fix(ci): use workflow_run trigger for homebrew packaging by zircote · Pull Request #95 · zircote/nsip

zircote · 2026-02-22T21:29:15Z

Summary

Fix race condition where package-homebrew.yml triggered on release: [published] before build-binaries finished uploading assets, causing all SHA-256 checksums to be computed from 404 error pages (all identical)
Switch to workflow_run trigger so the homebrew job waits for the entire Release workflow to complete
Add a guard that verifies binary SHAs are unique before proceeding (fail-fast if assets are missing)
Corrected formula already pushed to zircote/homebrew-tap with correct per-asset SHAs for v0.3.3

Test plan

brew reinstall zircote/tap/nsip succeeds with corrected formula
Next release triggers homebrew workflow only after Release workflow completes
workflow_dispatch with version input still works for manual runs

- Add team coordination tools to all agents - Update spec-orchestrator command with lifecycle fixes

The package-homebrew workflow was triggered by release:published, which fires before build-binaries finishes uploading assets. This caused all SHA-256 checksums to be computed from 404 error pages, resulting in identical (wrong) hashes in the formula. Switch to workflow_run trigger so the homebrew job waits for the entire Release workflow to complete. Add a guard that verifies binary SHAs are unique before proceeding.

github-actions · 2026-02-22T21:29:45Z

Benchmark Results

No benchmarks configured. Add benchmarks to benches/ directory.

Full results available in CI artifacts.

codecov · 2026-02-22T21:31:27Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.83%. Comparing base (bb2f81c) to head (0d0360d).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #95   +/-   ##
=======================================
  Coverage   95.83%   95.83%           
=======================================
  Files           9        9           
  Lines        6499     6499           
=======================================
  Hits         6228     6228           
  Misses        271      271

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

github-actions · 2026-02-22T21:31:38Z

Code Coverage Report

Overall Coverage: 0%

Summary

Filename                      Regions    Missed Regions     Cover   Functions  Missed Functions  Executed       Lines      Missed Lines     Cover    Branches   Missed Branches     Cover
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
client.rs                        1444                67    95.36%         118                13    88.98%         923                35    96.21%           0                 0         -
format.rs                        2172                 3    99.86%         132                 1    99.24%        1292                 1    99.92%           0                 0         -
main.rs                           326               241    26.07%          14                 8    42.86%         225               168    25.33%           0                 0         -
mcp/analytics.rs                  408                 2    99.51%          24                 0   100.00%         331                 0   100.00%           0                 0         -
mcp/mod.rs                        144                55    61.81%          23                15    34.78%         128                65    49.22%           0                 0         -
mcp/prompts.rs                   1908                33    98.27%         126                 6    95.24%        1043                12    98.85%           0                 0         -
mcp/resources.rs                 1317                20    98.48%          93                 1    98.92%         865                 6    99.31%           0                 0         -
mcp/tools.rs                     2146                90    95.81%         116                18    84.48%        1333                47    96.47%           0                 0         -
models.rs                        1079                31    97.13%          78                10    87.18%         762                14    98.16%           0                 0         -
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
TOTAL                           10944               542    95.05%         724                72    90.06%        6902               348    94.96%           0                 0         -

Full HTML report available in CI artifacts.

Copilot

Pull request overview

This PR addresses a race condition in the Homebrew packaging workflow and adds a new spec-orchestrator command for parallel agent-based development, along with updates to agent tool sets for team collaboration.

