How do I install the Brew Publish skill?

Run npx skillmds@latest add socketdev/brew-publish in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Brew Publish safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Brew Publish?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Brew Publish free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Brew Publish?

socketdev (@socketdev) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Brew Publish by socketdev — Agent Skill

Name: Brew Publish
Author: socketdev

Brew Publish

Operate the socket-release Homebrew tap flow - the binary-download formula model, tap repo layout, formula bumps tied to published releases, and sha256 verification against the release's own checksums.txt. Use when bumping a Homebrew formula or standing up a tap for a Socket CLI.

socketdev dcc7f38 3.1 KB Updated Sep 17, 2026

File contents

Homebrew tap (binary-download formula)

Model: no bottles, no source build - the formula downloads the release's prebuilt per-platform tarballs by EXACT releases/download/v<version>/<asset> URL (never latest) and pins the sha256 the release's own checksums.txt vouched for. brew-publish NEVER hashes an asset itself; the manifest is the authority.

Tap layout (one-time, manual)

The tap repo (SocketDev/homebrew-socket) carries an unsharded Formula/ dir plus a README documenting tap trust:

export HOMEBREW_REQUIRE_TAP_TRUST=1
brew trust SocketDev/socket

The exact layout is modeled by release-kit/examples/brew-cli/tap-fixture/ in sauce. Creating the tap repo is a human act (repo creation rights) - note it plainly; there is no script.

Bump cycle

Prerequisite: the release is CUT - tag on origin, release published (not draft), all four platform assets uploaded, checksums.txt attached (the github-release flow produces all of this).

node scripts/socket-release/brew-publish.mts --tag vX.Y.Z            # dry-run plan
node scripts/socket-release/brew-publish.mts --tag vX.Y.Z --apply    # commit the bump

The tool refuses, in order, with exit 1 and zero writes: a tag not on origin (it never creates tags), a draft/missing release, a missing templated asset, a missing/incomplete checksums.txt. An identical formula is a no-op (already reads <version>, exit 0). --apply commits the formula DIRECT to the tap default branch with a GitHub-signed API commit (never a PR - the version-bump-PR shape is guard-blocked), then re-reads the tap: the committed bytes must parse back to the desired formula, or it exits 1 saved-state-unproven.

From CI, brew-publish.yml runs on release: published (or manual dispatch with tag + publish: true) and mints a per-run App token via the ./.github/actions/socket-release-app-token composite from the org-wide App credentials - org secrets are enterprise-wide; never treat them as missing setup or a human task.

sha256 verification

The formula's four sha256s come from checksums.txt - verify the chain, never re-hash locally as authority:

gh release download vX.Y.Z --pattern checksums.txt --output -

Both grammars count: plain <hex> <name> (shasum) and sha256: <hex> <name>, the kit release tail's form. A duplicate filename with differing hex is a hard refusal. After a bump, spot-check one platform: the url in Formula/<name>.rb must name the exact v<version> download path and its sha256 must equal the manifest line for that asset.

Auth moments (gate, never improvise)

Local --apply uses ambient gh auth: if gh auth status fails, the operator runs gh auth login (browser) - render the gate.
Manual audits run on an operator Mac: brew style / brew audit against the tap (deferred from CI).

---name: brew-publishdescription: Operate the socket-release Homebrew tap flow - the binary-download formula model, tap repo layout, formula bumps tied to published releases, and sha256 verification against the release's own checksums.txt. Use when bumping a Homebrew formula or standing up a tap for a Socket CLI.---# Homebrew tap (binary-download formula)Model: no bottles, no source build - the formula downloads the release'sprebuilt per-platform tarballs by EXACT`releases/download/v<version>/<asset>` URL (never `latest`) and pins thesha256 the release's own `checksums.txt` vouched for. brew-publish NEVERhashes an asset itself; the manifest is the authority.## Tap layout (one-time, manual)The tap repo (`SocketDev/homebrew-socket`) carries an unsharded `Formula/`dir plus a README documenting tap trust:```bashexport HOMEBREW_REQUIRE_TAP_TRUST=1brew trust SocketDev/socket```The exact layout is modeled by `release-kit/examples/brew-cli/tap-fixture/`in sauce. Creating the tap repo is a human act (repo creation rights) -note it plainly; there is no script.## Bump cyclePrerequisite: the release is CUT - tag on origin, release published (notdraft), all four platform assets uploaded, `checksums.txt` attached (thegithub-release flow produces all of this).```bashnode scripts/socket-release/brew-publish.mts --tag vX.Y.Z # dry-run plannode scripts/socket-release/brew-publish.mts --tag vX.Y.Z --apply # commit the bump```The tool refuses, in order, with exit 1 and zero writes: a tag not onorigin (it never creates tags), a draft/missing release, a missingtemplated asset, a missing/incomplete `checksums.txt`. An identical formulais a no-op (`already reads <version>`, exit 0). `--apply` commits theformula DIRECT to the tap default branch with a GitHub-signed API commit(never a PR - the version-bump-PR shape is guard-blocked), then re-readsthe tap: the committed bytes must parse back to the desired formula, or itexits 1 saved-state-unproven.From CI, `brew-publish.yml` runs on `release: published` (or manualdispatch with `tag` + `publish: true`) and mints a per-run App token viathe `./.github/actions/socket-release-app-token` composite from theorg-wide App credentials - org secrets are enterprise-wide; never treatthem as missing setup or a human task.## sha256 verificationThe formula's four sha256s come from `checksums.txt` - verify the chain,never re-hash locally as authority:```bashgh release download vX.Y.Z --pattern checksums.txt --output -```Both grammars count: plain `<hex> <name>` (shasum) and`sha256: <hex> <name>`, the kit release tail's form. A duplicate filename withdiffering hex is a hard refusal. After a bump, spot-check one platform:the `url` in `Formula/<name>.rb` must name the exact `v<version>` downloadpath and its `sha256` must equal the manifest line for that asset.## Auth moments (gate, never improvise)- Local `--apply` uses ambient `gh` auth: if `gh auth status` fails, the operator runs `gh auth login` (browser) - render the gate.- Manual audits run on an operator Mac: `brew style` / `brew audit` against the tap (deferred from CI).

Frequently asked questions