Publish signed releases through Homebrew

Author: tcballard

.github/workflows/release.yml

@@ -36,3 +36,33 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh release upload "${GITHUB_REF_NAME}" .build/LocalWrapMac-Signed/*.dmg .build/LocalWrapMac-Signed/*.sha256 --clobber
+      - name: Check out Homebrew tap
+        uses: actions/checkout@v6
+        with:
+          repository: tcballard/homebrew-tap
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          path: homebrew-tap
+      - name: Update Homebrew Cask
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: |
+          VERSION="${VERSION#v}"
+          SHA256="$(cat ".build/LocalWrapMac-Signed/LocalWrap-${VERSION}-universal.dmg.sha256")"
+          ./script/render_homebrew_cask.sh homebrew-tap/Casks/localwrap.rb "$VERSION" "$SHA256"
+          ruby -c homebrew-tap/Casks/localwrap.rb
+      - name: Publish GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release edit "${GITHUB_REF_NAME}" --draft=false
+      - name: Publish Homebrew Cask
+        working-directory: homebrew-tap
+        run: |
+          if git diff --quiet -- Casks/localwrap.rb; then
+            echo "Cask is already current."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add Casks/localwrap.rb
+          git commit -m "Update LocalWrap to ${GITHUB_REF_NAME#v}"
+          git push origin HEAD:main

README.md

@@ -37,6 +37,20 @@ The Release product is the universal `LocalWrap.app`, bundle ID
 copies compatible data from the former Electron LocalWrap store without editing
 the source file.
 
+## Install with Homebrew
+
+Signed releases are published through the `tcballard/homebrew-tap` Cask:
+
+```bash
+brew tap tcballard/tap
+brew install --cask localwrap
+```
+
+After notarization succeeds, the release workflow publishes the GitHub Release
+and updates the Cask with the exact DMG version and SHA-256. The repository
+secret `HOMEBREW_TAP_TOKEN` must have Contents read/write access to
+`tcballard/homebrew-tap`.
+
 ## Signed distribution
 
 `./script/release_native_macos.sh` archives, Developer ID-signs, packages,

script/render_homebrew_cask.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+OUTPUT="${1:?usage: render_homebrew_cask.sh OUTPUT VERSION SHA256}"
+VERSION="${2:?usage: render_homebrew_cask.sh OUTPUT VERSION SHA256}"
+SHA256="${3:?usage: render_homebrew_cask.sh OUTPUT VERSION SHA256}"
+
+[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z]+)*$ ]] \
+  || { echo "error: invalid version: $VERSION" >&2; exit 2; }
+[[ "$SHA256" =~ ^[0-9a-f]{64}$ ]] \
+  || { echo "error: SHA-256 must be 64 lowercase hexadecimal characters" >&2; exit 2; }
+
+mkdir -p "$(dirname "$OUTPUT")"
+sed -e "s/__VERSION__/$VERSION/g" -e "s/__SHA256__/$SHA256/g" >"$OUTPUT" <<'RUBY'
+cask "localwrap" do
+  version "__VERSION__"
+  sha256 "__SHA256__"
+
+  url "https://github.com/tcballard/LocalWrap/releases/download/v#{version}/LocalWrap-#{version}-universal.dmg"
+  name "LocalWrap"
+  desc "Cockpit for localhost development projects"
+  homepage "https://github.com/tcballard/LocalWrap"
+
+  depends_on macos: :sequoia
+
+  app "LocalWrap.app"
+
+  zap trash: [
+    "~/Library/Application Support/LocalWrapNative",
+    "~/Library/Preferences/com.localwrap.app.plist",
+    "~/Library/Saved Application State/com.localwrap.app.savedState",
+  ]
+end
+RUBY