Changes:

Switched Homebrew workflow trigger from release: [published] to workflow_run to ensure packaging occurs after all release assets are uploaded
Added SHA uniqueness validation to fail fast if binary downloads return 404 error pages
Added comprehensive spec-orchestrator command for orchestrating large specification implementations using parallel agent teams
Updated agent tool definitions (rust-developer, test-engineer, code-reviewer) to include team coordination tools (SendMessage, TaskList, TaskGet, TaskUpdate, TaskCreate where applicable)

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/package-homebrew.yml	Changed trigger from release event to workflow_run, updated version extraction to use head_branch, added SHA uniqueness validation for binary assets
.claude/commands/spec-orchestrator.md	New command for orchestrating spec implementation via parallel agent teams with discovery, synthesis, and wave-based execution phases
.claude/agents/test-engineer.md	Added team coordination tools and reformatted description to single-line YAML
.claude/agents/rust-developer.md	Added team coordination tools and reformatted description to single-line YAML
.claude/agents/code-reviewer.md	Added team coordination tools (including TaskCreate) and reformatted description to single-line YAML

Copilot · 2026-02-22T21:34:20Z

.github/workflows/package-homebrew.yml

+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]


The workflow_run trigger is missing branch filtering, which means this workflow will be triggered whenever the "Release" workflow completes on ANY branch, not just tags. The Release workflow is triggered by tags matching "v*..", but workflow_run doesn't automatically inherit this filtering. This could cause the homebrew workflow to run unexpectedly if someone manually triggers the Release workflow via workflow_dispatch on a non-tag branch.

Consider adding branch filtering to restrict this to only run when the Release workflow completes on tag refs. However, GitHub Actions workflow_run doesn't support filtering by tags directly in the trigger configuration - you would need to add a job-level condition that checks the ref type.

Copilot · 2026-02-22T21:34:20Z

.github/workflows/package-homebrew.yml

+            VERSION="${RUN_HEAD_BRANCH#v}"
          else
            VERSION="$INPUT_VERSION"


The version extraction logic assumes that head_branch will contain the tag name when the Release workflow is triggered by a tag push. However, for workflow_run events triggered by tag pushes, github.event.workflow_run.head_branch contains the tag ref (e.g., "v1.2.3"), but when manually triggered via workflow_dispatch, the head_branch would be the branch name, not a tag.

Additionally, if the Release workflow is triggered via workflow_dispatch on a branch (which is allowed according to the Release workflow definition), this will attempt to strip "v" from a branch name that might not have that prefix, leading to incorrect version extraction.

Consider adding validation to ensure the VERSION is properly formatted, or add an additional check to verify that the workflow_run was triggered from a tag push.

Suggested change

VERSION="${RUN_HEAD_BRANCH#v}"

else

VERSION="$INPUT_VERSION"

# Expect RUN_HEAD_BRANCH to be a tag like "v1.2.3"

if printf '%s\n' "$RUN_HEAD_BRANCH" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+([0-9A-Za-z.+-]*)?$'; then

VERSION="${RUN_HEAD_BRANCH#v}"

else

echo "Error: workflow_run triggered from non-tag ref '$RUN_HEAD_BRANCH'. Expected a tag like 'v1.2.3'." >&2

exit 1

fi

else

# Normalize INPUT_VERSION by stripping optional leading "v"

RAW_VERSION="$INPUT_VERSION"

RAW_VERSION="${RAW_VERSION#v}"

if ! printf '%s\n' "$RAW_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([0-9A-Za-z.+-]*)?$'; then

echo "Error: Provided version '$INPUT_VERSION' is not a valid semantic version (e.g., 1.2.3)." >&2

exit 1

fi

VERSION="$RAW_VERSION"

Copilot · 2026-02-22T21:34:20Z

.github/workflows/package-homebrew.yml

+          # Verify all SHAs are unique (identical = failed downloads)
+          SHAS="$ARM64_SHA $AMD64_SHA $LINUX_SHA"
+          UNIQUE=$(echo "$SHAS" | tr ' ' '\n' | sort -u | wc -l)
+          if [ "$UNIQUE" -lt 3 ]; then
+            echo "::error::SHA mismatch: binary SHAs are not unique."


The SHA uniqueness validation only checks the three binary SHAs (ARM64, AMD64, LINUX) but doesn't include the completions, man pages, or source tarball in the uniqueness check. If those assets fail to download and return a 404 error page, they would all have identical (but incorrect) SHAs that wouldn't be caught by this validation.

Consider expanding the validation to include all downloaded assets, or at a minimum add the completions and man pages since they are also uploaded by the Release workflow and could be subject to the same race condition.

