Consolidate Homebrew release into CI

[0x77dev]

Eliminates the duplicate Homebrew workflow and uses the normal three-platform CI build as the release input. Tag/manual release jobs remain side-effect isolated with job-scoped permissions. The separately merged registry repair remains intact.\n\nVerified: actionlint .github/workflows/ci.yml; git diff --check.

[greptile-apps]

Confidence Score: 4/5

Not safe to merge until same-version tag and manual releases share one concurrency group.

A focused executable check reproduced one independently actionable release coordination failure and confirmed that the release jobs inherit the conflicting workflow-level concurrency setting.

Files Needing Attention: .github/workflows/ci.yml needs its workflow-level concurrency key normalized for manual and tag-triggered releases.

T-Rex Logs

What T-Rex did

• T-Rex ran a focused CI concurrency validation script to support a posted P1 finding.
• T-Rex produced a second P1 finding proof documenting additional validation steps.
• T-Rex validated contract-related behavior by confirming tag and dispatch outputs and that release jobs follow the workflow-level concurrency setting with an exit code of 0.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   Tag push and manual release dispatch use different concurrency groups

   • Bug
     • For the same tag vX.Y.Z, the workflow-level expression produces ci-refs/tags/vX.Y.Z on a tag-push event but ci-vX.Y.Z on a workflow_dispatch event. Because GitHub Actions serializes only identical concurrency-group strings, both runs may proceed concurrently. The workflow-level setting covers the release jobs, and those jobs do not add an overriding concurrency group.
   • Cause
     • The tag-push branch uses the fully qualified github.ref (refs/tags/vX.Y.Z), whereas the manual-dispatch branch uses the unqualified inputs.tag (vX.Y.Z).
   • Fix
     • Normalize both branches to the same tag representation in the concurrency key, for example use ci-${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }}.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "Consolidate Homebrew release into CI" | Re-trigger Greptile}

[greptile-apps]

Same-tag releases are not serialized

A tag push for vX.Y.Z uses ci-refs/tags/vX.Y.Z, while a manual run for that same tag uses ci-vX.Y.Z. These are separate concurrency groups, allowing both trusted release runs to overlap and race GitHub release creation, source-asset upload, tap dispatch, and Formula branch publication. Normalize the tag representation in both branches of the group expression so a manual retry and the tag-triggered release serialize together.

Artifacts

Focused CI concurrency validation script

• The executed deterministic Python source reads `.github/workflows/ci.yml`, evaluates the two requested event contexts, and checks release-job concurrency scope; it demonstrates the exact condition under test.

Focused CI concurrency validation output

• The captured Python execution from `/home/user/repo` exited successfully and shows the two distinct concurrency group strings; the takeaway is that the runs are not serialized together.

_{Ran code and verified through T-Rex}