amont-agent 2.8.0

A guard that inspects a shell command before Claude Code runs it
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

#!/usr/bin/env python3
"""Rewrite the homebrew formula for a release — asserts, not hope.

The tap bump was amont's last manual release step, done by hand four times in
three days: copy a version, copy four sha256 lines, push. A transcription
error there ships a formula brew refuses (checksum mismatch) or, worse,
accepts. This script is the closed loop: it reads the release's own
SHA256SUMS, rewrites exactly the url/sha pairs the formula declares, and
refuses loudly on ANY surprise — a checksum file for the wrong version, a
target the formula wants that the release did not build, a rewrite count
other than what the formula carries, a stale version string surviving.

Idempotent on purpose: re-run against a formula already at the version it
produces byte-identical output, so the workflow's "nothing to commit" path
is how a resumed release run no-ops.

Usage: bump-tap.py <version> <SHA256SUMS> <Formula/amont-agent.rb>
"""

import pathlib
import re
import sys


def main() -> None:
    version, sums_path, formula_path = sys.argv[1:4]
    version = version.lstrip("v")

    sums: dict[str, tuple[str, str]] = {}
    for line in pathlib.Path(sums_path).read_text().splitlines():
        parts = line.split()
        if len(parts) != 2:
            continue
        sha, name = parts
        m = re.fullmatch(r"amont-agent-([0-9.]+)-(.+?)\.(?:tar\.gz|zip)", name)
        if not m:
            continue
        assert m.group(1) == version, (
            f"SHA256SUMS is for {m.group(1)}, not {version} — wrong release?"
        )
        sums[m.group(2)] = (sha, name)
    assert sums, f"no amont-agent checksums parsed from {sums_path}"

    formula = pathlib.Path(formula_path)
    text = formula.read_text()
    text, n_version = re.subn(
        r'version "[0-9.]+"', f'version "{version}"', text, count=1
    )
    assert n_version == 1, "the formula carries no version line"

    def rewrite(m: "re.Match[str]") -> str:
        target = m.group("target")
        assert target in sums, (
            f"the formula wants {target} and this release did not publish it"
        )
        sha, name = sums[target]
        return (
            f'url "https://github.com/fredericrous/amont-agent/releases/'
            f'download/v{version}/{name}"'
            f'{m.group("mid")}sha256 "{sha}"'
        )

    pair = re.compile(
        r'url "https://github\.com/fredericrous/amont-agent/releases/'
        r'download/v[0-9.]+/amont-agent-[0-9.]+-(?P<target>[a-z0-9_-]+)\.tar\.gz"'
        r'(?P<mid>\s+)sha256 "[0-9a-f]{64}"'
    )
    text, n = pair.subn(rewrite, text)
    assert n == 4, f"expected 4 url/sha pairs in the formula, rewrote {n}"

    stale = set(re.findall(r"amont-agent-([0-9.]+)-", text)) - {version}
    assert not stale, f"stale release versions survived the rewrite: {stale}"

    formula.write_text(text)
    print(f"formula -> {version} ({n} targets)")


main()