From 3aecc38f002d247d4bf46864a6a011dfa8d95511 Mon Sep 17 00:00:00 2001 From: Arnon Rotem-Gal-Oz Date: Tue, 8 Sep 2026 21:00:08 +0300 Subject: [PATCH] chore: prepare v0.8.2 and guard the flake version against the tag v0.8.1 published its binaries, tarballs and a working checksums.txt, but not the Homebrew cask: HOMEBREW_TAP_TOKEN was not set yet, so the cask pipe got 401 Bad credentials. Re-running with the secret in place cannot fix it. Releases here are immutable, and the `release` pipe runs before `cask` -- goreleaser bails with "already exists and is immutable, it cannot be updated" before it ever reaches the cask. There is a `homebrew` skip key but none for the SCM release, so the cask cannot be published on its own. The tap therefore needs a fresh tag, which is what the version bump is for. Immutability makes any tag-time mistake permanent, so add a preflight check for the one input that can silently disagree with the tag: flake.nix states its version literally, since Nix builds from a source tree with no .git and `git describe` is unavailable there. Nothing else would catch a stale value -- the flake would just build and report the wrong version forever. The check reads the tag from the environment rather than interpolating it into the script, matching a72d115. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 18 ++++++++++++++++++ flake.nix | 8 +++++--- 2 files changed, 23 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index aa4fd16..bc0d270 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,6 +22,24 @@ jobs: # goreleaser derives the version and changelog from tags. fetch-depth: 0 + # Releases in this repository are immutable: once a tag publishes, its + # assets cannot be replaced and re-running the job cannot fix a mistake -- + # goreleaser fails fast with "already exists and is immutable". flake.nix + # states its version literally, because Nix builds from a source tree with + # no .git, so it is the one thing that can silently disagree with the tag. + # Catch that here, before anything becomes permanent. + - name: Check flake version matches the tag + env: + TAG: ${{ github.ref_name }} + run: | + want="${TAG#v}" + got="$(sed -n 's/^ *version = "\(.*\)";$/\1/p' flake.nix)" + if [ "$want" != "$got" ]; then + echo "::error file=flake.nix::flake.nix says $got but the tag is $want. Bump flake.nix and re-tag." + exit 1 + fi + echo "flake.nix and tag agree on $want" + - name: Set up Go uses: actions/setup-go@v7 with: diff --git a/flake.nix b/flake.nix index e87cb03..b3865c3 100644 --- a/flake.nix +++ b/flake.nix @@ -6,9 +6,11 @@ outputs = { self, nixpkgs }: let - # Bumped at release time. Nix builds from a source tree with no .git, so - # `git describe` is unavailable here and the version has to be stated. - version = "0.8.1"; + # Bumped at release time, and checked against the tag by the release + # workflow before anything is published. Nix builds from a source tree with + # no .git, so `git describe` is unavailable here and the version has to be + # stated literally. + version = "0.8.2"; systems = [ "x86_64-linux"