "inherit" });
             execSync2(`git push origin ${branch}`, { stdio: "inherit" });
-            execSync2(`gh pr create --title "chore(brew): update formula to ${releaseCtx.version}" --body "Automated formula update by pubm"`, { stdio: "inherit" });
+            const prUrl = execSync2(`gh pr create --title "chore(brew): update formula to ${releaseCtx.version}" --body "Automated formula update by pubm"`, { encoding: "utf-8" }).trim();
+            const prNumber = prUrl.match(/\/pull\/(\d+)/)?.[1];
+            if (prNumber) {
+              ctx.runtime.rollback.add({
+                label: `Close Homebrew tap PR #${prNumber}`,
+                fn: async () => {
+                  execSync2(`gh pr close ${prNumber} --comment "Closed by pubm rollback"`, { stdio: "inherit" });
+                },
+                confirm: true
+              });
+            }
             console.log(`Created PR on branch ${branch}`);
           }
-          return;
         }
         if (options.repo) {
           const { tmpdir: tmpdir2 } = await import("node:os");
           const { basename, join: join2 } = await import("node:path");
           const { execSync: execSync2 } = await import("node:child_process");
-          const { resolveGitHubToken } = await import("@pubm/core");
           const tmpDir = join2(tmpdir2(), `pubm-brew-tap-${Date.now()}`);
           const formulaFile = basename(formulaPath);
           const isShorthand = /^[^/]+\/[^/]+$/.test(options.repo);
@@ -355,10 +506,11 @@ function brewTap(options) {
           const ownerRepoMatch = repoUrl.match(/github\.com[/:]([^/]+\/[^/.]+?)(?:\.git)?$/);
           const ownerRepo = ownerRepoMatch?.[1] ?? options.repo;
           let cloneUrl = repoUrl;
-          const tokenResult = resolveGitHubToken();
-          if (tokenResult?.token && repoUrl.startsWith("https://github.com/")) {
-            cloneUrl = repoUrl.replace("https://github.com/", `https://x-access-token:${tokenResult.token}@github.com/`);
+          const token = ctx.runtime.pluginTokens?.["brew-github-token"];
+          if (token && repoUrl.startsWith("https://github.com/")) {
+            cloneUrl = repoUrl.replace("https://github.com/", `https://x-access-token:${token}@github.com/`);
           }
+          const ghEnv = token ? { env: { ...process.env, GH_TOKEN: token } } : {};
           execSync2(`git clone --depth 1 ${cloneUrl} ${tmpDir}`, {
             stdio: "inherit"
           });
@@ -381,7 +533,18 @@ function brewTap(options) {
             execSync2(`cd ${tmpDir} && git push origin ${branch}`, {
               stdio: "inherit"
             });
-            execSync2(`gh pr create --repo ${ownerRepo} --title "chore(brew): update formula to ${releaseCtx.version}" --body "Automated formula update by pubm"`, { stdio: "inherit" });
+            const prUrl = execSync2(`gh pr create --repo ${ownerRepo} --title "chore(brew): update formula to ${releaseCtx.version}" --body "Automated formula update by pubm"`, { encoding: "utf-8", ...ghEnv }).trim();
+            const prNumber = prUrl.match(/\/pull\/(\d+)/)?.[1];
+            if (prNumber) {
+              const repoFlag = ownerRepo;
+              ctx.runtime.rollback.add({
+                label: `Close Homebrew tap PR #${prNumber} (${repoFlag})`,
+                fn: async () => {
+                  execSync2(`gh pr close ${prNumber} --repo ${repoFlag} --comment "Closed by pubm rollback"`, { stdio: "inherit", ...ghEnv });
+                },
+                confirm: true
+              });
+            }
             console.log(`Created PR on branch ${branch}`);
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pubm/plugin-brew",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "type": "module",
   "description": "pubm plugin for Homebrew formula publishing workflows",
   "main": "./dist/index.js",
@@ -23,7 +23,7 @@
   },
   "license": "Apache-2.0",
   "peerDependencies": {
-    "@pubm/core": ">=0.4.3"
+    "@pubm/core": ">=0.4.8"
   },
   "publishConfig": {
     "access": "public"