[codex] Publish Tart to openai/homebrew-tools

[fkorotkov-oai]

Summary

• move Tart tag releases and manual release snapshots from Cirrus CI to GitHub Actions
• mint short-lived GitHub App tokens for both openai/tart and openai/homebrew-tools
• publish Formula/tart.rb through a tart-{{ .Version }} pull request in openai/homebrew-tools
• update the formula metadata and Softnet dependency to openai/tools/softnet
• update installation docs to use brew install openai/tools/tart
• make release builds deterministic across arm64 and x86_64 on macos-26
• keep manual snapshots secretless and outside the tag-only publish environment

Release blocker — do not cut a release yet

The publish environment currently has GORELEASER_KEY, RELEASE_APP_ID, and RELEASE_APP_PRIVATE_KEY, but it is still missing:

• AC_PASSWORD
• MACOS_CERTIFICATE

Those values currently exist only as encrypted Cirrus CI variables and cannot be copied from their ciphertext. Add both secrets to the publish environment before creating the next Tart release tag.

The corresponding openai/homebrew-tools validation/auto-merge support for Tart must also land before the first release using this workflow.

Install

brew install openai/tools/tart
brew install openai/tools/orchard

Behavior change

The old Cirrus release task's Sentry debug-file uploads and Sentry release creation are intentionally not migrated. Restoring them would require separately provisioning and scoping SENTRY_AUTH_TOKEN.

Validation

• actionlint 1.7.12
• goreleaser check --soft with GoReleaser Pro 2.16.0
• complete secretless goreleaser release --skip=publish --snapshot --clean
• arm64 and x86_64 release builds
• ad-hoc snapshot signature verified with codesign --verify --deep --strict
• generated formula written to dist/homebrew/Formula/tart.rb and checked with ruby -c
• shell syntax and git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 50903edd5d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pass AC_PASSWORD to the signing step

In tag releases, .ci/sign-release.sh invokes gon gon.hcl, and gon.hcl reads the notarization password from @env:AC_PASSWORD; however this secret is only scoped to the earlier “Import signing certificate” step, not to this GoReleaser step. On any non-snapshot release gon runs without that env var and fails to notarize/sign even when the publish environment has the secret. Please add AC_PASSWORD: ${{ secrets.AC_PASSWORD }} here, or change gon.hcl to use the stored notary profile.

Useful? React with 👍 / 👎.

[edi-oai]

What the rationale behind this change (whole file)?

[edi-oai]

What's the rationale behind dropping gon?