anchore / anchore/syft

Verify brew installations on/before release

Open
#576 1 comment 0 reactions 0 assignees View on GitHub
enhancement release
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:
Do one of the following:
- Add post-release automation that attempts to install syft via our brew tap and verify the installation + version.
- Add a goreleaser `brews.test` section to test if an installation worked before release (preferred if my understanding of the feature is correct).

**Why is this needed**:
We recently ran into a problem with goreleaser where the checksums of the asset referenced in the brew formula was wrong, preventing installations. The first indication of a problem was when users begin to report problems in slack and issues. It would be ideal to prevent this by testing before the release or at the very least get notified on slack after a release if a validation fails.

Related to #519

Contributor guide

Open the contributing guide

Research direction

Start by reading the repository's GoReleaser configuration and related issue #519 to determine how release artifacts and the brew tap are currently defined. Investigate whether the brews.test feature can verify a syft installation and version before release; done means failed brew installations are detected before release or reported after release.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
ci-cd, release
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.