build: sync the Homebrew tap from the release workflow

The tap repo is a publish target like the snap store: the release
workflow rewrites the in-repo formula's url/sha256 for the release
tarball and pushes it to homebrew-ecrou. No token, no update — tags
still release.
This commit is contained in:
vhaudiquet committed 2026-10-31 18:21:23 -05:00
1 parent 3844038d3a
commit a3b4dca2d9
2 files changed
+48 -1

No files matched your search

+6 -1
View File
@@ -334,7 +334,12 @@ runner; the release workflow ships a signed darwin-arm64 tarball.
## Homebrew
`packaging/homebrew/Formula/ecrou.rb` installs into a
`vhaudiquet/homebrew-ecrou` tap. The formula carries the runtime
`vhaudiquet/homebrew-ecrou` tap — the repo name is what makes
`brew install vhaudiquet/ecrou/ecrou` resolve without an explicit
`brew tap`. The tap repo is a publish target, not the source of
truth: the release workflow rewrites the formula's url/sha256 for
the release tarball and pushes it (gated on a `HOMEBREW_TAP_TOKEN`
PAT; without the secret the job no-ops). The formula carries the runtime
dependencies (`libkrun` from the krun tap, `e2fsprogs`, `libarchive`),
builds from source with cargo, and re-signs the binary with the
entitlements plist from `packaging/macos/` — brew bottles are