fix: harden tap bump against layout changes and bad downloads

[inureyes]

Problem

update_homebrew_formula.yml rewrote each checksum by line position:

gsed -i "/ARTIFACT\"/!b;n;c\      sha256 \"${sha}\""

It matched the url line, advanced one line (n), and replaced whatever it landed on (c\). Correct only while sha256 sits directly beneath url inside an on_macos / on_linux block, which is how Formula/all-smi.rb is written today.

lablup/mlxcel and lablup/bssh carried the same construct, all three copied from a common source. In mlxcel it went wrong: the formula moved its url to the top level with a version stanza in between, so the next bump overwrote version with the new checksum and left the previous release's sha256 below it:

  url ".../v0.4.3/mlxcel-macos-aarch64.zip"
      sha256 "dea8a5c2..."   # new hash, wrong indent, replaced `version`
  sha256 "83a0b702..."       # stale v0.4.2 hash, and this is the one that wins

No version stanza, two sha256 lines, brew install failing on checksum. Nothing validated the result and it sat broken in the tap for three days (lablup/homebrew-tap 9969ec4).

all-smi is not broken today, but it is one formula edit away from the same outcome. This is the last of the three copies.

Fix

Stanzas are located by name. set_artifact finds the url stanza whose value contains a given artifact, rewrites it, then rewrites the first sha256 stanza below it, preserving indentation. Anything in between is skipped rather than clobbered. Guards abort when the formula does not hold exactly one matching url, or when no sha256 follows it.

Two other faults, both shared with bssh and fixed the same way:

• curl -Ls with no -f. A missing or renamed asset produced a zero-byte file whose checksum went to the tap unnoticed. Now -f --retry 3, plus an empty-file check and an archive integrity check (unzip -t / tar -tzf).
• Unconditional git commit. Re-running for a version already in the tap failed on an empty index. It now exits cleanly.

A validation step runs ruby -c and brew style, checks the version stanza, and requires exactly the three checksums downloaded this run, which catches a substitution that silently no-ops.

Verification

test	result
bump Formula/all-smi.rb to a synthetic version	all three urls and checksums in the right place
validation replay (version, sha256 count, each sha present)	passes
brew style on the result	no offenses
workflow YAML parse	OK, 8 steps
live n;c\ constructs remaining	none, only the comment quoting the old form

ruby -c alone is not sufficient: the corrupted mlxcel formula was valid Ruby and passes a syntax check. That is why brew style is in the validation step.

Unrelated observation, deliberately left alone

The download base is still https://github.com/inureyes/all-smi, which works only through GitHub's rename redirect to lablup/all-smi. It also lands in the tap formula's url stanzas. Worth changing deliberately rather than as a side effect of this fix, since it alters what gets written to the tap.

Related

• fix: edit tap formula stanzas by name instead of line position mlxcel#949, where this construct had already caused the breakage described above.
• fix: harden tap bump against layout changes and bad downloads bssh#233, the same fix for the three bssh formulae.
• lablup/backend.ai-go#3962, stale cask and formula templates reverting hand-applied tap fixes.
• lablup/homebrew-tap 10facb2, repairing the damage in the tap.