Feature: make scorecard brew formula

[developer-guy]

Is your feature request related to a problem? Please describe.
This is not related to a problem.

Describe the solution you'd like

scorecard project already creates releases by using the GoReleaser project, so, GoReleaser has already support for creating brew formulas for free¹. The thing that needs to be done is just create a repository for storing these formulas called tap.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context

• https://appliedgo.net/release2/

please feel free to assign this to me, we can do this 🙋🏻‍♂️

cc: @naveensrinivasan @Dentrax

Footnotes

1. https://goreleaser.com/customization/homebrew/ ↩

[naveensrinivasan]

I agree, this would be a great addition. But I don't think we have time now to maintain another repository and a project.
@azeemshaikh38 @laurentsimon Thoughts

[laurentsimon]

agreed. We d'love to have it, but we don't have the resources to take it on ourselves right now.
Thanks for the suggestion @developer-guy

[developer-guy]

There is no need to maintain a repository btw because it will only hold these formulas. So, create a repository, and name it as homebrew-tap, that's all we need to do. Then, all these formulas will be created by the GoReleaser and pushed to that repository. Feel free to assign it to me, I'd love to do this.

@naveensrinivasan @laurentsimon

[laurentsimon]

Can the homebrew-tap live in the same repo or does it need to live on its own?

cc @haydentherapper

[developer-guy]

just place it under ossf organization, that's all I need IMHO.

[developer-guy]

once you do this, I'll add the necessary section for releasing HomeBrew formulas with GoReleaser.

[naveensrinivasan]

The issue is that once we create the repo, there are going to be questions and issues which is something we have to take it up. That is my apprehension.

[developer-guy]

I don't think so until we change the way we work with this repository, because this repository is going to be maintained by the GoReleaser only.

[naveensrinivasan]

I don't think so until we change the way we work with this repository, because this repository is going to be maintained by the GoReleaser only.

I agree, but there are going to be users who are going to ask for some support. The way in which we integrate goreleaser we might break that integration. We need to test it part of every release. All of these are kinds of chores.

[developer-guy]

I can maintain this repository if you want 🤩

[azeemshaikh38]

I can maintain this repository if you want 🤩

That's very generous of you @developer-guy! Thank you for offering :) I would be very happy to have this feature for Scorecard. I vote that we go ahead with this. @laurentsimon @naveensrinivasan wdyt?

[laurentsimon]

Go for it, yeah! So we just need to create a ossf/scorecard-tap repo?

[developer-guy]

it makes sense, I think there is no restriction about the naming, but I'm not sure about that.

https://docs.brew.sh/Taps#repository-naming-conventions-and-assumptions

[naveensrinivasan]

Let me know the repo name, I can create one.

[developer-guy]

I think it must be in the form of homebrew-<something>.

[developer-guy]

like https://github.com/sigstore/homebrew-tap

[naveensrinivasan]

How about homebrew-scorecard-tap?

[azeemshaikh38]

Or scorecard-homebrew-tap? Since we already have scorecard-actions, it will seem more like a standard/follows a convention.

[developer-guy]

I think it must start with the homebrew- prefix, and the rest does not matter.

On GitHub, your repository must be named homebrew-something to use the one-argument form of brew tap. The prefix “homebrew-“ is not optional. (The two-argument form doesn’t have this limitation, but it forces you to give the full URL explicitly.)

based on: https://docs.brew.sh/Taps#repository-naming-conventions-and-assumptions

[azeemshaikh38]

I see. Then, maybe homebrew-scorecard? With this, users should be able to invoke homebrew tap ossf/scorecard, right?

[developer-guy]

Users might be able to install for example scorecard like the following way if we name this repository homebrew-scorecard:

brew tap ossf/scorecard
brew install scorecard

but if we name it like this homebrew-tap, the command will become this:

brew tap ossf/tap
brew install scorecard

[naveensrinivasan]

What if ossf wants to support other brew packages? We need to think about that.

[azeemshaikh38]

Users might be able to install for example scorecard like the following way if we name this repository homebrew-scorecard

That sounds great. My vote is for this option since its very intuitive and provides a better developer experience.

What if ossf wants to support other brew packages? We need to think about that.

Those repos will be called homebrew-*. For example, homebrew-allstar. Wdyt?

[developer-guy]

Nope, there must be one repository for the organization to include all the formulas for projects maintained by the organization. So, we should create one repository, as I mentioned above, like homebrew-tap, we shouldn't use the tool name within the repository name.

[developer-guy]

I think the most suitable name for this is ossf/homebrew-tap btw.

[developer-guy]

tap and formulas are two different things, tap means a repository for holding formulas, think that way.

[naveensrinivasan]

My vote is homebrew-tap.

[azeemshaikh38]

tap and formulas are two different things, tap means a repository for holding formulas, think that way.

I see, didn't realize this was an org-wide thing. Ok, I also vote for homebrew-tap then.

[developer-guy]

Okay, then lets create the repository, and we can start working on this 🙋🏻‍♂️🤝

[naveensrinivasan]

https://github.com/ossf/homebrew-tap created. @developer-guy I have sent the invite to you for the repository.

[azeemshaikh38]

Thanks Naveen!

[developer-guy]

Let's give try through the demo repository

• https://github.com/developer-guy/scorecard/runs/4449079235?check_suite_focus=true
• https://github.com/developer-guy/homebrew-tap

[developer-guy]

you can run:

$ brew tap developer-guy/tap
$ brew install scorecard

[developer-guy]

[developer-guy]

yay! 🥳 @naveensrinivasan @azeemshaikh38

[naveensrinivasan]

Cool do a PR! But what permission does the action needs to write to the other repository?

[developer-guy]

just GitHub token IMHO, I used my own PAT to do that.

[naveensrinivasan]

closing it because we have scorecard brew packages.