fix: Re-enable Homebrew upload, add token validation to release workflow

- Re-enable brew formula upload (new HOMEBREW_TAP_TOKEN set)
- Add "Validate tokens" step that checks npm and Homebrew tokens before
  building, failing fast with actionable error messages if expired

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: SimplyLiz

.github/workflows/release.yml

@@ -34,6 +34,37 @@ jobs:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Validate tokens
+        env:
+          NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+        run: |
+          FAILED=false
+
+          # Check npm token
+          echo "Checking npm token..."
+          NPM_RESULT=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $NPM_AUTH_TOKEN" https://registry.npmjs.org/-/npm/v1/user)
+          if [ "$NPM_RESULT" = "200" ]; then
+            echo "✓ npm token is valid"
+          else
+            echo "::error::npm token is invalid or expired (HTTP $NPM_RESULT). Update NPM_AUTH_TOKEN in repo secrets."
+            FAILED=true
+          fi
+
+          # Check Homebrew tap token
+          echo "Checking Homebrew tap token..."
+          BREW_RESULT=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $HOMEBREW_TAP_TOKEN" https://api.github.com/repos/SimplyLiz/homebrew-ckb)
+          if [ "$BREW_RESULT" = "200" ]; then
+            echo "✓ Homebrew tap token is valid"
+          else
+            echo "::warning::Homebrew tap token is invalid or expired (HTTP $BREW_RESULT). Brew formula upload will be skipped."
+          fi
+
+          if [ "$FAILED" = "true" ]; then
+            echo "::error::One or more required tokens are invalid. Fix them before releasing."
+            exit 1
+          fi
+
       - name: Run tests
         run: go test -race ./...
 

.goreleaser.yml

@@ -77,7 +77,7 @@ brews:
     directory: Formula
     homepage: "https://github.com/SimplyLiz/CodeMCP"
     description: "Code intelligence orchestration layer for AI-assisted development"
-    skip_upload: true  # TODO: re-enable once HOMEBREW_TAP_TOKEN is refreshed
+    skip_upload: false
     install: |
       bin.install "ckb"
     test: |