release: sync master with checksums-collision fix - #16
Merged
Conversation
v1.1.0's release run built all four platform binaries successfully,
but the published Homebrew formula ended up with empty macOS
checksums and stale Linux ones. Root causes, both in release.yml:
- Each matrix build job wrote to a file literally named
"checksums.txt" and uploaded it as part of its own artifact. The
"Publish GitHub Release" job downloads all artifacts into one
directory with merge-multiple: true, which silently overwrites
same-named files across artifacts — only the last-downloaded
platform's single line survived, so the "Update Homebrew formula
checksums" step's greps came back empty for three of four
platforms.
- homebrew/kshield.rb's Linux entries had been hand-edited to
hardcoded-looking (but never build-verified) sha256 values instead
of the REPLACE_AFTER_LINUX_*_BUILD placeholder tokens, so even when
the checksum *was* found, sed had nothing left to substitute.
Fixed by giving each matrix job's checksum file a per-target name
(checksums-${{ matrix.target }}.txt) so downloads no longer collide,
updating the merge step to glob them all in, and restoring the Linux
placeholder tokens.
v1.1.0's actual GitHub Release binaries were all built correctly —
only the formula metadata was wrong. Verified by downloading the
release's real tarballs and hashing them directly; ytt-global/tap's
homebrew-tap repo has been hand-corrected with those verified
checksums so `brew install ytt-global/tap/kshield` works now.
This was referenced Jul 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
e1be9b1, landed ondevafter PR release: sync master with PyPI Trusted Publishing fix #15 had already merged, so it never reachedmaster.What's in it
Fixes the release-pipeline checksum-collision bug that broke v1.1.0's Homebrew formula (all four platform binaries built fine, but the merged
checksums.txtonly kept one platform's entry due to same-named files colliding acrossactions/upload-artifactuploads). Also restores the LinuxREPLACE_AFTER_LINUX_*_BUILDplaceholder tokens inhomebrew/kshield.rbthat had been overwritten with unverified hardcoded hashes.Test plan