fix(release): publish Homebrew formula to tap in announce job

[robdefeo]

Summary

• GITHUB_TOKEN is scoped to the current repo and cannot push to robdefeo/homebrew-tap
• The announce job was generated empty by cargo-dist with no publish step
• Adds a step to download the generated .rb formula from the release and push it to the tap using HOMEBREW_TAP_TOKEN

Test plan

• Merge, re-cut the release, verify robdefeo/homebrew-tap contains Formula/voxscribe.rb
• Verify brew tap robdefeo/tap && brew install voxscribe works

[greptile-apps]

Greptile Summary

This PR fixes the announce job in the cargo-dist–generated release workflow by adding a step that downloads the generated Homebrew formula from the GitHub release and pushes it to robdefeo/homebrew-tap using a dedicated HOMEBREW_TAP_TOKEN PAT. This is the correct approach because the default GITHUB_TOKEN is scoped to the current repository and cannot push to a separate tap repository.

Key changes and observations:

• Adds a \"Publish Homebrew formula\" step to the announce job that downloads *.rb artifacts from the release, clones the tap repo via a PAT, copies the formula into Formula/, and pushes the commit.
• P1: git commit is not guarded — if the formula file is identical to the one already in the tap (e.g., re-triggered workflow), git commit will exit with code 1 and fail the job. The commit should be conditional on git diff --staged having changes.
• P2: The run block does not set set -euo pipefail, so failures in early commands (e.g., gh release download finding no .rb files) will silently allow subsequent commands to proceed.

Confidence Score: 4/5

Safe to merge after addressing the unguarded git commit that will fail the job on re-runs or unchanged formulas.

The approach is correct and well-scoped. One P1 issue exists: the unguarded git commit will cause the announce job to fail whenever the formula hasn't changed (e.g., a re-triggered workflow). This is a one-line fix. The P2 (missing pipefail) is best practice but not blocking.

.github/workflows/release.yml — specifically the unguarded git commit at lines 307-309.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds Homebrew tap publishing step to the announce job using a PAT (HOMEBREW_TAP_TOKEN); one P1 issue — unguarded git commit will fail if the formula is unchanged.

Sequence Diagram

sequenceDiagram
    participant GHA as GitHub Actions announce job
    participant VoxRelease as robdefeo/voxscribe Release
    participant TapRepo as robdefeo/homebrew-tap

    GHA->>VoxRelease: gh release download tag pattern .rb
    VoxRelease-->>GHA: voxscribe.rb formula

    GHA->>TapRepo: git clone via HOMEBREW_TAP_TOKEN
    TapRepo-->>GHA: cloned repo

    GHA->>GHA: cp formula to homebrew-tap/Formula/
    GHA->>TapRepo: git add + commit + push
    TapRepo-->>GHA: push confirmed

Loading

Prompt To Fix All With AI

This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 307-309

Comment:
**`git commit` will fail if formula is unchanged**

If the formula file pushed to the release is byte-for-byte identical to the one already in the tap (e.g. a re-triggered workflow, or a release that didn't change the formula), `git add` will stage nothing and `git commit` will exit with code 1 ("nothing to commit"), failing the job. Guard the commit so the step only commits when there is actually a diff:

```suggestion
          git add Formula/
          git diff --staged --quiet || git commit -m "Update voxscribe formula to ${{ needs.plan.outputs.tag }}"
          git diff --staged --quiet || git push
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 299

Comment:
**No strict error mode — silent failures possible**

The script does not start with `set -euo pipefail`. If `gh release download` fails (e.g., no `.rb` artifact exists in the release), or if `cp formula/*.rb` finds no files, subsequent commands will continue executing and may produce confusing results or an incomplete push. Adding `set -euo pipefail` as the first line of the `run` block will cause the step to fail fast on the first error.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(release): publish Homebrew formula t..." | Re-trigger Greptile}

[greptile-apps]

git commit will fail if formula is unchanged

If the formula file pushed to the release is byte-for-byte identical to the one already in the tap (e.g. a re-triggered workflow, or a release that didn't change the formula), git add will stage nothing and git commit will exit with code 1 ("nothing to commit"), failing the job. Guard the commit so the step only commits when there is actually a diff:

Suggested change

	git add Formula/
	git commit -m "Update voxscribe formula to ${{ needs.plan.outputs.tag }}"
	git push
	git add Formula/
	git diff --staged --quiet || git commit -m "Update voxscribe formula to ${{ needs.plan.outputs.tag }}"
	git diff --staged --quiet || git push

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 307-309

Comment:
**`git commit` will fail if formula is unchanged**

If the formula file pushed to the release is byte-for-byte identical to the one already in the tap (e.g. a re-triggered workflow, or a release that didn't change the formula), `git add` will stage nothing and `git commit` will exit with code 1 ("nothing to commit"), failing the job. Guard the commit so the step only commits when there is actually a diff:

```suggestion
          git add Formula/
          git diff --staged --quiet || git commit -m "Update voxscribe formula to ${{ needs.plan.outputs.tag }}"
          git diff --staged --quiet || git push
```

How can I resolve this? If you propose a fix, please make it concise.

[robdefeo]

Won't fix — .github/workflows/release.yml is autogenerated by cargo-dist; we're keeping manual additions minimal to avoid drift on regeneration.

[greptile-apps]

No strict error mode — silent failures possible

The script does not start with set -euo pipefail. If gh release download fails (e.g., no .rb artifact exists in the release), or if cp formula/*.rb finds no files, subsequent commands will continue executing and may produce confusing results or an incomplete push. Adding set -euo pipefail as the first line of the run block will cause the step to fail fast on the first error.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 299

Comment:
**No strict error mode — silent failures possible**

The script does not start with `set -euo pipefail`. If `gh release download` fails (e.g., no `.rb` artifact exists in the release), or if `cp formula/*.rb` finds no files, subsequent commands will continue executing and may produce confusing results or an incomplete push. Adding `set -euo pipefail` as the first line of the `run` block will cause the step to fail fast on the first error.

How can I resolve this? If you propose a fix, please make it concise.

[robdefeo]

Won't fix — same reason as above; release.yml is autogenerated by cargo-dist and we're keeping the manual step simple.