feat(ENG-13436): publish standalone binaries via the Homebrew tap

[BartoszBlizniak]

Description

Publishes the standalone CLI binaries through the existing Homebrew tap. The release pipeline gains a publish-homebrew job that renders a per-architecture binary formula (macOS arm64/x86_64, Linux gnu x86_64/aarch64) from the release artifacts' checksums, verifies each live download URL against those checksums, and opens a pull request into the tap on a release/cloudsmith-cli-vX.Y.Z branch. The tap's main branch requires reviewed PRs with signed commits, so the flow is PR-based by design and tap PRs must be squash-merged. The PR also adds an Aliases/cloudsmith entry so brew install cloudsmith-io/cloudsmith-cli/cloudsmith works alongside the full formula name.

The existing tap formula installs the Python zipapp and depends on python@3.10; since this release retires the zipapp, the first binary release replaces that formula in place and existing users transition transparently via brew upgrade cloudsmith-cli (with an orphaned python@3.10 they can brew autoremove).

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Testing

• Rendered formula passes brew style and brew audit --strict with zero findings; ruby -c clean; leftover-placeholder check built into the job.
• Full end-to-end validation against a pre-release test repository: brew install, cloudsmith --version, brew test, and brew livecheck all green on macOS arm64, including the PyInstaller onedir libexec install pattern.
• zizmor reports no findings for the workflow change; job re-runs are idempotent (force-push to the release branch, existing-PR guard, clean-tree early exit after the tap PR merges).

Additional Notes

• The job is failure-isolated: nothing else in the release depends on it, and without the TAP_PUSH_TOKEN secret it stages the rendered formula as a workflow artifact instead of touching the tap. The token should be a fine-grained PAT scoped to the tap repository only (Contents and Pull requests read/write).
• Checksum provenance: formula hashes come from the same artifacts the release publishes, and the job re-downloads each live URL and compares before opening the tap PR.
• macOS codesigning/notarization is intentionally out of scope; the signing step slots into the binary build jobs later without any formula or tap changes.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds automated publication of standalone (PyInstaller) Cloudsmith CLI binaries to the existing Homebrew tap by rendering a per-architecture formula from release artifacts, verifying live downloads against checksums, and opening a PR to the tap repo.

Changes:

• Added a Homebrew formula template for installing the standalone binary across macOS (arm64/x86_64) and Linux (x86_64/aarch64 glibc).
• Extended the release workflow with a publish-homebrew job to render, validate, checksum-verify, and optionally PR the updated formula into the Homebrew tap.
• Added creation/updating of a Homebrew Aliases/cloudsmith symlink so brew install .../cloudsmith works.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
packaging/homebrew/cloudsmith-cli.rb.tmpl	New Homebrew formula template for installing the standalone CLI binary with per-OS/CPU URLs and a livecheck stanza.
.github/workflows/release.yml	Adds a publish-homebrew job to render/upload the formula, verify published downloads, and optionally open a PR in the tap repo.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.