chore(release): bump crate to v1.0.6

Author: smorin

.github/workflows/homebrew-tap-pr.yml

@@ -1,9 +1,6 @@
 name: Homebrew Tap PR
 
 on:
-  release:
-    types:
-      - published
   workflow_dispatch:
     inputs:
       tag:
@@ -12,7 +9,7 @@ on:
         type: string
 
 concurrency:
-  group: homebrew-tap-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.release.tag_name || inputs.tag || github.run_id }}
+  group: homebrew-tap-${{ github.workflow }}-${{ inputs.tag || github.run_id }}
   cancel-in-progress: false
 
 jobs:
@@ -34,14 +31,10 @@ jobs:
         id: tag
         shell: bash
         run: |
-          if [[ "${{ github.event_name }}" == "release" ]]; then
-            TAG="${{ github.event.release.tag_name }}"
-          else
-            TAG="${{ inputs.tag }}"
-          fi
+          TAG="${{ inputs.tag }}"
 
           if [[ -z "$TAG" ]]; then
-            echo "ERROR: missing release tag"
+            echo "ERROR: missing release tag input (workflow_dispatch input: tag)"
             exit 1
           fi
 

.github/workflows/release.yml

@@ -179,6 +179,57 @@ jobs:
           name: ${{ needs.meta.outputs.tag }}
           body: ${{ steps.git-cliff.outputs.content }}
 
+  dispatch-homebrew-tap-pr:
+    name: Dispatch Homebrew Tap PR workflow
+    needs: [meta, github-release]
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - name: Dispatch Homebrew Tap PR workflow
+        id: dispatch
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const tag = '${{ needs.meta.outputs.tag }}';
+            const workflowId = 'homebrew-tap-pr.yml';
+            const ref = context.payload.repository.default_branch;
+            const { owner, repo } = context.repo;
+
+            core.info(`Dispatching ${workflowId} for tag ${tag} on ref ${ref}`);
+
+            try {
+              await github.rest.actions.createWorkflowDispatch({
+                owner,
+                repo,
+                workflow_id: workflowId,
+                ref,
+                inputs: { tag },
+              });
+              core.info(`Dispatched ${workflowId} with tag=${tag}`);
+            } catch (error) {
+              core.error(
+                `Failed to dispatch ${workflowId} for tag ${tag}: ${error.message}`
+              );
+              core.error(
+                `Manual fallback: gh workflow run ${workflowId} -R ${owner}/${repo} -f tag=${tag}`
+              );
+              core.error(
+                "See RELEASING.md -> Homebrew tap sync flow (example) for dispatch fallback guidance."
+              );
+              core.setFailed(error.message);
+            }
+
+      - name: Dispatch fallback guidance
+        if: ${{ failure() }}
+        run: |
+          echo "::warning::Homebrew tap workflow dispatch failed. Crate release remains non-blocking."
+          echo "::warning::Manual fallback: gh workflow run homebrew-tap-pr.yml -R ${{ github.repository }} -f tag=${{ needs.meta.outputs.tag }}"
+          echo "::warning::See RELEASING.md -> Homebrew tap sync flow (example)."
+
   build:
     name: Build & Upload Binaries
     needs: [meta, github-release]

CHANGELOG.md

@@ -19,6 +19,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+## [1.0.6] - 2026-02-16
+
+### Added
+
+### Changed
+
+- Switched Homebrew tap automation from `release.published` listening to explicit dispatch from the release workflow.
+- Added a non-blocking release job that dispatches `homebrew-tap-pr.yml` and emits manual fallback guidance on dispatch failure.
+- Updated release documentation and ADRs for the explicit dispatch trigger contract.
+
+### Deprecated
+
+### Removed
+
+### Fixed
+
+### Security
+
 ## [1.0.5] - 2026-02-16
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "envgen"
-version = "1.0.5"
+version = "1.0.6"
 edition = "2021"
 description = "Generate and validate .env files from one spec - self-documenting config, consistent across environments, secrets stay out of git."
 readme = "README.md"

Cargo.toml

@@ -291,7 +291,12 @@ Pushing `schema-v*.*.*` tags does not trigger crates.io publish.
 