Suggested change

# Verify all SHAs are unique (identical = failed downloads)

SHAS="$ARM64_SHA $AMD64_SHA $LINUX_SHA"

UNIQUE=$(echo "$SHAS" | tr ' ' '\n' | sort -u | wc -l)

if [ "$UNIQUE" -lt 3 ]; then

echo "::error::SHA mismatch: binary SHAs are not unique."

# Verify all asset SHAs are unique (identical = failed downloads)

SHAS="$ARM64_SHA $AMD64_SHA $LINUX_SHA $COMP_SHA $MAN_SHA $SRC_SHA"

UNIQUE=$(echo "$SHAS" | tr ' ' '\n' | sort -u | wc -l)

if [ "$UNIQUE" -lt 6 ]; then

echo "::error::SHA mismatch: asset SHAs are not unique."

Copilot · 2026-02-22T21:34:20Z

.github/workflows/package-homebrew.yml


+          # Verify all SHAs are unique (identical = failed downloads)
+          SHAS="$ARM64_SHA $AMD64_SHA $LINUX_SHA"
+          UNIQUE=$(echo "$SHAS" | tr ' ' '\n' | sort -u | wc -l)


The wc -l command counts the number of newline characters, which can be problematic in shell scripts. If the input doesn't end with a newline, wc -l will undercount by 1. While sort -u typically adds a trailing newline, this behavior can vary across different Unix implementations.

Consider using a more robust counting method, such as piping to grep -c . or explicitly adding a newline before counting. Alternatively, you could directly compare the sorted output against the expected number of lines to ensure all three SHAs are present and unique.

Suggested change

UNIQUE=$(echo "$SHAS" | tr ' ' '\n' | sort -u | wc -l)

UNIQUE=$(echo "$SHAS" | tr ' ' '\n' | sort -u | grep -c .)

zircote · 2026-02-22T22:03:40Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot · 2026-02-22T22:03:47Z

@zircote I've opened a new pull request, #96, to work on those changes. Once the pull request is ready, I'll request review from you.

- Add semver validation for workflow_run (tag ref check) and workflow_dispatch (input format check) version extraction - Expand SHA uniqueness guard from 3 binary assets to all 6 assets (ARM64, AMD64, Linux, completions, man pages, source tarball) - Replace wc -l with grep -c . for robust unique-SHA counting Co-authored-by: zircote <307960+zircote@users.noreply.github.com>

fix(ci): harden package-homebrew version extraction and SHA validation

github-actions · 2026-02-22T23:39:48Z

Benchmark Results

No benchmarks configured. Add benchmarks to benches/ directory.

Full results available in CI artifacts.

github-actions · 2026-02-22T23:41:34Z

Code Coverage Report

Overall Coverage: 0%

Summary

Filename                      Regions    Missed Regions     Cover   Functions  Missed Functions  Executed       Lines      Missed Lines     Cover    Branches   Missed Branches     Cover
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
client.rs                        1444                67    95.36%         118                13    88.98%         923                35    96.21%           0                 0         -
format.rs                        2172                 3    99.86%         132                 1    99.24%        1292                 1    99.92%           0                 0         -
main.rs                           326               241    26.07%          14                 8    42.86%         225               168    25.33%           0                 0         -
mcp/analytics.rs                  408                 2    99.51%          24                 0   100.00%         331                 0   100.00%           0                 0         -
mcp/mod.rs                        144                55    61.81%          23                15    34.78%         128                65    49.22%           0                 0         -
mcp/prompts.rs                   1908                33    98.27%         126                 6    95.24%        1043                12    98.85%           0                 0         -
mcp/resources.rs                 1317                20    98.48%          93                 1    98.92%         865                 6    99.31%           0                 0         -
mcp/tools.rs                     2146                90    95.81%         116                18    84.48%        1333                47    96.47%           0                 0         -
models.rs                        1079                31    97.13%          78                10    87.18%         762                14    98.16%           0                 0         -
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
TOTAL                           10944               542    95.05%         724                72    90.06%        6902               348    94.96%           0                 0         -

