fix: avoid untrusted checkout in Homebrew sync workflow

Run formula sync as a release-scoped job after npm publish instead of a
workflow_run trigger that checked out workflow_run.head_sha with write access.

Co-authored-by: Cursor <[email protected]>

Author: zereight

.github/workflows/homebrew-formula.yml

@@ -1,23 +1,19 @@
 name: Sync Homebrew Formula
 
 on:
-  workflow_run:
-    workflows: ["NPM Publish"]
-    types: [completed]
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   sync:
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || '' }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4

.github/workflows/npm-publish.yml

@@ -30,3 +30,26 @@ jobs:
         run: npm run build
       - name: Publish to npm
         run: npm publish --access public --provenance
+
+  sync-homebrew:
+    needs: npm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.21.1"
+
+      - name: Sync formula from npm tarball
+        run: bash scripts/sync-homebrew-formula.sh
+
+      - name: Commit formula update
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: chore(homebrew): sync formula for release
+          file_pattern: Formula/zereight-mcp-gitlab.rb