Skip to content

Update Homebrew formula to CodeTruss CLI v0.2.36 - #4

Merged
DeliriumPulse merged 1 commit into
mainfrom
release/v0.2.36
Aug 7, 2026
Merged

Update Homebrew formula to CodeTruss CLI v0.2.36#4
DeliriumPulse merged 1 commit into
mainfrom
release/v0.2.36

Conversation

@DeliriumPulse

@DeliriumPulse DeliriumPulse commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator

The tap served 0.2.30 while the website and the newest attested release served 0.2.36.

Changes

Three lines, all version-coupled:

File Change
Formula/codetruss.rb url → the v0.2.36 release asset
Formula/codetruss.rb sha256953e3f48725a7471043b48a55aedd33ef78854615a341dd95881d90eeae3e814
.github/workflows/test.yml post-install assertion → codetruss 0.2.36

The workflow's assertion is version-pinned. Leaving it at 0.2.30 would have failed the install test on both macOS legs, so it moves with the formula.

Where the digest comes from

url and sha256 are taken from the immutable v0.2.36 GitHub release, not the website copy. They are the same bytes, verified rather than assumed — the downloaded release asset, the archive on codetruss.com, and a local rebuild from the tagged source all hash to 953e3f48….

Provenance, verified against the downloaded asset:

predicateType: https://slsa.dev/provenance/v1
subject     : codetruss-cli-0.2.36.tgz  sha256:953e3f48…
workflow    : DeliriumPulse/codetruss-cli/.github/workflows/release.yml@refs/tags/v0.2.36
sourceRef   : refs/tags/v0.2.36
sourceDigest: ed7debb4852f012aa15458a9ba80531b27fe02d6
runnerEnv   : github-hosted

Falsification-checked so the pass means something: a single flipped byte, the wrong repository, the SBOM in place of the archive, and a mismatched --source-ref each fail with a non-zero exit.

Why 0.2.36 and not 0.2.35

0.2.35 was never tagged. Its Windows tests failed on a real path-separator defect that also silently disabled vendored-directory exclusion on Windows, so the release was held and fixed in 0.2.36 rather than shipped around.

Summary by CodeRabbit

  • New Features

    • Updated the Codetruss CLI package to version 0.2.36.
    • Updated the package checksum to match the new release.
  • Tests

    • Updated release verification to expect Codetruss CLI version 0.2.36.

The tap served 0.2.30 while the website and the newest attested release served
0.2.36.

url and sha256 come from the immutable v0.2.36 GitHub release, not the website
copy. Verified they are the same bytes: the downloaded release asset, the
archive on codetruss.com, and a local rebuild from the tagged source all hash to
953e3f48725a7471043b48a55aedd33ef78854615a341dd95881d90eeae3e814, and
`gh attestation verify` binds that digest to release.yml at refs/tags/v0.2.36
on a GitHub-hosted runner.

The workflow's post-install assertion is version-pinned, so it moves with the
formula. Leaving it at 0.2.30 would have failed the install test on both macOS
legs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d81aa83e-587d-4a5b-b884-1861e3935568

📥 Commits

Reviewing files that changed from the base of the PR and between 091c398 and 33798c5.

📒 Files selected for processing (2)
  • .github/workflows/test.yml
  • Formula/codetruss.rb

📝 Walkthrough

Walkthrough

The Homebrew formula now installs Codetruss CLI 0.2.36. The test workflow validates the same version.

Changes

Codetruss release update

Layer / File(s) Summary
Update release version and validation
.github/workflows/test.yml, Formula/codetruss.rb
The formula uses Codetruss CLI 0.2.36 and its SHA-256 checksum. The workflow checks version 0.2.36.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the Homebrew formula update to CodeTruss CLI v0.2.36.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch release/v0.2.36

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@DeliriumPulse
DeliriumPulse merged commit 06bd2ca into main Aug 7, 2026
3 checks passed
@DeliriumPulse
DeliriumPulse deleted the release/v0.2.36 branch August 7, 2026 06:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant