feat: add Homebrew formula and update workflow for automatic formula …

[stearz]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Adds Homebrew installation support for Kelos, allowing users to install and manage Kelos via:

brew tap kelos-dev/tap
brew install kelos

This improves the installation experience and makes Kelos discoverable through a widely-used package manager.

This PR includes:

• Automated formula updates in GitHub Actions during release workflow
• Platform detection for macOS (Intel/ARM64) and Linux (x86_64/ARM64)
• Installation and version tests

The formula is automatically updated with correct checksums and version on every release, requiring no manual intervention.

Which issue(s) this PR is related to:

Fixes #817

Special notes for your reviewer:

• The GitHub Actions workflow automatically skips duplicate builds when the bot commits formula updates (using if: github.actor != 'kelos-dev[bot]')
• Binaries must be built and checksummed in the release job before the formula update step
• Formula uses placeholders that are replaced at release time with actual checksums
• The update-homebrew-formula.sh script handles downloading checksums from the GitHub release and updating the formula

Does this PR introduce a user-facing change?

Yes - a new installation method.

Add Homebrew installation support: users can now install Kelos via `brew tap kelos-dev/tap && brew install kelos`


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds Homebrew support so users can install `kelos` via `brew tap`/`install`. The formula auto-updates on releases and supports macOS (Intel/ARM) and Linux (AMD64/ARM64).

- **New Features**
  - Added `Formula/kelos.rb` with per-OS/arch URLs; version and checksums are injected at release; includes a `kelos version` test.
  - New workflow runs on release publish to update `kelos-dev/homebrew-tap`: copy the formula, run `hack/update-homebrew-formula.sh <tag>`, then commit and push.
  - Script pulls `checksums.txt`, verifies `darwin`/`linux` for `amd64`/`arm64`, strips the leading `v`, and updates shas/version. README shows `brew tap kelos-dev/tap && brew install kelos`.

<sup>Written for commit 0916609bbabf08199176c7e4b2b193d184e0b3c8. Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->

[cubic-dev-ai]

2 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="hack/update-homebrew-formula.sh">

<violation number="1" location="hack/update-homebrew-formula.sh:15">
P2: The script downloads a release asset named `checksums.txt` but then reads `/tmp/kelos-checksums.txt`. Since the checksums file generated by the release process is `checksums.txt`, the parsing loop will fail when the file isn’t renamed. This will abort the formula update.</violation>
</file>

<file name=".github/workflows/release.yaml">

<violation number="1" location=".github/workflows/release.yaml:99">
P2: Release workflow pushes from a detached HEAD on tag builds; `git push` will fail or not update main, so the Homebrew formula update won’t land.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/release.yaml">

<violation number="1" location=".github/workflows/release.yaml:99">
P1: Tag-triggered workflow may fail to push formula updates because `git push origin main` requires a local `main` ref that is not guaranteed in tag checkout context.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[stearz]

I fixed a conflict and squashed the commits. Ready to review

[stearz]

Alright, fixed verify issues and amended the the commit. NOW it is ready for review and merge.

Beware that this PR needs to be merged before so the tap repo is as expected: kelos-dev/homebrew-tap#1

Additionally you need to set up a PAT that is allowed to make changes to the tap repo and give it to the kelos repo as a TAP_GITHUB_TOKEN secret:

  Setting up the TAP_GITHUB_TOKEN secret

  The release workflow automatically updates the Homebrew formula in kelos-dev/homebrew-tap after each release. To
  enable this, a Personal Access Token (PAT) with write access to the tap repository must be configured as a secret
  in the main kelos-dev/kelos repository.

  1. Create the PAT

  Go to github.com/settings/personal-access-tokens/new and create a fine-grained PAT with the following settings:

  - Resource owner: kelos-dev
  - Repository access: Only select repositories → kelos-dev/homebrew-tap
  - Permissions → Contents: Read and write

  2. Add the secret to the kelos repository

  Go to kelos-dev/kelos → Settings → Secrets and variables → Actions → New repository secret and add:

  - Name: TAP_GITHUB_TOKEN
  - Value: the PAT from step 1

  Once set, the release workflow will automatically clone the tap repository, update Formula/kelos.rb with the new
  version and checksums, and push the commit on every tagged release.

It would be more elegant if we would use goreleaser but that would require more work because it would interfer with your existing build and release notes automation. I therfor decided to not go that way.

Hope to be able to install and especially update (that's the bigger value) kelos with homebrew soon.

[gjkim42]

/kelos review

[kelos-bot]

🤖 Kelos Task Status

Task kelos-reviewer-818 has succeeded. ✅

[gjkim42]

can we update the release note?
It's mixed up with cubic's comment.

[kelos-bot]

🤖 Kelos Reviewer Agent @gjkim42

Review Summary

Verdict: REQUEST CHANGES
Scope: Adds Homebrew formula, release workflow integration, and update script for automatic tap updates on release.

Findings

Correctness

• README.md:146 — brew tap command points to a nonexistent repo. brew tap kelos-dev/kelos resolves to github.com/kelos-dev/homebrew-kelos, which does not exist. The actual tap repo is kelos-dev/homebrew-tap, so the correct command is brew tap kelos-dev/tap. This would cause the documented installation instructions to fail for every user.
• Formula/kelos.rb:35 — Dead variable binary_name. The variable binary_name = "kelos-#{OS.kernel_name.downcase}-#{Hardware::CPU.arch}" is computed but never referenced. The next line uses Dir.glob("kelos-*").first instead. Remove the unused variable or use it.

Workflow

• .github/workflows/release.yaml:14–15 — Unnecessary bot guard. The if: github.actor != 'kelos-dev[bot]' condition on the release job can never trigger because the bot only pushes to kelos-dev/homebrew-tap (a different repo), not to kelos-dev/kelos. It won't prevent any real double-build scenario. Not harmful, but misleading — consider removing it or adding a comment explaining the intended future scenario.
• .github/workflows/release.yaml — Formula updated before release is published. The release is created with --draft, and the formula update runs in the same job immediately after. This means the formula (with real checksums and version) is pushed to the tap repo while the release is still a draft. During this window, brew install kelos would fail with a 404 because draft release assets aren't publicly downloadable. Consider either: (a) moving the formula update to a separate workflow triggered by release: published, or (b) publishing the release before updating the formula.

Code Quality

• Formula/kelos.rb:6 — Version will include v prefix. The VERSION step outputs v1.2.3, so the formula will have version "v1.2.3". Homebrew convention is bare version numbers (1.2.3). Consider stripping the prefix in the formula (version "1.2.3") and adjusting the URL to ...download/v#{version}/.... This avoids potential issues with Homebrew's version comparison logic.

Suggestions

• The formula test (assert !output.empty?) is weak — consider assert_match "kelos", output or matching the version string for a more meaningful check.
• Consider adding trap 'rm -f /tmp/checksums.txt' EXIT at the top of hack/update-homebrew-formula.sh to clean up the downloaded checksums file.

/kelos needs-input

[stearz]

Requested changes should be delivered with 0916609