fix(ci): update sigstore action from @v3 to @v3.3.0#127
Merged
Conversation
brew install --build-from-source requires the formula to be part of a registered tap. The previous command passed a raw file path which Homebrew rejects. Fix: tap the cloned directory first with `brew tap <org>/<repo> <path>`, then install via the tap reference. Fixes the 'Update Homebrew Formula' workflow failure on v1.0.0 release. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The @V3 tag does not exist in sigstore/gh-action-sigstore-python; the available tags are v3.0.0, v3.1.0, v3.2.0, v3.3.0. This was causing the Sign and Attach to GitHub Release job to fail in the v1.0.0 release run. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates the release workflows to use a valid pinned version of the Sigstore Python GitHub Action and fixes the Homebrew tap-based installation logic in the Homebrew release workflow so CI can correctly build, test, and uninstall the formula from the local tap. Flow diagram for updated Homebrew tap installation in release-homebrew workflowflowchart TD
subgraph Job_release_homebrew
A["Checkout repository"] --> B["Set up Homebrew environment"]
B --> C["Build macversiontracker artifact"]
C --> D["Clone homebrew-tap repo into homebrew-tap directory"]
D --> E["Register local tap\nbrew tap docdyhr/homebrew-tap $(pwd)/homebrew-tap"]
E --> F["Install formula from tap\nbrew install --build-from-source docdyhr/homebrew-tap/macversiontracker"]
F --> G["Run versiontracker --help"]
G --> H["Run versiontracker --version"]
H --> I["Uninstall formula from tap\nbrew uninstall docdyhr/homebrew-tap/macversiontracker || true"]
I --> J["Push updated formula to tap"]
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- The Homebrew tap name and formula path are now hard-coded (
docdyhr/homebrew-tap/macversiontracker); consider deriving these from existing variables (e.g.,FORMULA_PATHorgithub.repository_owner) to avoid duplication and reduce maintenance when names change. - After tapping the local
homebrew-tap, you might want to explicitlybrew untapit at the end of the job to keep the CI environment clean and avoid potential conflicts in subsequent steps.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The Homebrew tap name and formula path are now hard-coded (`docdyhr/homebrew-tap/macversiontracker`); consider deriving these from existing variables (e.g., `FORMULA_PATH` or `github.repository_owner`) to avoid duplication and reduce maintenance when names change.
- After tapping the local `homebrew-tap`, you might want to explicitly `brew untap` it at the end of the job to keep the CI environment clean and avoid potential conflicts in subsequent steps.
## Individual Comments
### Comment 1
<location path=".github/workflows/release.yml" line_range="301" />
<code_context>
- name: Sign distributions with Sigstore
- uses: sigstore/gh-action-sigstore-python@v3
+ uses: sigstore/gh-action-sigstore-python@v3.3.0
with:
inputs: >-
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Consider pinning the Sigstore action to a commit SHA for stronger supply-chain guarantees.
Pinning to `v3.3.0` is an improvement over a moving `v3` tag, but tags can be retargeted. For signing steps, prefer pinning to a specific commit SHA (optionally with a comment noting the tag) so the workflow always runs the exact same code.
Suggested implementation:
```
- name: Sign distributions with Sigstore
# v3.3.0
uses: sigstore/gh-action-sigstore-python@<COMMIT-SHA-FOR-v3.3.0>
with:
inputs: >-
./dist/*.tar.gz
```
Replace `<COMMIT-SHA-FOR-v3.3.0>` with the actual commit SHA corresponding to the `v3.3.0` tag of `sigstore/gh-action-sigstore-python`. You can obtain this SHA by:
1. Visiting the GitHub repo `sigstore/gh-action-sigstore-python`.
2. Checking the `v3.3.0` release/tag and copying its commit SHA.
3. Pasting that SHA in place of the placeholder.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
|
||
| - name: Sign distributions with Sigstore | ||
| uses: sigstore/gh-action-sigstore-python@v3 | ||
| uses: sigstore/gh-action-sigstore-python@v3.3.0 |
Contributor
There was a problem hiding this comment.
🚨 suggestion (security): Consider pinning the Sigstore action to a commit SHA for stronger supply-chain guarantees.
Pinning to v3.3.0 is an improvement over a moving v3 tag, but tags can be retargeted. For signing steps, prefer pinning to a specific commit SHA (optionally with a comment noting the tag) so the workflow always runs the exact same code.
Suggested implementation:
- name: Sign distributions with Sigstore
# v3.3.0
uses: sigstore/gh-action-sigstore-python@<COMMIT-SHA-FOR-v3.3.0>
with:
inputs: >-
./dist/*.tar.gz
Replace <COMMIT-SHA-FOR-v3.3.0> with the actual commit SHA corresponding to the v3.3.0 tag of sigstore/gh-action-sigstore-python. You can obtain this SHA by:
- Visiting the GitHub repo
sigstore/gh-action-sigstore-python. - Checking the
v3.3.0release/tag and copying its commit SHA. - Pasting that SHA in place of the placeholder.
🔒 Security Analysis ReportSecurity Analysis ReportGenerated: Wed Apr 1 12:01:18 UTC 2026 Bandit Security ScanSafety Check ResultsPip-Audit Results |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 94e2c095b9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+79
to
+80
| brew tap docdyhr/homebrew-tap "$(pwd)/homebrew-tap" | ||
| brew install --build-from-source docdyhr/homebrew-tap/macversiontracker |
There was a problem hiding this comment.
In .github/workflows/release-homebrew.yml, this step now runs brew tap ... "$(pwd)/homebrew-tap" and then installs from the tap before the formula update is committed. brew tap <user>/<repo> <URL> clones the repo at that URL, so the tapped copy does not include the uncommitted edits made in the previous awk update step. As a result, the install test can succeed against the old committed formula while the newly generated Formula/macversiontracker.rb (new version/SHA) is never validated and may be pushed broken.
Useful? React with 👍 / 👎.
docdyhr
added a commit
that referenced
this pull request
Apr 1, 2026
Documents PRs #127 (sigstore @v3.3.0), #128 (skip-existing PyPI), and #129 (black CVE-2026-32274) under a new [1.0.1] section. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docdyhr
added a commit
that referenced
this pull request
Apr 1, 2026
Documents PRs #127 (sigstore @v3.3.0), #128 (skip-existing PyPI), and #129 (black CVE-2026-32274) under a new [1.0.1] section. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sigstore/gh-action-sigstore-python@v3tag does not exist — only versioned tags likev3.0.0,v3.1.0,v3.2.0,v3.3.0are publishedUnable to resolve action, unable to find version v3@v3.3.0(latest available)Test plan
🤖 Generated with Claude Code
Summary by Sourcery
Fix release workflows for Homebrew formula publishing and Sigstore signing.
Bug Fixes:
CI: