feat: automate brew tap publishing + upgrade to Go 1.27

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        go: ['1.26.x']
+        go: ['1.27.x']
     runs-on: ${{ matrix.os }}
     defaults:
       run:
@@ -68,7 +68,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.x'
+          go-version: '1.27.x'
           cache: true
 
       - name: golangci-lint
@@ -87,7 +87,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.x'
+          go-version: '1.27.x'
           cache: true
 
       - name: Install govulncheck
@@ -108,7 +108,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.x'
+          go-version: '1.27.x'
           cache: true
 
       - name: make build

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.x'
+          go-version: '1.27.x'
           cache: true
 
       - name: Install Syft (SBOM generator)
@@ -36,6 +36,18 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.2
 
+      # Short-lived installation token for pushing the cask to homebrew-okf.
+      # The App has Contents read/write on that one repository only; the
+      # token expires after an hour and is revoked when the job ends.
+      - name: Mint tap push token
+        id: tap-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.TAP_APP_CLIENT_ID }}
+          private-key: ${{ secrets.TAP_APP_PRIVATE_KEY }}
+          owner: okfcli
+          repositories: homebrew-okf
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v7
         with:
@@ -44,3 +56,4 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}

.goreleaser.yaml

@@ -84,3 +84,27 @@ release:
   draft: false
   prerelease: auto
   name_template: "v{{ .Version }}"
+
+# Publishes the okf cask to the tap on every non-prerelease release. The token
+# is a short-lived GitHub App installation token minted in release.yml; the
+# default Actions token cannot push to a second repository.
+homebrew_casks:
+  - name: okf
+    homepage: https://github.com/okfcli/okf
+    description: "Go CLI toolkit for the Open Knowledge Format (OKF), agentic-first and JSON-native"
+    skip_upload: auto
+    url:
+      verified: github.com/okfcli/okf/
+    # The binaries are not signed or notarized, so strip the Gatekeeper
+    # quarantine bit on macOS; without this, users get "okf is damaged and
+    # cannot be opened".
+    hooks:
+      post:
+        install: |
+          if OS.mac?
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/okf"]
+          end
+    repository:
+      owner: okfcli
+      name: homebrew-okf
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"

go.mod

@@ -1,5 +1,5 @@
 module github.com/okfcli/okf
 
-go 1.26.5
+go 1.27.0
 
 require gopkg.in/yaml.v3 v3.0.1