ci: manual publish-dist workflow + shared tap-push script

[wavyx]

Adds a workflow_dispatch workflow to (re)publish the Homebrew/Scoop tap files for a version without re-running the full release, and factors the push logic into scripts/publish-tap.sh so the release job and the manual one share one implementation. No-ops without TAP_TOKEN; skips prereleases.

https://claude.ai/code/session_018dRMUUj9vpKp3tqKQFsvE9

Greptile Summary

This PR factors the Homebrew/Scoop tap-push logic out of the inline release workflow step into scripts/publish-tap.sh, and adds a new workflow_dispatch workflow (publish-dist.yml) so operators can (re)publish tap files for any already-published version without re-running the full release pipeline.

• scripts/publish-tap.sh is a self-contained bash script with set -euo pipefail, fast-fail on missing VERSION, no-op when TAP_TOKEN is absent, and prerelease skipping — all guards that were present in the old inline block.
• release.yml's dist job is simplified to a single bash scripts/publish-tap.sh call; the env var rename from V to VERSION is intentional and correctly matches the script's expectation.
• publish-dist.yml resolves the version from user input or package.json, calls gen-dist.mjs, then delegates to the shared script with VERSION=\"$V\" bash scripts/publish-tap.sh.

Confidence Score: 4/5

Safe to merge — the refactor faithfully replicates the existing inline tap-push logic, and both callers wire VERSION and TAP_TOKEN correctly.

The new shared script correctly handles all the guards (prerelease skip, missing token no-op, fast-fail on missing VERSION) that the old inline block had. The only concern is a style-level issue in push_file where tmp is not declared local and temp dirs are never explicitly cleaned up, harmless in ephemeral CI runners but inconsistent with the set -euo pipefail rigor otherwise applied throughout the script.

scripts/publish-tap.sh warrants a quick look at the push_file function for the local/cleanup pattern.

Important Files Changed

Filename	Overview
.github/workflows/publish-dist.yml	New manual workflow_dispatch workflow that re-publishes tap files for an arbitrary version; correctly passes VERSION and TAP_TOKEN, consistent with the existing dist job in release.yml
.github/workflows/release.yml	Inline tap-push block replaced with a single bash scripts/publish-tap.sh call; VERSION env var renamed from V to VERSION — logic is equivalent to what was removed
scripts/publish-tap.sh	Extracted push logic with set -euo pipefail, fast-fails on missing VERSION, no-ops without TAP_TOKEN, skips prereleases; tmp in push_file is not declared local and temp dirs are never explicitly cleaned up

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant GH as GitHub Actions
    participant RW as release.yml (dist job)
    participant MW as publish-dist.yml (manual)
    participant GD as gen-dist.mjs
    participant PS as publish-tap.sh
    participant HB as wavyx/homebrew-tap
    participant SC as wavyx/scoop-pdcli

    note over GH,SC: Automatic release path (on tag push)
    GH->>RW: tag push trigger
    RW->>GD: node scripts/gen-dist.mjs VERSION
    GD-->>RW: pdcli.rb + pdcli.json written
    RW->>PS: bash scripts/publish-tap.sh
    PS->>PS: skip if prerelease
    PS->>PS: no-op if TAP_TOKEN unset
    PS->>HB: git clone, cp, commit, push
    PS->>SC: git clone, cp, commit, push

    note over GH,SC: Manual re-publish path (workflow_dispatch)
    GH->>MW: manual trigger
    MW->>GD: node scripts/gen-dist.mjs V
    GD-->>MW: pdcli.rb + pdcli.json written
    MW->>PS: "VERSION=V bash scripts/publish-tap.sh"
    PS->>PS: skip if prerelease
    PS->>PS: no-op if TAP_TOKEN unset
    PS->>HB: git clone, cp, commit, push
    PS->>SC: git clone, cp, commit, push

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant GH as GitHub Actions
    participant RW as release.yml (dist job)
    participant MW as publish-dist.yml (manual)
    participant GD as gen-dist.mjs
    participant PS as publish-tap.sh
    participant HB as wavyx/homebrew-tap
    participant SC as wavyx/scoop-pdcli

    note over GH,SC: Automatic release path (on tag push)
    GH->>RW: tag push trigger
    RW->>GD: node scripts/gen-dist.mjs VERSION
    GD-->>RW: pdcli.rb + pdcli.json written
    RW->>PS: bash scripts/publish-tap.sh
    PS->>PS: skip if prerelease
    PS->>PS: no-op if TAP_TOKEN unset
    PS->>HB: git clone, cp, commit, push
    PS->>SC: git clone, cp, commit, push

    note over GH,SC: Manual re-publish path (workflow_dispatch)
    GH->>MW: manual trigger
    MW->>GD: node scripts/gen-dist.mjs V
    GD-->>MW: pdcli.rb + pdcli.json written
    MW->>PS: "VERSION=V bash scripts/publish-tap.sh"
    PS->>PS: skip if prerelease
    PS->>PS: no-op if TAP_TOKEN unset
    PS->>HB: git clone, cp, commit, push
    PS->>SC: git clone, cp, commit, push

Loading

_{Reviews (1): Last reviewed commit: "ci: add manual publish-dist workflow; sh..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[greptile-apps]

tmp is not declared with local, making it a global variable that is overwritten on each call to push_file. If set -e causes the script to exit mid-way (e.g., on a failed push), the temp directory from any prior call is never cleaned up. Declaring it local also makes the function self-contained and safe to call in any order.

Suggested change

	push_file() {
	repo="$1"; src="$2"; dest="$3"
	tmp="$(mktemp -d)"
	git clone --depth 1 "https://x-access-token:${TAP_TOKEN}@github.com/${repo}.git" "$tmp"
	mkdir -p "$(dirname "$tmp/$dest")"
	cp "$src" "$tmp/$dest"
	git -C "$tmp" add "$dest"
	if git -C "$tmp" commit -m "pdcli $VERSION"; then
	git -C "$tmp" push
	echo "pushed $repo/$dest"
	else
	echo "no change for $repo/$dest"
	fi
	}
	push_file() {
	local repo="$1" src="$2" dest="$3"
	local tmp
	tmp="$(mktemp -d)"
	trap 'rm -rf "$tmp"' RETURN
	git clone --depth 1 "https://x-access-token:${TAP_TOKEN}@github.com/${repo}.git" "$tmp"
	mkdir -p "$(dirname "$tmp/$dest")"
	cp "$src" "$tmp/$dest"
	git -C "$tmp" add "$dest"
	if git -C "$tmp" commit -m "pdcli $VERSION"; then
	git -C "$tmp" push
	echo "pushed $repo/$dest"
	else
	echo "no change for $repo/$dest"
	fi
	}