🚀 Package Preview Available!

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.0.42-pr.404.3910440

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.0.42-pr.404.3910440"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.0.42-pr.404.3910440"
  }
}

• 📦 Preview Package: @base44-preview/cli@0.0.42-pr.404.3910440
• 🔗 View this commit on GitHub

_{Preview published to npm registry — try new features instantly!}

@claude please go over the changes to the github action (manual-publish) and try to find issues that might happen after i merge this?

Claude finished @kfirstri's task in 2m 48s —— View job

Review of manual-publish.yml changes

• Read the changed files
• Analyze for potential issues
• Post review findings

Here are the issues I found, ordered by severity:

🔴 Issue 1 — Hardcoded master branch in update-tap.sh

File: packages/cli/infra/homebrew/update-tap.sh:44

git push origin master

If base44/homebrew-tap uses main as its default branch (GitHub's current default for new repos), this push will fail with a src refspec master does not match any error. This would silently leave the Homebrew formula out-of-date on every release.

Fix: Use the actual default branch, or make it configurable:

git push origin HEAD

Fix this →

🔴 Issue 2 — Token scope may not cover cross-repo operations

File: .github/workflows/manual-publish.yml:37-41

The generate-token step creates a GitHub App token with no owner or repositories scope:

- name: Generate a token
  id: generate-token
  uses: actions/create-github-app-token@v2
  with:
    app-id: ${{ vars.BASE44_GITHUB_ACTIONS_APP_ID }}
    private-key: ${{ secrets.BASE44_GITHUB_ACTIONS_APP_PRIVATE_KEY }}

By default, actions/create-github-app-token scopes the token to the current repository (base44/cli) only. This token is now being reused for two cross-repo operations:

1. Update Homebrew Tap (line 152-156) — clones and pushes to base44/homebrew-tap
2. Notify skills repo (line 158-170) — dispatches to base44/skills

The old workflow handled this by creating a separate scoped token for the skills dispatch:

- name: Generate token for skills repo
  uses: actions/create-github-app-token@v2
  with:
    app-id: ${{ vars.BASE44_GITHUB_ACTIONS_APP_ID }}
    private-key: ${{ secrets.BASE44_GITHUB_ACTIONS_APP_PRIVATE_KEY }}
    owner: base44
    repositories: skills  # explicitly scoped

The fact that a separate scoped token was used before strongly suggests the default token does not have cross-repo access. Both the Homebrew tap push and the skills dispatch will likely fail with authentication errors after merging.

Fix: Check if the GitHub App is installed at the org level with access to all repos. If not, either keep scoped tokens per repo, or generate a single org-level token:

uses: actions/create-github-app-token@v2
with:
  app-id: ${{ vars.BASE44_GITHUB_ACTIONS_APP_ID }}
  private-key: ${{ secrets.BASE44_GITHUB_ACTIONS_APP_PRIVATE_KEY }}
  owner: base44  # org-level token

🟡 Issue 3 — gh release create with unquoted glob fails if no files exist

File: .github/workflows/manual-publish.yml:149

${{ env.CLI_PACKAGE_DIR }}/dist/binaries/base44-*.tar.gz)

The glob is shell-expanded at runtime. If no .tar.gz files are found (e.g., build:binaries failed silently), the shell passes the literal glob string to gh, which will then fail with a cryptic "file not found" error rather than a clear build error.

This is low risk if the build always produces files, but worth being aware of.

🟡 Issue 4 — sed -i incompatible with macOS (local dev only)

File: packages/cli/infra/homebrew/update-tap.sh:24-28

sed -i "s/version \".*\"/version \"$VERSION\"/" /tmp/base44.rb

On macOS, sed -i requires an explicit (possibly empty) backup extension: sed -i '' "...". Without it, macOS sed will error out. This doesn't affect CI (ubuntu-latest), but anyone trying to run the script locally on macOS will hit this. Adding a comment in the usage docs or using gsed would help.

🟢 Issue 5 — Minor: RELEASE_URL env var used in a JSON payload

File: .github/workflows/manual-publish.yml:168

"release_url": "${{ env.RELEASE_URL }}",

RELEASE_URL is set via echo "RELEASE_URL=$RELEASE_URL" >> $GITHUB_ENV where $RELEASE_URL comes from gh release create output. GitHub Actions env vars in expression context are not JSON-escaped, so if the URL somehow contains special characters it could break the JSON payload. In practice this is fine since GitHub URLs are well-formed, but it's worth noting.

Summary

Issues 1 and 2 are the ones most likely to cause real failures after merging. I'd recommend checking the branch name of homebrew-tap and verifying whether the default generate-token has org-wide access before merging.