Repository navigation
Conversation
…ps, add ghostty Adds a trusted_taps list to the developer and home profiles and a task that runs `brew tap --trust` style trust through community.general.homebrew_tap, because Homebrew 6.0.0 requires a non-official tap to be trusted before its formulae load. Drops the cursor cask from both profiles and adds the ghostty cask to them. Nothing uninstalls an existing Cursor.app; the role only installs. Decisions: - cursor stop being installable: changed, removed from developer and home cask lists, issue, tests/assert-package-lists.yml (casks tag) - existing Cursor.app removal: unchanged, the role has no removal task, base tasks/darwin.yml is install-only, tests/assert-package-lists.yml - taps trusted: hashicorp/tap and twilio/brew only, issue plus vars/main.yml taps list, tests/assert-package-lists.yml (taps tag) - aws/tap trusted: unchanged, not trusted, issue names two taps, tests/assert-package-lists.yml - lightweight taps and trust: unchanged, no taps so no trust task, base vars/main.yml lightweight map, tests/assert-package-lists.yml - profiles getting ghostty: developer and home only, issue plus install.sh option mapping, tests/assert-package-lists.yml (casks tag) - ghostty form: plain cask list entry like the other casks, plan answer from Chris, tests/assert-package-lists.yml - twilio and hashicorp formulae: unchanged, vars/main.yml, tests/assert-package-lists.yml (parity tag) Behavior changes only for: macOS developer and home runs (cursor no longer installed, ghostty installed, hashicorp/tap and twilio/brew trusted). Files in scope: defilan-osconfig/roles/defilan-osconfig/vars/main.yml, defilan-osconfig/roles/defilan-osconfig/tasks/darwin.yml, defilan-osconfig/requirements.yml, README.md, defilan-osconfig/roles/defilan-osconfig/README.md, defilan-osconfig/tests/assert-package-lists.yml Signed-off-by: Christopher Maher <chris@mahercode.io>
The vars-only assertions stayed green when the darwin trust task was deleted, its loop removed, or trust flipped to false, and the shared formula parity check asserted three memberships instead of the list. This reads the darwin and main task files and asserts there is exactly one trust task, imported from main.yml, looping per tap with trust true, and compares the full shared formula list. Review round 1. Settled: declined the qwen nit to add tests/ and the assert playbook to .github/workflows/shell_lint.yml, because the plan's Files in scope omit workflow files and the plan records that gap as a note; the test is manual and run from defilan-osconfig. The Ubuntu dry-run jobs already exercise the changed tasks. Evidence: plan Files in scope line, plan Consumers note on the CI dry run. Signed-off-by: Christopher Maher <chris@mahercode.io>
The trust-task play did not read the task's when guard, so deleting the guard (which breaks a default lightweight macOS run) left the file green. It now asserts the guard, and the three-tap loop is one assertion per property so each failure names the property. The README table moves ghostty into the Developer row instead of claiming it for every profile. Review round 2. Settled: the round-1 Settled claim "The Ubuntu dry-run jobs already exercise the changed tasks" was false, since main.yml imports darwin.yml only when os_family is Darwin and the macOS dry run is continue-on-error. Replaced, not relied on. Evidence: tasks/main.yml macOS import guard, .github/workflows/shell_lint.yml macOS job. Declined [earlier]-tagged nit on the trust task name over-promising (aws/tap non-official but not trusted): the name matches the task's effect on the two taps it lists, and the plan's Comments asked for it. Signed-off-by: Christopher Maher <chris@mahercode.io>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Three changes to the package lists the playbook installs:
