Repository navigation
v1.15.3: signed build provenance, owner-relative Homebrew taps, demo links - #19
Merged
Merged
Conversation
The upstream mirror clojurewasm/ClojureWasm carries this workflow, so merging #18 there cut its own v1.15.1 build and its tap job tried to rewrite Formula/cljw.rb with that build's checksums. The formula's urls name BuddhiLW/ClojureWasm releases, whose artifacts hash differently (linux cb7ad4a5 here vs 586396f7 upstream), so a successful push would have broken brew install. It failed instead with a 403: the mirror has no TAP_DEPLOY_KEY. Guard the job on github.repository; it is skipped, not failed, elsewhere.
Release workflow: bump the Homebrew tap only from BuddhiLW/ClojureWasm
Each repository now bumps <its owner>/homebrew-tap and points the formula at its OWN release assets, so BuddhiLW/ClojureWasm keeps buddhilw/tap and clojurewasm/ClojureWasm drives clojurewasm/tap (deploy key added there). The two repositories build each tag separately and hash differently; a formula never pairs one's urls with the other's checksums. Preflight reports whether TAP_DEPLOY_KEY exists, and a fork without it skips the job instead of failing. Each tarball gets a Sigstore build attestation (actions/attest-build-provenance v4.2.2): `gh attestation verify` proves it was built by this workflow from a given commit, which a .sha256 next to the asset cannot. A SHA256SUMS file collects the per-asset sums. README advertises clojurewasm/tap/cljw and the verify command.
Release: signed build provenance, SHA256SUMS, owner-relative Homebrew taps
README: link the live demos at cljw.buddhilw.com
BuddhiLW
added a commit
that referenced
this pull request
Oct 23, 2026
… newest tag clojurewasm/ClojureWasm main CI failed on the PR #19 merge (runs 39701804074, 39701800082): the mirror has no v1.15.2 tag (its release job died on a homebrew-tap 403 before tagging), and the CI run raced the release workflow that tags v1.15.3 on that same merge. The newest reachable tag was v1.15.1, the script skipped only the pending [1.15.3] heading, then refused [1.15.2]. Every heading between [Unreleased] and the newest tag's heading is now checked on its own: dated, newer than the newest tag, no newer than build.zig.zon's version, and untagged. A stray or out-of-range heading still fails, and so does a missing heading for the newest tag.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings upstream main to v1.15.3 from BuddhiLW/ClojureWasm (gated there in BuddhiLW#69).