feat: auto-update Homebrew tap on release

Add update-homebrew job to release.yml that:
- Downloads SHA256SUMS from the just-published release
- Generates the Formula/rvl.rb with real hashes
- Pushes the updated formula to cmdrvl/homebrew-tap

Requires HOMEBREW_TAP_TOKEN secret (PAT with repo scope for cmdrvl/homebrew-tap).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Zachary Ruiz

.github/workflows/release.yml

@@ -271,3 +271,108 @@ jobs:
             dist/SHA256SUMS.pem
             dist/provenance.intoto.jsonl
             dist/sbom.cdx.json
+
+  update-homebrew:
+    name: Update Homebrew tap
+    runs-on: ubuntu-latest
+    needs: release
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Read version
+        id: version
+        run: |
+          version=$(python3 - <<'PY'
+          import tomllib
+          from pathlib import Path
+          data = tomllib.loads(Path('Cargo.toml').read_text())
+          print(f"v{data['package']['version']}")
+          PY
+          )
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "bare_version=${version#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Download SHA256SUMS from release
+        run: |
+          curl -fsSL "https://github.com/cmdrvl/rvl/releases/download/${{ steps.version.outputs.version }}/SHA256SUMS" -o SHA256SUMS
+
+      - name: Generate formula
+        run: |
+          python3 - <<'PYEOF'
+          import pathlib
+
+          version = "${{ steps.version.outputs.version }}"
+          bare = "${{ steps.version.outputs.bare_version }}"
+
+          sums = {}
+          for line in pathlib.Path("SHA256SUMS").read_text().strip().splitlines():
+              digest, name = line.split(maxsplit=1)
+              sums[name.strip()] = digest
+
+          targets = {
+              "aarch64-apple-darwin": ("on_macos", "on_arm"),
+              "x86_64-apple-darwin": ("on_macos", "on_intel"),
+              "aarch64-unknown-linux-gnu": ("on_linux", "on_arm"),
+              "x86_64-unknown-linux-gnu": ("on_linux", "on_intel"),
+          }
+
+          blocks = []
+          current_os = None
+          for target, (os_block, arch_block) in targets.items():
+              asset = f"rvl-{version}-{target}.tar.gz"
+              sha = sums.get(asset, "MISSING")
+              if os_block != current_os:
+                  if current_os is not None:
+                      blocks.append("  end")
+                  blocks.append(f"\n  {os_block} do")
+                  current_os = os_block
+              blocks.append(f"    {arch_block} do")
+              blocks.append(f'      url "https://github.com/cmdrvl/rvl/releases/download/{version}/{asset}"')
+              blocks.append(f'      sha256 "{sha}"')
+              blocks.append(f"    end")
+          blocks.append("  end")
+
+          formula = f'''# typed: false
+          # frozen_string_literal: true
+
+          class Rvl < Formula
+            desc "Reveal the smallest set of numeric changes that explain what actually changed"
+            homepage "https://github.com/cmdrvl/rvl"
+            version "{bare}"
+            license "MIT"
+          {"".join(chr(10) + l for l in blocks)}
+
+            def install
+              bin.install "rvl"
+            end
+
+            test do
+              assert_match version.to_s, shell_output("#{{bin}}/rvl --version")
+            end
+          end
+          '''
+
+          # Dedent (remove leading spaces from triple-quoted string)
+          import textwrap
+          formula = textwrap.dedent(formula).lstrip()
+          pathlib.Path("rvl.rb").write_text(formula)
+          PYEOF
+
+      - name: Push formula to tap
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+        run: |
+          git clone "https://x-access-token:${GH_TOKEN}@github.com/cmdrvl/homebrew-tap.git" tap
+          cp rvl.rb tap/Formula/rvl.rb
+          cd tap
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if git diff --quiet; then
+            echo "No changes to formula"
+          else
+            git add Formula/rvl.rb
+            git commit -m "rvl ${{ steps.version.outputs.version }}"
+            git push
+          fi