From 983f6736d64f4211a013e51c84b8409856a3549b Mon Sep 17 00:00:00 2001
From: Kim Gustyr <kim.gustyr@flagsmith.com>
Date: Tue, 11 Aug 2026 18:15:33 +0100
Subject: [PATCH] ci: publish a Homebrew cask on release
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`brew install Flagsmith/tap/flagsmith`, from our own tap rather than
homebrew-core: core needs 30 forks, 30 watchers or 75 stars, and does not
take submissions from a project's own authors.

A cask, not a formula, because we ship prebuilt binaries — and because
goreleaser removed the `brews` (formula) section in v2.16 in favour of
`homebrew_casks`. The workflow pins `~> v2`, so `brews` was never an option.

The tap enforces the same no-direct-push rule as everywhere else, so
`pull_request.enabled` puts the cask on a `flagsmith-cli-<version>` branch
and opens a PR. Without it goreleaser commits straight to the tap's default
branch; setting it also defaults the head branch, so no branch config here.

`GITHUB_TOKEN` cannot reach another repo, so the cask push borrows the
engineering GitHub App, scoped to `homebrew-tap` and to the two permissions
the PR needs. Same pattern as flagsmith/flagsmith's renovate and
update-flagsmith-environment workflows.

The postflight `xattr` strips the quarantine attribute Homebrew sets on what
it downloads: our macOS binaries are unsigned, so without it the first run
dies with "flagsmith is damaged and can't be opened". `install.sh` never hit
this because curl does not set the attribute. Notarisation is the real fix.

Verified with `goreleaser check` and a snapshot build. `flagsmith completion`
runs without config or auth, so install-time completion generation is safe.

beep boop
---
 .github/workflows/release.yml | 12 ++++++++++++
 .goreleaser.yaml              | 26 ++++++++++++++++++++++++++
 README.md                     |  6 ++++++
 3 files changed, 44 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 04a9cb3..c39000f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,12 +29,24 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }}
+          private-key: ${{ secrets.FLAGSMITH_ENGINEERING_GH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: homebrew-tap
+          # Only what the cask needs: push its branch, open the pull request.
+          permission-contents: write
+          permission-pull-requests: write
       - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           version: "~> v2"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
       # Attests every file listed in the checksum file.
       - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 46ffcf2..b271f07 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -54,6 +54,32 @@ dockers_v2:
       org.opencontainers.image.revision: "{{ .FullCommit }}"
       org.opencontainers.image.licenses: MIT
 
+homebrew_casks:
+  - name: flagsmith
+    repository:
+      owner: Flagsmith
+      name: homebrew-tap
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
+      pull_request:
+        enabled: true
+    homepage: https://github.com/Flagsmith/flagsmith-cli
+    description: The Flagsmith command-line interface
+    binaries:
+      - flagsmith
+    generate_completions_from_executable:
+      executable: flagsmith
+      args: [completion]
+      shell_parameter_format: cobra
+      shells: [bash, zsh, fish]
+    hooks:
+      post:
+        # Homebrew quarantines what it downloads;
+        # Unqarantine manually until we start notarising the Mac binaries.
+        install: |
+          if system_command("/usr/bin/xattr", args: ["-h"]).exit_status == 0
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/flagsmith"]
+          end
+
 # changelog handled by release-please.
 changelog:
   disable: true
diff --git a/README.md b/README.md
index 16f5e2b..3755395 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,12 @@ The next-generation Flagsmith command-line interface (work in progress).
 
 ## Install
 
+```sh
+brew install Flagsmith/tap/flagsmith
+```
+
+Or:
+
 ```sh
 curl -fsSL https://raw.githubusercontent.com/Flagsmith/flagsmith-cli/main/install.sh | sh
 ```