3 Create GitHub action

[yeminko]

This pull request introduces a new GitHub Actions workflow to automate updating the Homebrew tap formula for the project upon each release. The workflow calculates the release tarball's SHA-256 checksum, updates the gitid.rb formula in the homebrew-tap repository, and pushes the changes automatically.

Release automation:

• Added a .github/workflows/release-tap.yaml workflow that triggers on release publication, computes the release tarball SHA-256, updates the gitid.rb formula in the homebrew-tap repository with the new tag and checksum, and commits the changes automatically.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical shell-injection risk and additional workflow reliability issues must be addressed.

Review effort: Lite
Findings: 1 · 2

Open (3)

• Prevent shell injection when interpolating release tags · New
• Serialize release updates to prevent non-fast-forward pushes · New
• Make curl fail on HTTP errors before hashing · New

What changed in this PR

Adds a release-triggered GitHub Actions workflow to update and push the Homebrew tap formula.

Changes:

• Computes the release tarball SHA-256 checksum.
• Updates gitid.rb with the release tag and checksum.
• Commits and pushes changes to homebrew-tap.

File	Summary
.github/​workflows/​release-tap.yaml	Adds release automation. Findings include unsafe shell interpolation of the release tag (critical), insufficient curl error handling, silent formula-update failures, and concurrent-release push conflicts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved shell interpolation and tag-escaping issues can execute commands or produce invalid formula updates.

Review effort: Lite
Findings: 1

Open (1)

• Prevent shell command injection when interpolating release tags · New

Resolved since last review (3)

• Prevent shell injection when interpolating release tags
• Make curl fail on HTTP errors before hashing
• Serialize release updates to prevent non-fast-forward pushes

Previously missed (1)

In code that hasn't changed since last review

Escape Git tag characters before sed replacement

.github/​workflows/​release-tap.yaml:43

The tag is placed unescaped in the replacement part of a sed expression. Valid Git ref names can contain characters such as & and |; & expands to the entire matched URL and | breaks the command, so publishing such a tag can produce an invalid formula or fail the job. Escape replacement metacharacters before substitution (or use a parser).

[Copilot]

Copilot review overview

🔵 Needs a closer look

Fix the unsafe tag substitution and validate that formula updates actually occur.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Prevent shell command injection when interpolating release tags

Previously missed (1)

In code that hasn't changed since last review

Escape Git tag metacharacters before sed substitution

.github/​workflows/​release-tap.yaml:44

A valid Git tag can contain & (and |), but interpolating it directly into the sed replacement makes & expand to the entire matched URL and | terminate the replacement. For example, v1.0.0&beta produces a malformed formula URL, so releases using those tag names will commit an unusable formula. Escape sed replacement metacharacters (or update the formula with a structured script) before substituting the tag.