Deprecate the aggregator tap, migrate consumers to direct-repo install #6
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally filed by @coilysiren on 2026-05-19T08:16:29Z - https://github.com/coilysiren/homebrew-tap/issues/35
Problem
The aggregator-tap pattern requires every consumer repo (coily, repo-recall, agent-guard, personal-dashboard, session-lattice) to hold a
HOMEBREW_TAP_TOKENfine-grained PAT scoped to this repo withContents: Read and write. Five PATs total, each one auth-maintenance: they expire, they need rotating, they can leak, they're per-PAT effort to provision on a fresh host.The maintenance is auth maintenance, not code maintenance. The cross-repo bump workflow itself is fine and works. The cost is the PAT footprint.
Decision
Deprecate this tap. Every consumer formula already lives at
Formula/<name>.rbin its own upstream repo (source of truth). Users can install directly:The explicit-URL
brew tapform lets brew tap repos that aren'thomebrew-*prefixed, so no repo renames needed. Costs one extra path segment in the install command (coilysiren/repo-recall/repo-recallvscoilysiren/tap/repo-recall). That is the entire UX delta.Drops five PATs, five bump workflows in consumers, one bump workflow per consumer in this repo, and the per-repo dispatch wiring.
Migration
Per-consumer (each has its own retirement issue, linked below):
bump-tapjob from the consumer's.github/workflows/release.yml. Keep the tag + GH Release jobs.HOMEBREW_TAP_TOKENsecret on the consumer repo.In this repo, after each consumer migrates:
Formula/<name>.rbmirror..github/workflows/bump-<name>.ymlreceiver.README.mdand entry inAGENTS.md.When all five consumers have migrated, this repo becomes an empty shell:
README.mdwith a deprecation banner pointing users at the per-repo direct-tap install commands.install-repo-recall.shscript (consumer repos can carry their own equivalent if they want one).Sequencing
session-lattice migrates first - the bump workflow landed today (#16), no real release has tagged yet, no users depend on the tap path. Smallest blast radius, cleanest validation that the direct-tap install actually works end to end. Then repo-recall, then the Go-binary consumers (coily, agent-guard, personal-dashboard) which are even simpler (no Python resource blocks).
Consumer retirement issues