Add constrained install commands (9/24)#23186
Draft
MikeMcQuaid wants to merge 5 commits into
Draft
Conversation
MikeMcQuaid
force-pushed
the
install-step-08-formula-permissions
branch
from
July 20, 2026 07:22
3aa531a to
6d02e59
Compare
MikeMcQuaid
force-pushed
the
install-step-09-commands
branch
from
July 20, 2026 07:22
504b56b to
6a4f7bd
Compare
This was referenced Jul 20, 2026
The runtime DSL already supports scoped guards, template identifiers and `move_contents`, but the validator rejects them. This blocks incremental tap migrations which use those existing APIs. - validate nested platform and path guard blocks recursively - allow formula and cask identifiers in serialised step strings - accept `move_contents` in formula and cask step blocks - continue rejecting arbitrary Ruby inside nested scopes
Many cask flight hooks only write a fixed launcher and link it into the configured binary directory. - generate executable wrapper content as a first-class cask artifact - reuse binary linking, collision and uninstall behaviour - serialise the stanza so cask JSON preserves its definition
Some cask flight hooks only materialise a fixed helper before another artifact or install step consumes it. - write literal executable content as a serialisable cask artifact - restrict generated paths to the staged cask and reject traversal - order generated scripts before dependent installer artifacts
Three core formulae adjust modes on persistent paths after installation but do not need ownership changes or arbitrary Ruby. - admit the existing `set_permissions` step in formula blocks - keep `set_ownership` limited to cask blocks - document and audit the formula capability explicitly
Many remaining hooks invoke one packaged or system executable and do not need a Ruby block or shell command string. - serialise literal arguments, environments, streams and directories - resolve path bases, templates and guards through shared contexts - make privilege, output and required-success policies explicit - replace the one-use GIO action with the general command step
MikeMcQuaid
force-pushed
the
install-step-08-formula-permissions
branch
from
July 21, 2026 07:14
6d02e59 to
a689849
Compare
MikeMcQuaid
force-pushed
the
install-step-09-commands
branch
from
July 21, 2026 07:14
6a4f7bd to
33670fb
Compare
MikeMcQuaid
force-pushed
the
install-step-08-formula-permissions
branch
from
July 21, 2026 12:02
a689849 to
9ad0321
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Many remaining hooks invoke one packaged or system executable and do not
need a Ruby block or shell command string.
AI disclosure: using OpenAI Codex 5.6 Sol max with local review and
testing.