feat: auto-bump homebrew-tap on release (#6)

Adds bump-tap job to release workflow. After a GitHub release is
created, computes the new tarball SHA256 and pushes an updated formula
to 1shooperman/homebrew-tap via TAP_GITHUB_TOKEN secret.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 1shooperman

.github/workflows/release.yml

@@ -21,6 +21,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+    outputs:
+      version: ${{ steps.version.outputs.version }}
     steps:
       - name: Harden runner
         uses: step-security/harden-runner@v2
@@ -75,3 +77,46 @@ jobs:
             --verify-tag
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  bump-tap:
+    needs: release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+
+      - name: Checkout tap
+        uses: actions/checkout@v6
+        with:
+          repository: 1shooperman/homebrew-tap
+          token: ${{ secrets.TAP_GITHUB_TOKEN }}
+
+      - name: Compute SHA256
+        id: sha
+        run: |
+          VERSION="${{ needs.release.outputs.version }}"
+          URL="https://github.com/1shooperman/cli-tools/archive/refs/tags/${VERSION}.tar.gz"
+          SHA=$(curl -sL "$URL" | shasum -a 256 | awk '{print $1}')
+          echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
+          echo "url=${URL}" >> "$GITHUB_OUTPUT"
+
+      - name: Bump formula
+        run: |
+          VERSION="${{ needs.release.outputs.version }}"
+          sed -i "s|url \".*\"|url \"${{ steps.sha.outputs.url }}\"|" Formula/cli-tools.rb
+          sed -i "s|sha256 \".*\"|sha256 \"${{ steps.sha.outputs.sha }}\"|" Formula/cli-tools.rb
+
+      - name: Push
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git commit -am "chore: bump cli-tools to ${{ needs.release.outputs.version }}"
+          git push