 Automation equivalent:
 
-- `.github/workflows/homebrew-tap-pr.yml` runs on `release.published` and can be retried with `workflow_dispatch`.
+- Tag push triggers `.github/workflows/release.yml`.
+- `release.yml` job `dispatch-homebrew-tap-pr` explicitly dispatches
+  `.github/workflows/homebrew-tap-pr.yml` using `workflow_dispatch` with
+  `tag=vX.Y.Z`.
+- You can manually retry the tap workflow with:
+  - `gh workflow run homebrew-tap-pr.yml -R smorinlabs/envgen -f tag=vX.Y.Z`
 
 ## Reset HOMEBREW_TAP_GITHUB_TOKEN (step-by-step)
 
@@ -346,6 +351,11 @@ Docs:
 - Partial update on bump failure:
   - A failed bump can leave version/changelog edits before later steps complete.
   - Recovery: run `make sync-lockfile` and retry the bump after fixing the reported error.
+- Homebrew tap workflow dispatch failure:
+  - Symptom: `release.yml` job `Dispatch Homebrew Tap PR workflow` fails.
+  - Impact: crate release remains successful (non-blocking), but tap sync does not start automatically.
+  - Fix: check the dispatch job logs and repo workflow permissions (`actions: write`), then run:
+    - `gh workflow run homebrew-tap-pr.yml -R smorinlabs/envgen -f tag=vX.Y.Z`
 - Homebrew tap token auth/permission errors:
   - Symptom: workflow step `Validate tap token permissions` fails with `::error::` output.
   - Fix: follow `Reset HOMEBREW_TAP_GITHUB_TOKEN (step-by-step)` in this document.

RELEASING.md

@@ -0,0 +1,56 @@
+# 0015: Explicitly dispatch Homebrew tap PR workflow from release pipeline
+Date: 2026-02-16
+Status: Accepted
+
+## Context
+
+`envgen` publishes GitHub releases in `.github/workflows/release.yml` using
+`softprops/action-gh-release` and `secrets.GITHUB_TOKEN`.
+
+The Homebrew tap workflow `.github/workflows/homebrew-tap-pr.yml` previously
+listened to `release.published` events. In practice, downstream workflow
+triggering from release events generated by `github-actions[bot]` was not
+reliable for this pipeline.
+
+Observed outcome: crate release completed, but Homebrew tap sync did not start
+unless manually dispatched.
+
+## Decision
+
+Dispatch `.github/workflows/homebrew-tap-pr.yml` explicitly from
+`.github/workflows/release.yml` after the `github-release` job succeeds.
+
+Implementation details:
+
+- Add `dispatch-homebrew-tap-pr` job in `release.yml`.
+- Use `actions/github-script` and
+  `github.rest.actions.createWorkflowDispatch(...)`.
+- Pass input `tag=${{ needs.meta.outputs.tag }}`.
+- Keep the dispatch job non-blocking via `continue-on-error: true`.
+- Keep manual fallback path documented:
+  `gh workflow run homebrew-tap-pr.yml -R smorinlabs/envgen -f tag=vX.Y.Z`.
+
+## Consequences
+
+- Homebrew tap sync trigger is deterministic and auditable from the release run.
+- Failures in tap workflow dispatch do not block crate release completion.
+- Operational debugging is simpler: a single release run contains dispatch
+  success/failure signals.
+- `homebrew-tap-pr.yml` trigger contract is now `workflow_dispatch` only.
+
+## Alternatives considered
+
+1. Keep `release.published` listener in `homebrew-tap-pr.yml`.
+   - Rejected: non-deterministic auto-trigger behavior in this setup.
+2. Chain with `workflow_run` from `release.yml`.
+   - Rejected: less direct control over input payload (`tag`) and dispatch
+     error handling/logging.
+3. Publish release with a PAT instead of `GITHUB_TOKEN`.
+   - Rejected: introduces additional credential management and wider token
+     scope for a problem solved by explicit workflow dispatch.
+
+## References/links
+
+- `/Users/stevemorin/c/envgen/.github/workflows/release.yml`
+- `/Users/stevemorin/c/envgen/.github/workflows/homebrew-tap-pr.yml`
+- `/Users/stevemorin/c/envgen/RELEASING.md`