Installation

Package Managers

npm install -g rulesync

# And then
rulesync --version
rulesync --help

Homebrew (macOS and Linux)

rulesync ships a self-contained Homebrew tap inside this repository. Because the repository is not named homebrew-rulesync, you must use the two-argument brew tap <name> <url> form to add it — the auto-tap shorthand brew install dyoshikawa/rulesync/rulesync cannot resolve it on its own:

brew tap dyoshikawa/rulesync https://github.com/dyoshikawa/rulesync
brew install rulesync

# And then
rulesync --version

The formula installs the prebuilt binary for your platform (macOS/Linux, arm64 and x64), so it does not depend on a Node.js runtime. It is updated as part of each release. Homebrew does not support Windows; use npm or the single-binary download below there.

Single Binary

Download pre-built binaries from the latest release. These binaries are built using Bun's single-file executable bundler.

Quick Install (Linux/macOS - No sudo required):

curl -fsSL https://github.com/dyoshikawa/rulesync/releases/latest/download/install.sh | bash

Options:

• Install specific version: curl -fsSL https://github.com/dyoshikawa/rulesync/releases/latest/download/install.sh | bash -s -- v6.4.0
• Custom directory: RULESYNC_HOME=~/.local curl -fsSL https://github.com/dyoshikawa/rulesync/releases/latest/download/install.sh | bash

Manual installation (requires sudo)

Linux (x64)

curl -L https://github.com/dyoshikawa/rulesync/releases/latest/download/rulesync-linux-x64 -o rulesync && \
  chmod +x rulesync && \
  sudo mv rulesync /usr/local/bin/

Linux (ARM64)

curl -L https://github.com/dyoshikawa/rulesync/releases/latest/download/rulesync-linux-arm64 -o rulesync && \
  chmod +x rulesync && \
  sudo mv rulesync /usr/local/bin/

macOS (Apple Silicon)

curl -L https://github.com/dyoshikawa/rulesync/releases/latest/download/rulesync-darwin-arm64 -o rulesync && \
  chmod +x rulesync && \
  sudo mv rulesync /usr/local/bin/

macOS (Intel)

curl -L https://github.com/dyoshikawa/rulesync/releases/latest/download/rulesync-darwin-x64 -o rulesync && \
  chmod +x rulesync && \
  sudo mv rulesync /usr/local/bin/

Windows (x64)

Invoke-WebRequest -Uri "https://github.com/dyoshikawa/rulesync/releases/latest/download/rulesync-windows-x64.exe" -OutFile "rulesync.exe"; `
  Move-Item rulesync.exe C:\Windows\System32\

Or using curl (if available):

curl -L https://github.com/dyoshikawa/rulesync/releases/latest/download/rulesync-windows-x64.exe -o rulesync.exe && \
  mv rulesync.exe /path/to/your/bin/

Verify checksums

curl -L https://github.com/dyoshikawa/rulesync/releases/latest/download/SHA256SUMS -o SHA256SUMS

# Linux/macOS
sha256sum -c SHA256SUMS

# Windows (PowerShell)
# Download SHA256SUMS file first, then verify:
Get-FileHash rulesync.exe -Algorithm SHA256 | ForEach-Object {
  $actual = $_.Hash.ToLower()
  $expected = (Get-Content SHA256SUMS | Select-String "rulesync-windows-x64.exe").ToString().Split()[0]
  if ($actual -eq $expected) { "✓ Checksum verified" } else { "✗ Checksum mismatch" }
}

Verify build provenance

Release binaries carry GitHub Artifact Attestations, so you can check that the file you downloaded really was built by this repository's release workflow. This needs the GitHub CLI v2.49.0 or later, which is where gh attestation was introduced, and a signed-in CLI (gh auth login) — verification queries the API even for a public repository.

# Linux/macOS — the path the steps above installed the binary to
gh attestation verify /usr/local/bin/rulesync \
  --repo dyoshikawa/rulesync \
  --signer-workflow dyoshikawa/rulesync/.github/workflows/publish-assets.yml

# Windows
gh attestation verify C:\Windows\System32\rulesync.exe `
  --repo dyoshikawa/rulesync `
  --signer-workflow dyoshikawa/rulesync/.github/workflows/publish-assets.yml

Pass the path you actually installed the binary to. The command identifies the file by its contents, not by its name, so renaming it during installation — which the steps above do — does not affect verification; a binary installed by install.sh or Homebrew is the same file and verifies the same way. --repo alone only proves the attestation came from this repository, so --signer-workflow is included to pin the workflow that signed it.

This covers the release binaries. The npm package carries npm's own provenance attestation instead, which is checked with npm audit signatures rather than gh attestation verify.