feat: bump the homebrew-tap formula automatically after each release

New homebrew-tap-bump job, parallel to the container job (both need:
[burrito-package]) - reads the just-published release's tag +
SHA256SUMS, updates rubyists/homebrew-tap's Formula/linear-cli/linear-cli.rb
url/sha256 for both platforms via ci/bump_homebrew_formula.rb, and opens
a PR there via peter-evans/create-pull-request@v8 (no-op if nothing
changed).

Uses the RELEASE_PLEASE_TOKEN org secret to push/PR against a different
repo than the one the workflow runs in - the default GITHUB_TOKEN is
scoped only to this repo.

The actual bump logic lives in ci/bump_homebrew_formula.rb rather than
inline in the workflow YAML, so it's runnable/testable locally without
a real CI run - verified directly against a real copy of the formula
and real release checksums, confirmed idempotent, and re-verified after
the tap repo's Formula/lc.rb -> Formula/linear-cli/linear-cli.rb move.

Depends on rubyists/homebrew-tap#3 (submodule pointer bumped to that
branch's tip - update again once it merges if the SHA changes from a
squash-merge).

Author: bougyman

.github/workflows/main.yaml

@@ -350,3 +350,54 @@ jobs:
           name: container-sbom
           path: container-sbom.cdx.json
           retention-days: 90
+
+  homebrew-tap-bump:
+    needs: [burrito-package]
+    name: Bump the Homebrew tap formula
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout linear-cli (for ci/bump_homebrew_formula.rb)
+        uses: actions/checkout@v7
+        with:
+          path: linear-cli
+      -
+        # RELEASE_PLEASE_TOKEN (org secret) - the default GITHUB_TOKEN is
+        # scoped only to this repo, and can't push/open a PR against a
+        # different one.
+        name: Checkout rubyists/homebrew-tap
+        uses: actions/checkout@v7
+        with:
+          repository: rubyists/homebrew-tap
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          path: homebrew-tap
+      -
+        name: Download this release's SHA256SUMS
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release download "${{ needs.burrito-package.outputs.tag_name }}" \
+              --repo rubyists/linear-cli --pattern SHA256SUMS --output linear-cli/SHA256SUMS
+      -
+        name: Bump the formula's url/sha256 for each platform
+        run: |
+          ruby linear-cli/ci/bump_homebrew_formula.rb \
+              homebrew-tap/Formula/linear-cli/linear-cli.rb \
+              "${{ needs.burrito-package.outputs.tag_name }}" \
+              linear-cli/SHA256SUMS
+      -
+        # No-op (no PR opened, nothing pushed) when there's nothing to
+        # commit - same action/behavior already relied on in
+        # usage-rules-sync.yaml.
+        name: Open a PR bumping the formula, if anything changed
+        uses: peter-evans/create-pull-request@v8
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          path: homebrew-tap
+          commit-message: "fix: bump linear-cli formula to ${{ needs.burrito-package.outputs.tag_name }}"
+          title: "fix: bump linear-cli formula to ${{ needs.burrito-package.outputs.tag_name }}"
+          body: >-
+            Auto-generated after rubyists/linear-cli's
+            ${{ needs.burrito-package.outputs.tag_name }} release.
+          branch: "bump-formula-${{ needs.burrito-package.outputs.tag_name }}"
+          delete-branch: true

ci/bump_homebrew_formula.rb

@@ -0,0 +1,48 @@
+#!/usr/bin/env ruby
+# Bumps a Homebrew formula's per-platform `url`/`sha256` pairs to a new
+# rubyists/linear-cli release - the `.github/workflows/main.yaml`
+# `homebrew-tap-bump` job's only real logic, kept out of the workflow YAML
+# so it's runnable/testable locally without a real CI run.
+#
+# Usage: bump_homebrew_formula.rb FORMULA_PATH TAG SHA256SUMS_PATH
+#
+#   FORMULA_PATH     path to the formula file (e.g. Formula/linear-cli/linear-cli.rb)
+#   TAG              the release tag, e.g. "v1.3.0"
+#   SHA256SUMS_PATH  that release's own SHA256SUMS asset, as downloaded
+
+formula_path, tag, sha256sums_path = ARGV
+
+unless formula_path && tag && sha256sums_path
+  abort "Usage: #{$PROGRAM_NAME} FORMULA_PATH TAG SHA256SUMS_PATH"
+end
+
+sha256sums =
+  File.readlines(sha256sums_path).each_with_object({}) do |line, acc|
+    sha, name = line.split(/\s+/, 2)
+    acc[name.strip] = sha if name
+  end
+
+content = File.read(formula_path)
+
+%w[macos_aarch64 linux_x86_64].each do |target|
+  asset = "lc_#{target}.tar.gz"
+  sha = sha256sums.fetch(asset) { abort "No checksum found for #{asset} in #{sha256sums_path}" }
+
+  pattern = /
+    url\ "https:\/\/github\.com\/rubyists\/linear-cli\/releases\/download\/v[\d.]+\/#{Regexp.escape(asset)}"
+    \n(\s*)
+    sha256\ "[a-f0-9]+"
+  /x
+
+  unless content.match?(pattern)
+    abort "Could not find a url/sha256 pair for #{asset} in #{formula_path}"
+  end
+
+  content = content.sub(pattern) do
+    indent = ::Regexp.last_match(1)
+    %(url "https://github.com/rubyists/linear-cli/releases/download/#{tag}/#{asset}"\n#{indent}sha256 "#{sha}")
+  end
+end
+
+File.write(formula_path, content)
+puts "Bumped #{formula_path} to #{tag}"