From 273a69608569b41b245e1c86987ce036d1c5af7d Mon Sep 17 00:00:00 2001
From: Algis Dumbris <gordon.greatests@gmail.com>
Date: Thu, 2 Jul 2026 06:39:53 +0300
Subject: [PATCH 1/2] ci: add lightweight brew style + audit on PRs

Adds a macos-latest GitHub Actions job that taps the checked-out repo and
runs brew style + brew audit --online against the cask and formula on every
pull_request and push to main. This machine-verifies cask/formula changes
(url/sha256, stanza style) without the heavy brew test-bot bottling pipeline
(no install, no bottling).
---
 .github/workflows/brew-test.yml | 42 +++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 .github/workflows/brew-test.yml

diff --git a/.github/workflows/brew-test.yml b/.github/workflows/brew-test.yml
new file mode 100644
index 0000000..9ccd1de
--- /dev/null
+++ b/.github/workflows/brew-test.yml
@@ -0,0 +1,42 @@
+name: brew style + audit
+
+# Lightweight tap CI: run `brew style` and `brew audit` on the cask and
+# formula so cask/formula changes are machine-verified on every PR/push.
+# Deliberately NOT the full `brew test-bot` bottling pipeline — no install,
+# no bottling. Casks are macOS-only, so this runs on macos-latest.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+# Cancel superseded runs on the same ref to save runner minutes.
+concurrency:
+  group: brew-test-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  brew-style-audit:
+    runs-on: macos-latest
+    steps:
+      - name: Check out tap
+        uses: actions/checkout@v4
+
+      - name: Set up Homebrew
+        uses: Homebrew/actions/setup-homebrew@master
+
+      - name: Tap the checked-out repo
+        run: brew tap smart-mcp-proxy/mcpproxy "$GITHUB_WORKSPACE"
+
+      - name: brew style (cask + formula)
+        run: brew style smart-mcp-proxy/mcpproxy
+
+      - name: brew audit (cask, online url/sha256)
+        run: brew audit --tap smart-mcp-proxy/mcpproxy --cask --online mcpproxy
+
+      - name: brew audit (formula, online url/sha256)
+        run: brew audit --tap smart-mcp-proxy/mcpproxy --formula --online mcpproxy

From a26dede493917bb3b1bfd915568606a15d40e709 Mon Sep 17 00:00:00 2001
From: Algis Dumbris <gordon.greatests@gmail.com>
Date: Thu, 2 Jul 2026 06:41:24 +0300
Subject: [PATCH 2/2] ci: symlink checkout into Homebrew taps dir instead of
 brew tap <path>

brew rejects `brew tap <name> <path>` for a named tap with a remote
mismatch on the runner; symlinking the checkout into the Taps directory
lets brew style/audit operate on the PR's files reliably.
---
 .github/workflows/brew-test.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/brew-test.yml b/.github/workflows/brew-test.yml
index 9ccd1de..fad0199 100644
--- a/.github/workflows/brew-test.yml
+++ b/.github/workflows/brew-test.yml
@@ -30,7 +30,15 @@ jobs:
         uses: Homebrew/actions/setup-homebrew@master
 
       - name: Tap the checked-out repo
-        run: brew tap smart-mcp-proxy/mcpproxy "$GITHUB_WORKSPACE"
+        # Link the checkout into Homebrew's Taps dir so `brew style`/`brew audit`
+        # operate on the PR's files. `brew tap <name> <path>` is rejected here
+        # because brew resolves the canonical GitHub remote for a named tap.
+        run: |
+          TAP_DIR="$(brew --repository)/Library/Taps/smart-mcp-proxy/homebrew-mcpproxy"
+          rm -rf "$TAP_DIR"
+          mkdir -p "$(dirname "$TAP_DIR")"
+          ln -s "$GITHUB_WORKSPACE" "$TAP_DIR"
+          brew tap  # sanity: list taps
 
       - name: brew style (cask + formula)
         run: brew style smart-mcp-proxy/mcpproxy