Place Formula checkout in Homebrew tap tree

[0x77dev]

Moves the authenticated tap checkout into Homebrew's canonical tap directory before invoking the updater, then leaves a workspace symlink for post-job cleanup. Homebrew therefore recognizes Formula/pdf.rb as signed-page/tap/pdf.\n\nVerified: actionlint .github/workflows/ci.yml; git diff --check.

[greptile-apps]

Confidence Score: 4/5

Not safe to merge until the workflow creates the canonical tap path’s parent directory before moving the checkout.

A focused execution reproduced the failing filesystem operation when the tap owner directory is absent and confirmed that creating the parent makes the same operation succeed.

Files Needing Attention: .github/workflows/ci.yml needs the destination-parent creation immediately before the tap checkout is moved.

T-Rex Logs

What T-Rex did

• T-Rex produced a proof for a posted P1 finding (proof 0), including a focused fresh-tap move reproduction script and related logs demonstrating failure when the tap parent is absent and success after creating the parent, plus the current Homebrew repository command source and the affected update-tap workflow lines.
• T-Rex produced a second P1 finding proof (proof 1).
• General contract validation confirms the tap-parent creation behavior, showing that the mv of the parent fails without a parent directory and succeeds after creating it, with supporting logs for the Homebrew tap_path source and the before/after tap-parent moves.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   Fresh runner cannot move fetched tap into Homebrew tap path

   • Bug
     • On a fresh runner where signed-page/tap has not previously been tapped, brew --repository signed-page/tap returns the prospective path under Library/Taps/signed-page/homebrew-tap, but does not create Library/Taps/signed-page. The workflow then runs mv "$tap_checkout" "$tap_path" and exits under set -e when that parent is absent, preventing update-tap from reaching brew trust or the release-branch update.
   • Cause
     • The PR removed mkdir -p "$(dirname "$tap_path")" while changing the workflow to move the checkout into the resolved Homebrew tap path. Homebrew's current --repository command is path construction/output only.
   • Fix
     • Restore mkdir -p "$(dirname "$tap_path")" immediately before .github/workflows/ci.yml:871's mv (after the occupancy check is also acceptable).

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "Place Formula checkout in Homebrew tap t..." | Re-trigger Greptile}

[greptile-apps]

Fresh tap parent directory is missing

On a fresh runner where signed-page/tap has not been installed, brew --repository signed-page/tap returns the prospective path under Library/Taps/signed-page/homebrew-tap without creating Library/Taps/signed-page. This mv therefore fails under set -e with “No such file or directory”, so the tap updater never runs and the release branch is not produced. Create the destination parent before moving the authenticated checkout.

Artifacts

Focused fresh-tap move reproduction script

• The executable reproduction creates a temporary checkout and models Homebrew’s resolved signed-page tap path, comparing the missing-parent and created-parent cases; it demonstrates the required parent creation.

Move fails when the fresh tap parent is absent

• The executed before run reports `parent_exists_before=no`, then `mv` fails with No such file or directory and exits 1; this proves the workflow's current placement step fails at the same filesystem scope.

Move succeeds after creating the tap parent

• The executed after run creates the parent before the same move, then reports `mv_exit=0`, no checkout at the old location, and a directory at the destination; this proves the minimal fix.

Current Homebrew repository command source

• The captured current upstream Homebrew command implementation shows `tap_path` only constructs and echoes the `Library/Taps/<user>/homebrew-<repo>` path; it does not create any directories.

Affected update-tap workflow lines

• The captured numbered workflow excerpt shows the resolved tap path, absent parent creation, and failing `mv` at line 871; this identifies the exact affected location.

_{Ran code and verified through T-Rex}