Skip to content

ci: pin Homebrew/actions/setup-homebrew to a tag - #3612

Merged
bpamiri merged 2 commits into
developfrom
ci/pin-homebrew-actions
Sep 13, 2026
Merged

bpamiri merged 2 commits into
developfrom
ci/pin-homebrew-actions

Conversation

@bpamiri

@bpamiri bpamiri commented Sep 13, 2026

Copy link
Copy Markdown
Collaborator

Homebrew/actions renamed its default branch from master to main. Both docs workflows referenced @master, so every PR opened after the rename fails at "Set up job":

Unable to resolve action `homebrew/actions@master`, unable to find version `master`

The same job passed 18 hours earlier on #3609 with an unchanged workflow — nothing in this repo moved; upstream did.

Pinned to the 2026.09.07.1 tag rather than swapping @master for @main: a branch reference is exactly what just broke, and upstream tags weekly. setup-homebrew/action.yml is byte-identical (1421 bytes) at that tag and at today's 2026.09.13.1.

Found while landing #3611, whose only red check was this job. This PR will demonstrate the fix by passing that same check.

Homebrew/actions renamed its default branch from master to main. Both
docs workflows referenced @master, so every PR opened after the rename
fails at "Set up job" with:

  Unable to resolve action `homebrew/actions@master`,
  unable to find version `master`

The same job passed 18 hours earlier on PR #3609 with an unchanged
workflow — nothing in the repo moved; upstream did.

Pinned to the 2026.09.07.1 tag rather than swapping @master for @main:
a branch reference is exactly what just broke, and upstream tags weekly.
setup-homebrew/action.yml is byte-identical (1421 bytes) at that tag and
at today's 2026.09.13.1.

Found while landing #3611, whose only red check was this job.

Signed-off-by: Peter Amiri <peter@alurium.com>
Second half of the docs-verify breakage. After pinning the action, the
job ran and failed inside `brew tap`:

  Invalid formula (golden_gate): .../Formula/wheels-be.rb
  Refusing to load formula wheels-dev/wheels/wheels-be from untrusted tap.
  Run `brew trust wheels-dev/wheels` to trust it.

Homebrew now validates every formula in a tap WHILE cloning it, and on
Linuxbrew refuses untrusted ones at that moment. docs-verify already had
`brew trust wheels-dev/wheels` — one line AFTER the tap, so it ran too
late; docs-validation had no trust at all. Both now trust first. The
earlier run proved `brew trust` accepts a not-yet-installed tap (it
printed "Trusted tap" after the failed clone).

The "Invalid formula" wording is a consequence of the refusal, not a
separate syntax problem; the tap's own macOS CI audits and installs the
same formula green.

Signed-off-by: Peter Amiri <peter@alurium.com>
@bpamiri
bpamiri merged commit 01783fc into develop Sep 13, 2026
10 of 11 checks passed
@bpamiri
bpamiri deleted the ci/pin-homebrew-actions branch September 13, 2026 23:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant