release.yml

name: Release & Publish

on:
  push:
    tags:
      - "v*"

# Serialize releases so two overlapping v* tags can't race on the Homebrew tap push.
concurrency:
  group: release-${{ github.workflow }}
  cancel-in-progress: false

env:
  CICD_INTERMEDIATES_DIR: "_cicd-intermediates"
  CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER: link.exe

jobs:

  crate_metadata:
    name: Extract crate metadata
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Extract crate information
        id: crate_metadata
        run: |
          cargo metadata --no-deps --format-version 1 | jq -r '"name=" + .packages[0].name' | tee -a $GITHUB_OUTPUT
          cargo metadata --no-deps --format-version 1 | jq -r '"version=" + .packages[0].version' | tee -a $GITHUB_OUTPUT
          cargo metadata --no-deps --format-version 1 | jq -r '"maintainer=" + .packages[0].authors[0]' | tee -a $GITHUB_OUTPUT
          cargo metadata --no-deps --format-version 1 | jq -r '"homepage=" + .packages[0].homepage' | tee -a $GITHUB_OUTPUT
      - name: Verify tag matches crate version
        shell: bash
        env:
          VERSION: ${{ steps.crate_metadata.outputs.version }}
        run: |
          set -euo pipefail
          tag_version="${GITHUB_REF_NAME#v}"
          if [[ "$tag_version" != "$VERSION" ]]; then
            echo "Tag v${tag_version} does not match crate version ${VERSION}" >&2
            exit 1
          fi
          echo "Tag matches crate version: ${VERSION}"
    outputs:
      name: ${{ steps.crate_metadata.outputs.name }}
      version: ${{ steps.crate_metadata.outputs.version }}
      maintainer: ${{ steps.crate_metadata.outputs.maintainer }}
      homepage: ${{ steps.crate_metadata.outputs.homepage }}

  build:
    name: ${{ matrix.job.target }} (${{ matrix.job.os }})
    runs-on: ${{ matrix.job.os }}
    needs: crate_metadata
    strategy:
      fail-fast: false
      matrix:
        job:
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            dpkg_arch: arm64
            use-cross: true
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            dpkg_arch: arm64
            use-cross: true
          # For now, skip 32-bit targets (`i686` and `arm`).  ARM64 (e.g. Apple Silicon) is still built (above and below).
          #
          # - target: arm-unknown-linux-gnueabihf
          # os: ubuntu-latest
          # dpkg_arch: armhf
          # use-cross: true
          # - target: arm-unknown-linux-musleabihf
          # os: ubuntu-latest
          # dpkg_arch: musl-linux-armhf
          # use-cross: true
          # - target: i686-pc-windows-msvc
          # os: windows-2025
          # - target: i686-unknown-linux-gnu
          # os: ubuntu-latest
          # dpkg_arch: i686
          # use-cross: true
          # - target: i686-unknown-linux-musl
          # os: ubuntu-latest
          # dpkg_arch: musl-linux-i686
          # use-cross: true
          - target: x86_64-apple-darwin
            os: macos-15-intel
          - target: aarch64-apple-darwin
            os: macos-15
          - target: x86_64-pc-windows-msvc
            os: windows-2025
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            dpkg_arch: amd64
            use-cross: true
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            dpkg_arch: musl-linux-amd64
            use-cross: true
    env:
      BUILD_CMD: cargo
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Checkout source code
        uses: actions/checkout@v4

      - name: Fetch secrets from Infisical
        if: startsWith(matrix.job.os, 'windows-') || startsWith(matrix.job.os, 'macos-')
        uses: Infisical/secrets-action@77ab1f4ccd183a543cb5b42435fbd181189f4995 # v1.0.16
        with:
          method: oidc
          identity-id: ${{ vars.INFISICAL_IDENTITY_ID }}
          env-slug: prod
          project-slug: ${{ vars.INFISICAL_PROJECT_SLUG }}

      - name: Authenticate with GCP
        if: startsWith(matrix.job.os, 'windows-')
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ vars.GCP_PROJECT_ID }}
          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}

      - name: Install prerequisites
        shell: bash
        run: |
          # Install cross-compiler toolchains on for ARM.
          case ${{ matrix.job.target }} in
            arm-unknown-linux-*) sudo apt-get -y update ; sudo apt-get -y install gcc-arm-linux-gnueabihf ;;
            aarch64-unknown-linux-gnu) sudo apt-get -y update ; sudo apt-get -y install gcc-aarch64-linux-gnu ;;
          esac

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: nightly
          components: rustc-codegen-cranelift-preview
          targets: ${{ matrix.job.target }}

      - name: Install cross
        if: matrix.job.use-cross
        uses: taiki-e/install-action@cross

      - name: Overwrite build command env variable
        if: matrix.job.use-cross
        shell: bash
        run: echo "BUILD_CMD=cross" >> $GITHUB_ENV

      - name: Show version information (Rust, cargo, GCC)
        shell: bash
        run: |
          gcc --version || true
          rustup -V
          rustup toolchain list
          rustup default
          cargo -V
          rustc -V

      - name: Import macOS code signing certificate
        if: startsWith(matrix.job.os, 'macos-')
        shell: bash
        run: |
          # Create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          echo -n "${{ env.APPLE_CODE_SIGNING_CERT }}" | base64 --decode -o $CERTIFICATE_PATH

          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          security import $CERTIFICATE_PATH -P '${{ env.APPLE_CODE_SIGNING_CERT_PASSWORD }}' -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

          echo "APPLE_SIGNING_IDENTITY=$(security find-identity -v -p codesigning | grep "Piebald LLC" | awk -F '"' '{print $2}')" >> $GITHUB_ENV

          # Write API key and set path in environment
          API_KEY_PATH=$RUNNER_TEMP/apple-api-key
          echo -n "${{ env.APP_STORE_CONNECT_API_KEY }}" | base64 --decode -o $API_KEY_PATH
          echo "APPLE_API_KEY_PATH=$API_KEY_PATH" >> $GITHUB_ENV

      - name: Build
        shell: bash
        run: $BUILD_CMD build --locked --release --target=${{ matrix.job.target }}

      - name: Set binary name & path
        id: bin
        shell: bash
        run: |
          # Figure out suffix of binary
          EXE_suffix=""
          case ${{ matrix.job.target }} in
            *-pc-windows-*) EXE_suffix=".exe" ;;
          esac;

          # Setup paths
          BIN_NAME="${{ needs.crate_metadata.outputs.name }}${EXE_suffix}"
          BIN_PATH="target/${{ matrix.job.target }}/release/${BIN_NAME}"

          # Let subsequent steps know where to find the binary
          echo "BIN_PATH=${BIN_PATH}" >> $GITHUB_OUTPUT
          echo "BIN_NAME=${BIN_NAME}" >> $GITHUB_OUTPUT

      - name: Codesign executable (macOS)
        if: startsWith(matrix.job.os, 'macos-')
        shell: bash
        env:
          APPLE_API_ISSUER: ${{ env.APP_STORE_CONNECT_API_KEY_ISSUER }}
          APPLE_API_KEY: ${{ env.APP_STORE_CONNECT_API_KEY_ID }}
        run: |
          codesign --force --options runtime \
            --sign "$APPLE_SIGNING_IDENTITY" \
            --timestamp \
            --identifier ai.piebald.splitrail \
            "${{ steps.bin.outputs.BIN_PATH }}"

      - name: Create notarization archive (macOS)
        if: startsWith(matrix.job.os, 'macos-')
        shell: bash
        run: |
          BIN_DIR=$(dirname "${{ steps.bin.outputs.BIN_PATH }}")
          BIN_NAME="${{ steps.bin.outputs.BIN_NAME }}"
          case "${{ matrix.job.os }}" in
            macos-15-intel) PLATFORM="macos-x64";;
            macos-15) PLATFORM="macos-arm64";;
            *) echo "Unsupported macOS: ${{ matrix.job.os }}"; exit 1;;
          esac
          pushd "$BIN_DIR" >/dev/null
          zip "${{ needs.crate_metadata.outputs.name }}-${PLATFORM}.zip" "$BIN_NAME"
          popd >/dev/null

      - name: Notarize archive (macOS)
        if: startsWith(matrix.job.os, 'macos-')
        shell: bash
        env:
          APPLE_API_ISSUER: ${{ env.APP_STORE_CONNECT_API_KEY_ISSUER }}
          APPLE_API_KEY: ${{ env.APP_STORE_CONNECT_API_KEY_ID }}
        run: |
          BIN_DIR=$(dirname "${{ steps.bin.outputs.BIN_PATH }}")
          case "${{ matrix.job.os }}" in
            macos-15-intel) PLATFORM="macos-x64";;
            macos-15) PLATFORM="macos-arm64";;
            *) echo "Unsupported macOS: ${{ matrix.job.os }}"; exit 1;;
          esac
          ARCHIVE_PATH="$BIN_DIR/${{ needs.crate_metadata.outputs.name }}-${PLATFORM}.zip"
          xcrun notarytool submit "$ARCHIVE_PATH" \
            --key "$APPLE_API_KEY_PATH" \
            --key-id "$APPLE_API_KEY" \
            --issuer "$APPLE_API_ISSUER" \
            --wait

      - name: Cleanup notarization archive and certificate (macOS)
        if: always() && startsWith(matrix.job.os, 'macos-')
        shell: bash
        run: |
          BIN_DIR=$(dirname "${{ steps.bin.outputs.BIN_PATH }}")
          case "${{ matrix.job.os }}" in
            macos-15-intel) PLATFORM="macos-x64";;
            macos-15) PLATFORM="macos-arm64";;
            *) echo "Unsupported macOS: ${{ matrix.job.os }}"; exit 1;;
          esac
          rm -f "$BIN_DIR/${{ needs.crate_metadata.outputs.name }}-${PLATFORM}.zip"
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true
          rm -f $RUNNER_TEMP/apple-api-key || true

      - name: Decode Windows code signing certificate
        if: startsWith(matrix.job.os, 'windows-')
        run: |
          $certBytes = [System.Convert]::FromBase64String("${{ env.WINDOWS_CODE_SIGNING_CERT }}")
          [System.IO.File]::WriteAllBytes("piebald_llc.crt", $certBytes)

      - name: Add SignTool to PATH
        if: startsWith(matrix.job.os, 'windows-')
        uses: kamaranl/add-signtool-action@v1

      - name: Install Google Cloud KMS CNG provider
        if: startsWith(matrix.job.os, 'windows-')
        run: |
          Invoke-WebRequest -Uri https://github.com/GoogleCloudPlatform/kms-integrations/releases/download/cng-v1.3/kmscng-1.3-windows-amd64.zip -OutFile kmscng.zip
          Expand-Archive -Path kmscng.zip -DestinationPath .
          $proc = Start-Process "msiexec" "/i kmscng-1.3-windows-amd64\kmscng.msi /qn" -NoNewWindow -PassThru -Wait
          Remove-Item -Path kmscng.zip,kmscng-1.3-windows-amd64 -Recurse -Force
          exit $proc.ExitCode

      - name: Sign Windows executable
        if: startsWith(matrix.job.os, 'windows-')
        run: |
          signtool sign `
            /v /debug /fd sha256 `
            /t http://timestamp.digicert.com `
            /f piebald_llc.crt `
            /csp "Google Cloud KMS Provider" `
            /kc ${{ vars.GCP_KMS_KEY }} `
            "${{ steps.bin.outputs.BIN_PATH }}"

      - name: Create tarball
        id: package
        shell: bash
        run: |
          PKG_suffix=".tar.gz" ; case ${{ matrix.job.target }} in *-pc-windows-*) PKG_suffix=".zip" ;; esac;
          PKG_BASENAME=${{ needs.crate_metadata.outputs.name }}-v${{ needs.crate_metadata.outputs.version }}-${{ matrix.job.target }}
          PKG_NAME=${PKG_BASENAME}${PKG_suffix}
          echo "PKG_NAME=${PKG_NAME}" >> $GITHUB_OUTPUT

          PKG_STAGING="${{ env.CICD_INTERMEDIATES_DIR }}/package"
          ARCHIVE_DIR="${PKG_STAGING}/${PKG_BASENAME}/"
          mkdir -p "${ARCHIVE_DIR}"

          # Binary
          cp "${{ steps.bin.outputs.BIN_PATH }}" "$ARCHIVE_DIR"

          # README and LICENSE
          cp "README.md" "LICENSE" "$ARCHIVE_DIR"

          # base compressed package
          pushd "${PKG_STAGING}/" >/dev/null
          case ${{ matrix.job.target }} in
            *-pc-windows-*) 7z -y a "${PKG_NAME}" "${PKG_BASENAME}"/* | tail -2 ;;
            *) tar czf "${PKG_NAME}" "${PKG_BASENAME}"/* ;;
          esac;
          popd >/dev/null

          # Let subsequent steps know where to find the compressed package
          echo "PKG_PATH=${PKG_STAGING}/${PKG_NAME}" >> $GITHUB_OUTPUT

      - name: Create Debian package
        id: debian-package
        shell: bash
        if: startsWith(matrix.job.os, 'ubuntu')
        run: |
          DPKG_STAGING="${{ env.CICD_INTERMEDIATES_DIR }}/debian-package"
          DPKG_DIR="${DPKG_STAGING}/dpkg"
          mkdir -p "${DPKG_DIR}"

          DPKG_BASENAME=${{ needs.crate_metadata.outputs.name }}
          DPKG_CONFLICTS=${{ needs.crate_metadata.outputs.name }}-musl
          case ${{ matrix.job.target }} in *-musl) DPKG_BASENAME=${{ needs.crate_metadata.outputs.name }}-musl ; DPKG_CONFLICTS=${{ needs.crate_metadata.outputs.name }} ;; esac;
          DPKG_VERSION=${{ needs.crate_metadata.outputs.version }}
          DPKG_ARCH="${{ matrix.job.dpkg_arch }}"
          DPKG_NAME="${DPKG_BASENAME}_${DPKG_VERSION}_${DPKG_ARCH}.deb"
          echo "DPKG_NAME=${DPKG_NAME}" >> $GITHUB_OUTPUT

          # Binary
          install -Dm755 "${{ steps.bin.outputs.BIN_PATH }}" "${DPKG_DIR}/usr/bin/${{ steps.bin.outputs.BIN_NAME }}"

          # README and LICENSE
          install -Dm644 "README.md" "${DPKG_DIR}/usr/share/doc/${DPKG_BASENAME}/README.md"
          install -Dm644 "LICENSE" "${DPKG_DIR}/usr/share/doc/${DPKG_BASENAME}/LICENSE"

          cat > "${DPKG_DIR}/usr/share/doc/${DPKG_BASENAME}/copyright" <<EOF
          Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
          Upstream-Name: ${{ needs.crate_metadata.outputs.name }}
          Source: ${{ needs.crate_metadata.outputs.homepage }}

          Files: *
          Copyright: ${{ needs.crate_metadata.outputs.maintainer }}
          Copyright: 2025 ${{ needs.crate_metadata.outputs.maintainer }}

          License: MIT
            Permission is hereby granted, free of charge, to any
            person obtaining a copy of this software and associated
            documentation files (the "Software"), to deal in the
            Software without restriction, including without
            limitation the rights to use, copy, modify, merge,
            publish, distribute, sublicense, and/or sell copies of
            the Software, and to permit persons to whom the Software
            is furnished to do so, subject to the following
            conditions:
            .
            The above copyright notice and this permission notice
            shall be included in all copies or substantial portions
            of the Software.
            .
            THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
            ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
            TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
            PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
            SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
            CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
            OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
            IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
            DEALINGS IN THE SOFTWARE.
          EOF

          chmod 644 "${DPKG_DIR}/usr/share/doc/${DPKG_BASENAME}/copyright"

          # control file
          mkdir -p "${DPKG_DIR}/DEBIAN"
          cat > "${DPKG_DIR}/DEBIAN/control" <<EOF
          Package: ${DPKG_BASENAME}
          Version: ${DPKG_VERSION}
          Section: utils
          Priority: optional
          Maintainer: ${{ needs.crate_metadata.outputs.maintainer }}
          Homepage: ${{ needs.crate_metadata.outputs.homepage }}
          Architecture: ${DPKG_ARCH}
          Provides: ${{ needs.crate_metadata.outputs.name }}
          Conflicts: ${DPKG_CONFLICTS}
          Description: Blazing fast, single-executable, cross-platform, agentic development monitor.  Supports Claude Code / Codex CLI / Gemini CLI / Qwen Code / Cline / Roo Code / Kilo Code / GitHub Copilot / OpenCode / Pi Agent, and integrates with Splitrail Cloud.
          EOF

          DPKG_PATH="${DPKG_STAGING}/${DPKG_NAME}"
          echo "DPKG_PATH=${DPKG_PATH}" >> $GITHUB_OUTPUT

          # build dpkg
          fakeroot dpkg-deb --build "${DPKG_DIR}" "${DPKG_PATH}"

      - name: "Artifact upload: tarball"
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.package.outputs.PKG_NAME }}
          path: ${{ steps.package.outputs.PKG_PATH }}

      - name: "Artifact upload: Debian package"
        uses: actions/upload-artifact@v4
        if: steps.debian-package.outputs.DPKG_NAME
        with:
          name: ${{ steps.debian-package.outputs.DPKG_NAME }}
          path: ${{ steps.debian-package.outputs.DPKG_PATH }}

  publish_release:
    name: Publish release
    runs-on: ubuntu-latest
    needs:
      - build
    permissions:
      contents: write
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Publish archives and packages
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          make_latest: "true"
          files: |
            artifacts/**

  publish_homebrew:
    name: Publish Homebrew formula
    runs-on: ubuntu-latest
    needs:
      - crate_metadata
      - publish_release
    permissions:
      contents: read
      id-token: write
    env:
      HOMEBREW_TAP_REPOSITORY: Piebald-AI/homebrew-tap
      HOMEBREW_TAP_FORMULA: splitrail
      HOMEBREW_TAP_BRANCH: main
    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          path: artifacts

      - name: Fetch release app credentials from Infisical
        uses: Infisical/secrets-action@77ab1f4ccd183a543cb5b42435fbd181189f4995 # v1.0.16
        with:
          method: oidc
          identity-id: ${{ vars.INFISICAL_IDENTITY_ID }}
          env-slug: prod
          project-slug: ${{ vars.INFISICAL_PROJECT_SLUG }}

      - name: Create GitHub App token
        id: release-app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ env.RELEASES_APP_CLIENT_ID }}
          private-key: ${{ env.RELEASES_APP_PRIVATE_KEY }}
          owner: Piebald-AI
          repositories: homebrew-tap
          permission-contents: write

      - name: Resolve release app identity
        id: release-app-identity
        env:
          GH_TOKEN: ${{ steps.release-app-token.outputs.token }}
          APP_SLUG: ${{ steps.release-app-token.outputs.app-slug }}
        run: |
          set -euo pipefail
          user_id=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)
          # Guard against a missing/null id (jq prints "null" and exits 0) so a
          # malformed value can't flow into the noreply commit email downstream.
          if [[ ! "$user_id" =~ ^[0-9]+$ ]]; then
            echo "Resolved an invalid user id for ${APP_SLUG}[bot]: '${user_id}'" >&2
            exit 1
          fi
          echo "user-id=${user_id}" >> "$GITHUB_OUTPUT"

      - name: Checkout Homebrew tap
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ${{ env.HOMEBREW_TAP_REPOSITORY }}
          token: ${{ steps.release-app-token.outputs.token }}
          path: homebrew-tap
          ref: ${{ env.HOMEBREW_TAP_BRANCH }}
          persist-credentials: false

      - name: Update formula URLs and checksums
        shell: bash
        env:
          VERSION: ${{ needs.crate_metadata.outputs.version }}
          FORMULA: ${{ env.HOMEBREW_TAP_FORMULA }}
        run: |
          set -euo pipefail

          formula_path="homebrew-tap/Formula/${FORMULA}.rb"
          release_base_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/v${VERSION}"
          targets=(
            "aarch64-apple-darwin"
            "x86_64-apple-darwin"
            "aarch64-unknown-linux-gnu"
            "x86_64-unknown-linux-gnu"
          )

          if [[ ! -f "$formula_path" ]]; then
            echo "Formula not found: $formula_path" >&2
            exit 1
          fi

          for target in "${targets[@]}"; do
            artifact="${FORMULA}-v${VERSION}-${target}.tar.gz"
            artifact_path="artifacts/${artifact}/${artifact}"
            url="${release_base_url}/${artifact}"

            if [[ ! -f "$artifact_path" ]]; then
              echo "Artifact not found: $artifact_path" >&2
              exit 1
            fi