cursoris no longer installed. It is dropped from thedeveloper(Option 2) andhome(Option 3) cask lists. Nothing uninstalls an existing copy; the role only installs.hashicorp/tapandtwilio/brewtaps are trusted before formulae load. Homebrew 6.0.0 introduced tap trust, and an untrusted third-party tap refuses to load: before this branch,brew info twilioreported "Refusing to load formula twilio/brew/twilio from untrusted tap".ghosttyis added to the Option 2 and Option 3 cask lists.Why
twiliois installed fromtwilio/brew, and the tap is tapped but untrusted, which is the case the new trust step fixes.cursorcomes out andghosttygoes in on the two profiles Chris asked for.How
5c018bffeat(brew): stop installing cursor, trust the hashicorp and twilio taps, add ghosttyvars/main.yml: adds_shared_trusted_taps(hashicorp/tap, twilio/brew), attaches it astrusted_tapstodeveloperandhome, swapscursorforghosttyin both cask lists.tasks/darwin.yml: a "Trust non-official Homebrew taps" task looping overtrusted_tapswithtrust: true.requirements.yml: collection floor>=8.0.0to>=13.3.0, the version that added the module'strustoption.README.mdand the role README restate the taps and put the casks in a per-profile table.tests/assert-package-lists.yml: assertions on the trust lists, the cask swaps, the lightweight profile, and the shared formula list.e23def2test(brew): pin the darwin trust task and the full formula listtasks/darwin.ymlandtasks/main.yml, so deleting the trust task, dropping its loop or flippingtrustfails them. Formula parity becomes the full list comparison.tasks/darwin.ymlchanges from a whole-listnametoname: "{{ item }}"with aloop.bacfea9test(brew): assert the trust task guard and restate the cask tablewhen: trusted_taps is definedguard, one assertion per property, and movesghosttyinto the README's Developer row.Design notes, from the commit ledgers:
trusted_tapsis separate fromhomebrew_tapsso that trusting is limited to the two taps asked for.aws/tapstays tapped and untrusted, which blocks nothing:awscliandaws-sam-clicome from core.lightweightprofile has nohomebrew_taps, so it gets notrusted_tapsand the trust task skips. Its casks are unchanged.ghosttyis a plain list entry like every other cask, not a separate step.Verification
ansible-playbook tests/assert-package-lists.ymlfromdefilan-osconfigpasses (9 tasks, 0 failed). Onorigin/mainthe same file fails on the trust lists, onghosttyandcursor, and on the darwin trust task.ansible-playbook playbook.yml --syntax-checkpasses,yamllintwith the CI rule set passes, andansible-linton the changed directories reports 0 failures. Falsification: removing each property (the trust list,ghostty, the task, its loop, itstrust, itswhen, the import) turns the file red.A real
-e config=developerrun on Chris's Mac installed theghosttycask andbrew trust --json=v1listedhashicorp/tapandtwilio/brew. Thecursorremoval only shows on a machine that does not already have it, so it was not observed here.Not done, and open for a follow-up:
requirements.ymlnow requires ansible-core 2.18, becausecommunity.general13.3.0 declaresrequires_ansible: '>=2.18.0'. The role README still saysAnsible >= 2.14andmeta/main.ymlstill setsmin_ansible_version: "2.14".install.shnever runsansible-galaxy collection install -r defilan-osconfig/requirements.yml. Ansible 14.0.0 bundlescommunity.general13.0.1, which has notrustoption; 14.3.0 is the first release carrying 13.3.0.brew install ansibletakes the latest today, so the normal path works.tests/assert-package-lists.ymlor lintsdefilan-osconfig/tests/.AI assistance
Assisted-by: DeepSeek-V4.1-Flash-1017-heretic (served on a 3xGB10 cluster via LLMKube; roles: code, tests and commit messages, executing review: base-vs-head probes and mutation checks)
Assisted-by: qwen38-flash-next (served on an AMD Strix Halo; roles: read-only review)
Verified by the author: read diffs and supervised build
Checklist
defilan-osconfig/tests/assert-package-lists.yml)ansible-playbook tests/assert-package-lists.ymlpassesyamllintwith the CI rule set andansible-linton the changed directories)git commit -s)README.md,defilan-osconfig/roles/defilan-osconfig/README.md)