ci(release): auto-open Homebrew/core bump PR after npm publish (#2087)

* ci(release): auto-open Homebrew/core bump PR after npm publish

Adds a homebrew job to the Publish workflow that, after the npm publish and GitHub release are finalized, derives the version from the release tag, waits for the npm tarball to propagate, computes its sha256, and runs 'brew bump-formula-pr' to open a Homebrew/core update PR. This keeps the Homebrew formula from lagging behind GitHub/npm releases.

The step is gated on a maintainer-provisioned HOMEBREW_BUMP_TOKEN secret (a PAT with public_repo scope; the default GITHUB_TOKEN cannot open cross-repo PRs) and is a no-op warning when the secret is absent. Untrusted workflow_run data is passed via env vars and the tag is validated, per the project's GitHub Actions script-injection guidance.

Closes #2074

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ci): harden Homebrew bump job (success gate, brew PATH, least privilege)

Address review findings on the new homebrew job:

- The custom `if:` replaced the implicit `needs: publish` success gate, so
  the job could still run when publish failed after the npm tarball already
  existed (e.g. `gh release edit` failing) — opening a Homebrew/core PR that
  references an unpublished draft release. Add `success()` to restore the gate.
- GitHub-hosted runners ship Homebrew preinstalled but do not add it to PATH,
  so `brew bump-formula-pr` would fail with command-not-found. Load Homebrew's
  shell environment via `brew shellenv` before invoking brew.
- Scope the job to `permissions: {}`; it only opens a cross-repo PR with its
  own HOMEBREW_BUMP_TOKEN and needs none of the workflow-level contents/id-token
  grants.

Allowlist `linuxbrew` and `shellenv` in cspell for the new shellenv command.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: dyoshikawa <yoshikawa.daio@classmethod.jp>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

.github/workflows/publish.yml

@@ -46,3 +46,71 @@ jobs:
             exit 1
           fi
           gh release edit "$TAG" --draft=false --latest
+
+  homebrew:
+    name: Bump Homebrew/core formula
+    needs: publish
+    runs-on: ubuntu-latest
+    # Only bump for real releases. `success()` keeps the implicit `needs: publish`
+    # success gate — a custom `if:` that omits it would replace that gate and let
+    # this job run even when `publish` failed. The remaining checks mirror the
+    # publish job's release-trigger gating.
+    if: success() && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request' && startsWith(github.event.workflow_run.head_branch, 'release/v')
+    # This job only opens a cross-repo PR with its own HOMEBREW_BUMP_TOKEN; it never
+    # checks out this repo, uses GITHUB_TOKEN, or requests OIDC, so it needs none of
+    # the workflow-level permissions.
+    permissions: {}
+    steps:
+      - name: Open Homebrew/core bump PR
+        env:
+          # Maintainer-owned PAT with `public_repo` scope (forking + PRs against
+          # Homebrew/homebrew-core). The default GITHUB_TOKEN cannot open
+          # cross-repository PRs, so the step is skipped when this is absent.
+          HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.HOMEBREW_BUMP_TOKEN }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          if [ -z "${HOMEBREW_GITHUB_API_TOKEN}" ]; then
+            echo "::warning::HOMEBREW_BUMP_TOKEN secret is not set; skipping Homebrew formula bump."
+            exit 0
+          fi
+
+          TAG="${HEAD_BRANCH#release/}"
+          if ! echo "$TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::Invalid release tag derived from branch: $HEAD_BRANCH"
+            exit 1
+          fi
+          VERSION="${TAG#v}"
+          URL="https://registry.npmjs.org/rulesync/-/rulesync-${VERSION}.tgz"
+
+          # Wait until the npm tarball for this version is actually downloadable
+          # (npm registry propagation can lag behind `pnpm publish`).
+          for attempt in $(seq 1 30); do
+            if curl -sfIL "$URL" >/dev/null 2>&1; then
+              break
+            fi
+            echo "Waiting for npm tarball to become available (attempt ${attempt}/30)..."
+            sleep 20
+          done
+          if ! curl -sfIL "$URL" >/dev/null 2>&1; then
+            echo "::error::npm tarball not available after timeout: $URL"
+            exit 1
+          fi
+
+          SHA256="$(curl -sfL "$URL" | sha256sum | cut -d' ' -f1)"
+          if [ -z "${SHA256}" ]; then
+            echo "::error::Failed to compute sha256 for $URL"
+            exit 1
+          fi
+
+          # GitHub-hosted runners ship Homebrew preinstalled but do not add it to
+          # PATH, so load its shell environment before invoking brew.
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+
+          # Skip if Homebrew/core already has this exact version or an open bump PR
+          # for it; brew bump-formula-pr is idempotent and will refuse duplicates.
+          brew bump-formula-pr rulesync \
+            --version "${VERSION}" \
+            --url "${URL}" \
+            --sha256 "${SHA256}" \
+            --no-browse \
+            --message "Automated bump from rulesync ${TAG} release."

cspell.json

@@ -177,6 +177,7 @@
     "levelname",
     "lightningcss",
     "lilconfig",
+    "linuxbrew",
     "lintstagedrc",
     "Liskov",
     "listr",
@@ -274,6 +275,7 @@
     "saoudrizwan",
     "secops",
     "setprototypeof",
+    "shellenv",
     "siginfo",
     "sindresorhus",
     "skipvalidation",