feat: add `ward pkg brew` audited brew wrapper at parity with coily #53

Merged

coilysiren merged 1 commit from feat/pkg-brew into main

2026-06-04 11:52:34 +00:00

coilysiren commented

2026-06-04 11:31:56 +00:00

Owner

What

Adds a ward pkg group with a brew subcommand at full parity with coily pkg brew (coily cmd/coily/brew.go). Ward-gated board repos now have a native audited brew path instead of routing package management back to coily.

Why

Ward's own bare-brew deny hint pointed at coily brew ..., coupling public ward-gated repos to coily, which public contributors don't have. The cli-guard reflow (cli-guard#74) moved the "ward never grows ops verbs" constraint to the future seed template, so ward is now the right home for an audited package wrapper.

How

cmd/ward/pkg_brew.go - the brew wrapper ported from coily: brew-argv-shaped single entry point; formula/tap mutations default to primary-org taps with --allow-untapped opt-out; touch-everything verbs gated; read-only verbs and brew bundle pass through. Audit rows pkg.brew.*.
cmd/ward/runner.go - a minimal ward Runner (shell + audit writer), built lazily inside the pkg action so lean verbs (hook, version, exec) never touch the audit directory. Reuses cli-guard verb/audit/egress/exitcode/shell/config - no coily import.
cmd/ward/pkg.go - the pkg group; pkg_brew_test.go - coily's brew tests ported (split-args, classify, tap-scope, shape).
Updated the bare-brew deny-recovery hint to offer the ward-native path; README + FEATURES.

Verification

go build / go vet / gofmt clean; golangci-lint v2.12.2: 0 issues; full go test ./... green.
Ran the built binary end-to-end: ward pkg brew bundle check shelled to brew against a real Brewfile and returned the correct unmet-deps result, writing an audit row.
Full pre-commit gate passed (code-comments, documentation-layout, conventional-commits, closes-issue, trifecta, trufflehog).

Follow-ups (out of scope)

Other package managers (npm/pip/cargo/...) - follow-up once brew lands.
A ward release so the verb ships on disk; the first consumer is the otel-a2a-relay-ansible-debug board repo, currently on the interim coily pkg brew bundle.

closes #52

## What Adds a `ward pkg` group with a `brew` subcommand at **full parity with `coily pkg brew`** (coily `cmd/coily/brew.go`). Ward-gated board repos now have a native audited brew path instead of routing package management back to coily. ## Why Ward's own bare-`brew` deny hint pointed at `coily brew ...`, coupling public ward-gated repos to coily, which public contributors don't have. The cli-guard reflow (cli-guard#74) moved the "ward never grows ops verbs" constraint to the future `seed` template, so ward is now the right home for an audited package wrapper. ## How - **`cmd/ward/pkg_brew.go`** - the brew wrapper ported from coily: brew-argv-shaped single entry point; formula/tap mutations default to primary-org taps with `--allow-untapped` opt-out; touch-everything verbs gated; read-only verbs and `brew bundle` pass through. Audit rows `pkg.brew.*`. - **`cmd/ward/runner.go`** - a minimal ward `Runner` (shell + audit writer), built **lazily** inside the pkg action so lean verbs (`hook`, `version`, `exec`) never touch the audit directory. Reuses cli-guard `verb`/`audit`/`egress`/`exitcode`/`shell`/`config` - **no coily import**. - **`cmd/ward/pkg.go`** - the `pkg` group; **`pkg_brew_test.go`** - coily's brew tests ported (split-args, classify, tap-scope, shape). - Updated the bare-`brew` deny-recovery hint to offer the ward-native path; README + FEATURES. ## Verification - `go build` / `go vet` / `gofmt` clean; **golangci-lint v2.12.2: 0 issues**; full `go test ./...` green. - Ran the built binary end-to-end: `ward pkg brew bundle check` shelled to brew against a real Brewfile and returned the correct unmet-deps result, writing an audit row. - Full pre-commit gate passed (code-comments, documentation-layout, conventional-commits, closes-issue, trifecta, trufflehog). ## Follow-ups (out of scope) - Other package managers (npm/pip/cargo/...) - follow-up once brew lands. - A ward release so the verb ships on disk; the first consumer is the `otel-a2a-relay-ansible-debug` board repo, currently on the interim `coily pkg brew bundle`. closes #52

coilysiren added 1 commit

2026-06-04 11:31:56 +00:00

feat: add ward pkg brew audited brew wrapper at parity with coily

test / test (pull_request) Has been cancelled

Details

85837d7c8c

Ward grows a `pkg` group with a `brew` subcommand mirroring coily's
`coily pkg brew` (cmd/coily/brew.go): brew-argv-shaped, formula/tap
mutations default to primary-org taps with --allow-untapped opt-out,
read-only verbs and `brew bundle` pass through, audit rows pkg.brew.*.
Ward gains a minimal Runner (shell + audit writer, lazily built so lean
verbs never touch the audit dir), reusing cli-guard verb/audit/egress/
exitcode/shell - no coily import. Updates the bare-brew deny hint to offer
the ward-native path. Gives board repos an audited brew path instead of
routing package management back to coily.

closes #52

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coilysiren merged commit f7ec03279a into main

2026-06-04 11:52:34 +00:00

coilysiren referenced this pull request from a commit

2026-06-04 11:52:34 +00:00

Merge pull request 'feat: add `ward pkg brew` audited brew wrapper at parity with coily' (#53) from feat/pkg-brew into main

coilysiren referenced this pull request

2026-06-04 12:04:54 +00:00

feat: migrate ward release to Forgejo Actions (build from Forgejo, not GitHub) #55