Add Homebrew cask configuration

[sj26]

I'd like to brew install buildkite/buildkite/buildkite-mcp-server. Goreleaser supports homebrew casks, and we have a homebrew tap, so let's switch it on!

On this branch, I ran:

$ goreleaser release --snapshot

This generates casks like:

# This file was generated by GoReleaser. DO NOT EDIT.
cask "buildkite-mcp-server" do
  desc "Model Context Protocol server for Buildkite"
  homepage "https://github.com/buildkite/buildkite-mcp-server"
  version "0.5.5-SNAPSHOT-51c2883"

  livecheck do
    skip "Auto-generated on release."
  end

  binary "buildkite-mcp-server"

  on_macos do
    on_intel do
      url "https://github.com/buildkite/buildkite-mcp-server/releases/download/v0.5.5/buildkite-mcp-server_Darwin_x86_64.tar.gz"
      sha256 "d380dcda54d4217be8a4004bd2fa0777ea772d0235e72580a3f5c7dea7f167df"
    end
    on_arm do
      url "https://github.com/buildkite/buildkite-mcp-server/releases/download/v0.5.5/buildkite-mcp-server_Darwin_arm64.tar.gz"
      sha256 "5ef3a3a38d11d85ae76ad0d896c6436605248503c5c2842b3abdd0740ddbd0ee"
    end
  end

  on_linux do
    on_intel do
      url "https://github.com/buildkite/buildkite-mcp-server/releases/download/v0.5.5/buildkite-mcp-server_Linux_x86_64.tar.gz"
      sha256 "1905a1c1accb1c508b25ad3da815ed03e5b2ce353d00dfc98c9a3cf288a52ce0"
    end
    on_arm do
      url "https://github.com/buildkite/buildkite-mcp-server/releases/download/v0.5.5/buildkite-mcp-server_Linux_arm64.tar.gz"
      sha256 "e7c43a14957501a136720066462d3224cdfa6089c0bb929915148307047d8f26"
    end
  end

  postflight do
    if system_command("/usr/bin/xattr", args: ["-h"]).exit_status == 0
      system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/buildkite-mcp-server"]
    end
  end

  # No zap stanza required
end

I copy pasted this into my local clone of the tap, adjusted it to the latest official v0.5.5 artifacts, and it works a treat:

$ brew install buildkite/buildkite/buildkite-mcp-server
==> Auto-updating Homebrew...
Adjust how often this is run with HOMEBREW_AUTO_UPDATE_SECS or disable with
HOMEBREW_NO_AUTO_UPDATE. Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).
==> Downloading https://github.com/buildkite/buildkite-mcp-server/releases/download/v0.5.5/buildkite-mcp-server_Darwin_arm64.tar.gz
Already downloaded: /Users/sj26/Library/Caches/Homebrew/downloads/e4ea39ee1b140052feff876f6ae31313b6296b54301e6ee57f615cf850469731--buildkite-mcp-server_Darwin_arm64.tar.gz
==> Installing Cask buildkite-mcp-server
==> Linking Binary 'buildkite-mcp-server' to '/opt/homebrew/bin/buildkite-mcp-server'
🍺  buildkite-mcp-server was successfully installed!

$ buildkite-mcp-server --version
0.5.5

I'll go update our tap to support formulae and casks, and add an initial cask based on the already released version.

I suspect we'll need to give our release pipeline permission to cut a new cask. I presume it already has some form of GitHub credential. We might need to adjust this to open a PR, I don't think it'll be able to push straight to main.

How do you test this release process nicely? Can we do a snapshot release or something?

[sj26]

Updated goreleaser (and ko while we're in there) for homebrew cask support.

[catkins]

I think you can manually tag on your branch and it should kick off the pipeline. Might need to adjust the branch protection rules on the other repo though.

I know @lucaswilric had played with similar GitHub permissions stuff elsewhere for a different project, although I can't remember which one off hand.

[sj26]

It looks like we might be able to push straight to master in that repo:

https://github.com/buildkite/homebrew-buildkite/commits/master

There's at least a linear history of commits by "buildkite-agent-releaser" and "goreleaserbot" (goreleaser's default commit identity). Neither seem to correspond to actual GitHub users.

We do homebrew releases for test-engine-client:

https://github.com/buildkite/test-engine-client/blob/main/.goreleaser.yaml#L28-L40

That's using a GitHub token stored in SSM:

https://github.com/buildkite/test-engine-client/blob/main/.buildkite/pipeline.release.yml#L19

Will need to dig to figure out the principal.

[sj26]

Oh I'm just failing at using GitHub's UI.

https://github.com/buildkite-agent-releaser exists.

So does https://github.com/goreleaserbot.

The former is probably committer and pusher. The latter must be a committer, not sure of the pusher.

[sj26]

buildkite/test-engine-client#138

[sj26]

I shall take my own advice. Once I had a GitHub token I think can do the right thing.

[sj26]

We already have a GitHub token via aws assume identity and ssm, similar to test engine client:

https://github.com/buildkite/buildkite-mcp-server/blob/13be873187b0d20944ca68ce8e810c37f61c6036/.buildkite/pipeline.release.yml#L45C27-L45C89

[sj26]

Confirmed, this release pipeline has a fine grained GitHub token with access to the homebrew tap.

So I think this can be merged, and the next release will tell us if it's configured correctly - I think so!