[DEV-387] Add Homebrew tap trust documentation and guidelines - #5
Draft
YairLeshemOctopus wants to merge 1 commit into
Draft
[DEV-387] Add Homebrew tap trust documentation and guidelines#5YairLeshemOctopus wants to merge 1 commit into
YairLeshemOctopus wants to merge 1 commit into
Conversation
This commit addresses the Homebrew 6.0.0+ tap trust requirement by: 1. Updated README.md with clear trust instructions for users - Added separate sections for Homebrew 6.0+ and earlier versions - Provided examples for trusting entire tap vs specific formulae - Documented both codefresh and cf2 formulae 2. Created SECURITY.md documenting: - Why tap trust is required - How to trust the tap (whole tap or specific formulae) - How to verify and revoke trust - Security best practices - Vulnerability reporting process 3. Created CONTRIBUTING.md with: - Guidelines for updating formulae - Local testing instructions with tap trust - Pull request process - Security considerations - Suggested GitHub Actions workflow for future implementation These changes ensure users are properly informed about the tap trust requirement and know how to safely install Codefresh CLI tools from this tap with Homebrew 6.0.0+ and 5.2.0+. Note: A GitHub Actions workflow for formula validation is recommended but requires the 'workflow' scope to push. This can be added separately by a maintainer with appropriate permissions. Linear issue: https://linear.app/octopus/issue/DEV-387/codefresh-io-cli-tap-is-not-trusted-in-homebrew
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear issue: https://linear.app/octopus/issue/DEV-387/codefresh-io-cli-tap-is-not-trusted-in-homebrew
Summary
This PR addresses the Homebrew 6.0.0+ tap trust requirement by providing comprehensive documentation and guidelines for users and maintainers.
Changes
1. Updated README.md
2. Created SECURITY.md
3. Created CONTRIBUTING.md
User Impact
Before: Users see warnings and are unsure how to proceed with installing codefresh or cf2.
After: Users have clear documentation showing exactly how to trust the tap and install the tools safely.