build: sync the Homebrew tap from the release workflow

The tap repo is a publish target like the snap store: the release
workflow rewrites the in-repo formula's url/sha256 for the release
tarball and pushes it to homebrew-ecrou. No token, no update — tags
still release.

.github/workflows/release.yml

@@ -101,6 +101,48 @@ jobs:
           name: ecrou-darwin-arm64
           path: dist/*
 
+  # The tap repo (vhaudiquet/homebrew-ecrou) is a publish target, not
+  # the source of truth: the formula is maintained in packaging/ and
+  # this job rewrites its url/sha256 for the release tarball and pushes
+  # it. Needs a PAT with push access to the tap repo as the
+  # HOMEBREW_TAP_TOKEN secret; without it the job is a no-op so tags
+  # still release.
+  update-homebrew:
+    needs: build-macos
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: ecrou-darwin-arm64
+          path: dist
+
+      - name: Push the formula to the tap
+        env:
+          TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [[ -z "$TAP_TOKEN" ]]; then
+            echo "::notice::no HOMEBREW_TAP_TOKEN secret set; tap not updated"
+            exit 0
+          fi
+          v="${GITHUB_REF_NAME#v}"
+          sha="$(cut -d' ' -f1 "dist/ecrou-v$v-darwin-arm64.tar.gz.sha256")"
+          url="https://github.com/vhaudiquet/ecrou/archive/refs/tags/v$v.tar.gz"
+          mkdir -p formula/Formula
+          sed -e 's|^  # Pinned by tag until the first release exists; switch to the$|  # Published by the ecrou release workflow; do not edit by hand.|'               -e '/^  # release tarball + sha256 then\.$/d'               -e "s|^  url \"https://github.com/vhaudiquet/ecrou.git\", tag: \"v0.1.0\"$|  url \"$url\"\n  sha256 \"$sha\"|" \
+            packaging/homebrew/Formula/ecrou.rb > formula/Formula/ecrou.rb
+          grep -q "sha256 \"$sha\"" formula/Formula/ecrou.rb
+          git clone -q "https://x-access-token:$TAP_TOKEN@github.com/vhaudiquet/homebrew-ecrou" tap
+          cp formula/Formula/ecrou.rb tap/Formula/ecrou.rb
+          cd tap
+          git add Formula/ecrou.rb
+          git -c user.name="ecrou-release" -c user.email="noreply@github.com" \
+            commit -m "ecrou $v"
+          git push -q
+
   publish-snap:
     needs: build-snap
     runs-on: ubuntu-latest

SPEC.md

@@ -334,7 +334,12 @@ runner; the release workflow ships a signed darwin-arm64 tarball.
 ## Homebrew
 
 `packaging/homebrew/Formula/ecrou.rb` installs into a
-`vhaudiquet/homebrew-ecrou` tap. The formula carries the runtime
+`vhaudiquet/homebrew-ecrou` tap — the repo name is what makes
+`brew install vhaudiquet/ecrou/ecrou` resolve without an explicit
+`brew tap`. The tap repo is a publish target, not the source of
+truth: the release workflow rewrites the formula's url/sha256 for
+the release tarball and pushes it (gated on a `HOMEBREW_TAP_TOKEN`
+PAT; without the secret the job no-ops). The formula carries the runtime
 dependencies (`libkrun` from the krun tap, `e2fsprogs`, `libarchive`),
 builds from source with cargo, and re-signs the binary with the
 entitlements plist from `packaging/macos/` — brew bottles are