Update Homebrew formula to CodeTruss CLI v0.2.37

[DeliriumPulse]

What changed

The tap served 0.2.36 while codetruss.com and the newest attested GitHub release served 0.2.37.

• Formula/codetruss.rb — url and sha256 to the immutable v0.2.37 release asset
• .github/workflows/test.yml — the post-install assertion is version-pinned, so it moves with the formula. Left at 0.2.36 it would fail the install test on both macOS legs.

The digest, and where it came from

082a03fe5dd2d9c516acc76504e0bb45bc7d3b5a1fa7308fb2d627ce07a3c627

Same bytes on every channel, checked with cmp (exit 0), not by eyeballing hashes:

Source	Result
releases/download/v0.2.37/codetruss-cli-0.2.37.tgz	082a03fe…
codetruss.com/downloads/codetruss-cli-0.2.37.tgz	082a03fe…, cmp exit 0
codetruss.com/downloads/codetruss-cli-latest.tgz	082a03fe…, cmp exit 0
Rebuilt from tagged source in the release workflow	082a03fe…

Provenance

gh attestation verify binds that digest to release.yml at refs/tags/v0.2.37, tag commit f420be17b5b886fb54b4901afb929665c0549ba3, on a GitHub-hosted runner — exit 0 with --signer-workflow, --source-ref, --source-digest and --deny-self-hosted-runners all pinned. Release run 31158510262.

Three predicates are bound to it, all in-toto Statement v1: https://slsa.dev/provenance/v1, https://cyclonedx.org/bom, and https://in-toto.io/attestation/release/v0.2.

The verifier was falsification-checked, not trusted

Exit codes captured directly. Piping gh attestation verify into head and reading $? gives head's status — the same known-bad input reads as exit 0 through a pipe and exit 1 under direct capture, which was demonstrated rather than assumed.

Tamper	Result
A tarball that is not the release	exit 1, HTTP 404 ... /attestations/sha256:1f555eec…
One flipped byte in the genuine archive	exit 1, 404 on the changed digest
Real archive, --source-ref refs/tags/v0.2.36	exit 1, expected SourceRepositoryRef to be refs/tags/v0.2.36, got refs/tags/v0.2.37
Real archive, --source-digest ed7debb… (the 0.2.36 commit)	exit 1, expected SourceRepositoryDigest to be ed7debb…, got f420be17…
Real archive, --signer-workflow …/ci.yml	exit 1
Real archive, --repo DeliriumPulse/homebrew-codetruss	exit 1, 404

Verify locally

curl -sLO https://github.com/DeliriumPulse/codetruss-cli/releases/download/v0.2.37/codetruss-cli-0.2.37.tgz
shasum -a 256 codetruss-cli-0.2.37.tgz   # 082a03fe...
gh attestation verify codetruss-cli-0.2.37.tgz --repo DeliriumPulse/codetruss-cli; echo "exit=$?"

v0.2.36 is untouched: its tag, release, assets and attestations still verify (exit 0 with the 0.2.36 ref and digest pinned).

Summary by CodeRabbit

• Chores
  • Updated release verification to use Codetruss CLI version 0.2.37.
  • Updated the package installation formula and checksum for version 0.2.37.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5a894b08-fe20-4b58-858a-34985d2bbacb

📥 Commits

Reviewing files that changed from the base of the PR and between 06bd2ca and b317dc0.

📒 Files selected for processing (2)

• .github/workflows/test.yml
• Formula/codetruss.rb

---

📝 Walkthrough

Walkthrough

The Homebrew formula now installs Codetruss CLI 0.2.37 with its updated checksum. The workflow verifies the same version.

Changes

Release version alignment

Layer / File(s)	Summary
Update release source and verification .github/workflows/test.yml, Formula/codetruss.rb	The formula uses the Codetruss CLI 0.2.37 source and SHA-256 checksum. The workflow checks the installed 0.2.37 version.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• DeliriumPulse/homebrew-codetruss#1: Updates the same formula and workflow version assertion.
• DeliriumPulse/homebrew-codetruss#3: Advances the Codetruss CLI version in the same formula and CI check.
• DeliriumPulse/homebrew-codetruss#4: Updates the same release source, checksum, and version test.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the formula update to CodeTruss CLI v0.2.37.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/v0.2.37

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}