Fix nightly release: scope homebrew cask to vigilante archives, gate publish to main - #464
Merged
Merged
Conversation
…ish to main The nightly release was failing at the homebrew cask stage with: one tap can handle only one archive of an OS/Arch combination. Consider using ids in the homebrew_casks section Both `vigilante` and `gh-sandbox` produce Linux amd64/arm64 archives, so the unscoped homebrew_casks entry tried to template both into a single cask and collided. Filter the cask to the `release-archives` archive id (which already pins to the `vigilante` build) so gh-sandbox artifacts are excluded from the cask template while still shipping as release assets. Also harden the workflow so it only publishes/updates external artifacts when running on `main`. Non-main pushes (currently used as a temporary verification branch for this fix) exercise the goreleaser build step but skip the rolling prerelease, nightly verification, and Homebrew tap update. The `main`-only gates are the permanent behavior; the branch entry under `on.push.branches` is temporary and will be removed once this run is confirmed green. Local verification: - goreleaser check — pass - goreleaser release --snapshot --clean --skip=publish — pass; the generated dist/homebrew/Casks/vigilante.rb references only the vigilante archives (macOS amd64/arm64, Linux amd64).
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
vigilante | b3fca59 | Commit Preview URL Branch Preview URL |
Apr 23 2026, 04:19 PM |
Branch pushes hit environment protection rules before the job could even start, because the job unconditionally required environment `main` and that environment is gated to `main`. Make the environment conditional so non-main verification pushes still build the goreleaser snapshot, and gate the `Get token for Homebrew tap` step to main since its secrets are only available inside the `main` environment. On main pushes the behavior is identical to before.
Nightly run 24846173714 on this branch succeeded with the goreleaser homebrew_casks fix in place (build step passed; publish/tap steps correctly skipped off-main). Drop the temporary branch entry from the push trigger list so nightly only fires on main again. The permanent main-only gates on the publish/verify/tap steps and the conditional `environment: main` stay in place as a safety net.
Collaborator
Author
✅ Branch nightly run succeeded — temporary trigger removedNightly run on this branch (commit Step outcomes on the branch run (as intended):
Pushed Ready to merge. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix the Nightly Release job that has been failing on every push to
mainsincegh-sandboxjoined the goreleaser build. The homebrew cask stage errored with:because the unscoped
homebrew_casksentry tried to template the Linux amd64/arm64 archives from bothvigilanteandgh-sandboxinto a single cask.Changes
.goreleaser.yml— scope thehomebrew_casks.vigilanteentry toids: [release-archives], which is already thevigilante-only archive.gh-sandbox-archivesstill ship as release assets, they just don't participate in the cask template..github/workflows/nightly.yml— gate the side-effectful steps (rolling prerelease publish, nightly-release verification, homebrew tap checkout/update/push) togithub.ref == 'refs/heads/main'. Non-main pushes now exercisegoreleaser check, the snapshot build, and the snapshot cask template (the actual former failure point), but cannot overwrite themain-nightlytag, assets, or Homebrew tap. This is a permanent safety net and should stay after this PR.on.push.branchestemporarily so a nightly run fires on the branch to prove the build step works end-to-end. That trigger entry will be removed before merge.Local verification
goreleaser check— pass.NIGHTLY_VERSION=0.0.0-nightly.test.local ... goreleaser release --snapshot --clean --skip=publish— pass. Generateddist/homebrew/Casks/vigilante.rbreferences only the vigilante archives (macOS amd64, macOS arm64, Linux amd64) — no gh-sandbox. Noone tap can handle only one archiveerror.Rollout
on.push.branchesin a follow-up commit on this PR.mainpush will resume successful nightly publishing.Refs: https://github.com/aliengiraffe/vigilante/actions/runs/24843180124/job/72722701900 and the four previous nightly runs that hit the same error.