            sha256=$(sha256sum "$artifact_path" | awk '{print $1}')
            TARGET="$target" URL="$url" SHA256="$sha256" ruby -e '
              path = ARGV.fetch(0)
              formula = ENV.fetch("FORMULA")
              target = ENV.fetch("TARGET")
              url = ENV.fetch("URL")
              sha256 = ENV.fetch("SHA256")
              lines = File.readlines(path)
              index = lines.index { |line| line.include?("#{formula}-v") && line.include?("-#{target}.tar.gz") }
              abort "could not find Homebrew url for #{formula} #{target}" unless index
              abort "could not find Homebrew sha256 for #{target}" unless lines[index + 1]&.match?(/^\s*sha256 "/)
              abort "could not substitute url for #{formula} #{target}" if lines[index].sub!(/url ".*"/, "url \"#{url}\"").nil?
              abort "could not substitute sha256 for #{formula} #{target}" if lines[index + 1].sub!(/sha256 "[0-9a-f]+"/, "sha256 \"#{sha256}\"").nil?
              File.write(path, lines.join)
            ' "$formula_path"

            # Guard against the url/sha256 drifting apart: confirm both the exact
            # rewritten url and its matching checksum are present in the formula.
            grep -Fq "url \"${url}\"" "$formula_path" || { echo "Failed to update url for ${target} in $formula_path" >&2; exit 1; }
            grep -Fq "sha256 \"${sha256}\"" "$formula_path" || { echo "Failed to update sha256 for ${target} in $formula_path" >&2; exit 1; }
          done

      - name: Commit and push formula update
        shell: bash
        working-directory: homebrew-tap
        env:
          VERSION: ${{ needs.crate_metadata.outputs.version }}
          FORMULA: ${{ env.HOMEBREW_TAP_FORMULA }}
          BRANCH: ${{ env.HOMEBREW_TAP_BRANCH }}
          TAP_REPOSITORY: ${{ env.HOMEBREW_TAP_REPOSITORY }}
          TAP_TOKEN: ${{ steps.release-app-token.outputs.token }}
          APP_SLUG: ${{ steps.release-app-token.outputs.app-slug }}
          APP_USER_ID: ${{ steps.release-app-identity.outputs.user-id }}
        run: |
          set -euo pipefail

          git config user.name "${APP_SLUG}[bot]"
          git config user.email "${APP_USER_ID}+${APP_SLUG}[bot]@users.noreply.github.com"

          if git diff --quiet -- "Formula/${FORMULA}.rb"; then
            echo "Formula/${FORMULA}.rb is already up to date"
            exit 0
          fi

          git add "Formula/${FORMULA}.rb"
          git commit -m "Update ${FORMULA} to v${VERSION}"

          # Authenticate with the documented Basic form for ghs_ installation
          # tokens over HTTPS (x-access-token:<token>), which is the path
          # actions/checkout uses internally.
          auth_header="AUTHORIZATION: basic $(printf 'x-access-token:%s' "${TAP_TOKEN}" | base64 -w0)"

          # Retry against concurrent pushes to the tap branch: rebase onto the
          # latest remote tip and try again rather than failing the release on a race.
          remote="https://github.com/${TAP_REPOSITORY}.git"
          for attempt in 1 2 3 4 5; do
            if git -c http.extraheader="${auth_header}" push "$remote" "HEAD:${BRANCH}"; then
              echo "Pushed formula update on attempt ${attempt}"
              exit 0
            fi
            echo "Push attempt ${attempt} failed; rebasing on latest ${BRANCH} and retrying" >&2
            git -c http.extraheader="${auth_header}" fetch "$remote" "${BRANCH}"
            git rebase FETCH_HEAD
            sleep $((attempt * 3))
          done
          echo "Failed to push formula update after multiple attempts" >&2
          exit 1

  # TODO: Enable after initial release.
  # winget:
  #   name: Publish to Winget
  #   runs-on: ubuntu-latest
  #   needs: build
  #   if: startsWith(github.ref, 'refs/tags/v')
  #   steps:
  #     - uses: vedantmgoyal9/winget-releaser@main
  #       with:
  #         identifier: piebald.splitrail
  #         installers-regex: '-pc-windows-msvc\.zip$'
  #         token: ${{ secrets.WINGET_TOKEN }}