Full HTML report available in CI artifacts.

zircote added 2 commits February 21, 2026 22:39

perf(.claude): sync agents and spec-orchestrator from rust-template

758b76b

- Add team coordination tools to all agents - Update spec-orchestrator command with lifecycle fixes

Copilot AI review requested due to automatic review settings February 22, 2026 21:29

zircote temporarily deployed to copilot February 22, 2026 21:29 — with GitHub Actions Inactive

Copilot started reviewing on behalf of zircote February 22, 2026 21:29 View session

Copilot AI reviewed Feb 22, 2026

View reviewed changes

Initial plan

427a2e1

Copilot AI mentioned this pull request Feb 22, 2026

fix(ci): harden package-homebrew version extraction and SHA validation #96

Merged

Copilot AI and others added 2 commits February 22, 2026 22:07

Merge pull request #96 from zircote/copilot/sub-pr-95

0d0360d

fix(ci): harden package-homebrew version extraction and SHA validation

zircote temporarily deployed to copilot February 22, 2026 23:39 — with GitHub Actions Inactive

zircote merged commit 3a8d58f into main Feb 22, 2026
31 checks passed

zircote deleted the fix/homebrew-workflow-race branch February 22, 2026 23:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(ci): use workflow_run trigger for homebrew packaging#95

fix(ci): use workflow_run trigger for homebrew packaging#95
zircote merged 5 commits intomainfrom
fix/homebrew-workflow-race

zircote commented Feb 22, 2026

Uh oh!

github-actions bot commented Feb 22, 2026

Uh oh!

codecov bot commented Feb 22, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 22, 2026

Uh oh!

Copilot AI Feb 22, 2026

Uh oh!

Copilot AI Feb 22, 2026

Uh oh!

Copilot AI Feb 22, 2026

Uh oh!

zircote commented Feb 22, 2026

Uh oh!

Copilot AI commented Feb 22, 2026

Uh oh!

github-actions bot commented Feb 22, 2026

Uh oh!

github-actions bot commented Feb 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-            VERSION="${RUN_HEAD_BRANCH#v}"
-          else
-            VERSION="$INPUT_VERSION"
+            # Expect RUN_HEAD_BRANCH to be a tag like "v1.2.3"
+            if printf '%s\n' "$RUN_HEAD_BRANCH" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+([0-9A-Za-z.+-]*)?$'; then
+              VERSION="${RUN_HEAD_BRANCH#v}"
+            else
+              echo "Error: workflow_run triggered from non-tag ref '$RUN_HEAD_BRANCH'. Expected a tag like 'v1.2.3'." >&2
+              exit 1
+            fi
+          else
+            # Normalize INPUT_VERSION by stripping optional leading "v"
+            RAW_VERSION="$INPUT_VERSION"
+            RAW_VERSION="${RAW_VERSION#v}"
+            if ! printf '%s\n' "$RAW_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([0-9A-Za-z.+-]*)?$'; then
+              echo "Error: Provided version '$INPUT_VERSION' is not a valid semantic version (e.g., 1.2.3)." >&2
+              exit 1
+            fi
+            VERSION="$RAW_VERSION"

	UNIQUE=$(echo "$SHAS" \| tr ' ' '\n' \| sort -u \| wc -l)
	UNIQUE=$(echo "$SHAS" \| tr ' ' '\n' \| sort -u \| grep -c .)

Conversation

zircote commented Feb 22, 2026

Summary

Test plan

Uh oh!

github-actions bot commented Feb 22, 2026

Benchmark Results

Uh oh!

codecov bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Feb 22, 2026

Code Coverage Report

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

zircote commented Feb 22, 2026

Uh oh!

Copilot AI commented Feb 22, 2026

Uh oh!

github-actions bot commented Feb 22, 2026

Benchmark Results

Uh oh!

github-actions bot commented Feb 22, 2026

Code Coverage Report

Summary

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Feb 22, 2026 •

edited

Loading