From 9466f841933528f2d6f17274bcdd772f7099eb19 Mon Sep 17 00:00:00 2001
From: LM <me@lonelyman.site>
Date: Fri, 23 Oct 2026 12:57:06 +0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=91=B7=20=E5=8F=91=E5=B8=83=E6=AD=A3?=
 =?UTF-8?q?=E5=BC=8F=E7=89=88=E5=90=8E=E8=87=AA=E5=8A=A8=E6=9B=B4=E6=96=B0?=
 =?UTF-8?q?=20Homebrew=20tap?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

release 成功后新增 homebrew job：把 scriptscat/homebrew-tap 里的 Formula/sctl.rb 指向本次 tag 的源码包并推送，
省掉每次发版手动改 url 与 sha256。预发布不进 tap，保证 brew install 拿到的始终是正式版；同一 tag 重跑时
formula 已是最新则跳过，不产生空提交。写 tap 走组织级 secret HOMEBREW_TAP_DEPLOY_KEY（tap 上的读写 deploy key），
job 不需要本仓库 GITHUB_TOKEN 的任何权限。
---
 .github/workflows/release.yaml | 36 ++++++++++++++++++++++++++++++++++
 docs/development.md            |  5 +++++
 2 files changed, 41 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 191419b..5d7e2a1 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -180,3 +180,39 @@ jobs:
             echo
             echo "Release 已自动发布。"
           } >> "$GITHUB_STEP_SUMMARY"
+
+  homebrew:
+    name: Bump Homebrew tap
+    needs: release
+    # 预发布不进 tap:brew install 拿到的应当始终是正式版。
+    if: ${{ !contains(github.ref_name, '-') }}
+    runs-on: ubuntu-latest
+    permissions: {} # 写 tap 走 deploy key,不需要本仓库 GITHUB_TOKEN 的任何权限
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: scriptscat/homebrew-tap
+          ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
+      - name: 更新 sctl formula
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          VERSION="${TAG#v}"
+          URL="https://github.com/scriptscat/sctl/archive/refs/tags/${TAG}.tar.gz"
+          # formula 从源码构建,校验的是 GitHub 生成的源码包,不是 release 里的二进制归档。
+          SHA256=$(curl -fsSL "$URL" | sha256sum | cut -d' ' -f1)
+          sed -i -E \
+            -e "s|^  url \".*\"$|  url \"${URL}\"|" \
+            -e "s|^  sha256 \".*\"$|  sha256 \"${SHA256}\"|" \
+            Formula/sctl.rb
+          grep -qF "$URL" Formula/sctl.rb && grep -qF "$SHA256" Formula/sctl.rb
+          # 重跑同一个 tag 时 formula 已是最新,不再产生空提交。
+          if git diff --quiet; then
+            echo "Formula/sctl.rb 已是 ${VERSION},跳过。"
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -am "sctl ${VERSION}"
+          git push
diff --git a/docs/development.md b/docs/development.md
index 3a3f952..fac8d22 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -153,6 +153,11 @@ via `-ldflags` and are visible through `sctl version`.
 
 Cross-compilation, packaging, checksums, and the GitHub Release upload all happen inside that workflow.
 
+For a non-prerelease tag, the `homebrew` job then points `Formula/sctl.rb` in
+[scriptscat/homebrew-tap](https://github.com/scriptscat/homebrew-tap) at the tag's source tarball and pushes the
+commit. It authenticates with the `HOMEBREW_TAP_DEPLOY_KEY` secret, the private half of a write-enabled deploy key
+on the tap repository.
+
 ## Browser extension
 
 The sctl Browser extension lives in `extension/` (pnpm, Vite, React, TypeScript, Tailwind CSS v4, shadcn/ui,