brew release should run an actual release workflow

[Copilot]

• Understand current brew release command and workflow structure
• Add workflow_dispatch trigger to pkg-installer.yml workflow
• Move tag creation to after notarization in workflow
• Remove release: published trigger from workflow
• Add --force flag to brew release for dry-run by default
• Update workflow to create tag after package is built and notarized
• Update command to show release notes without creating release by default
• Fix Sorbet type checking errors
• Verify tests pass

Implementation Details

Tag Creation Timing

The tag and draft release are now created in the upload job, AFTER the package has been built and notarized. This ensures the tag only exists once the workflow has completed successfully.

Dry-Run by Default

Without --force, brew release now just shows what release notes would be generated. With --force, it triggers the workflow.

Removed Release Trigger

The workflow no longer triggers on release: published events since the workflow now handles everything.

Type Safety Fixes

• Added proper type annotation for workflow_run_url variable: T.let(nil, T.nilable(String))
• Used _e for exception variable in rescue block inside loop to avoid Sorbet scoping issues

Flow:

1. brew release (without --force) shows release notes
2. brew release --force triggers workflow
3. Workflow builds package, notarizes it
4. Workflow creates tag and draft release, uploads package
5. User can then publish the immutable release

Original prompt

---

This section details on the original issue you should resolve

<issue_title>brew release should run an actual release workflow</issue_title>
<issue_description>### Verification

• This issue's title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.

Provide a detailed description of the proposed feature

brew release currently creates a tag and draft release for us to finalize prior to publishing. This has worked well, but we'd like to start taking advantage of immutable releases. We can't enable these currently, because our pkg-installer workflow uploads the artifact once the release is created.

What is the motivation for the feature?

Immutable releases will increase user confidence with our releases. By ensuring our GitHub releases cannot be changed after publishing, we can show users that nothing was tampered with after the fact.

How will the feature be relevant to at least 90% of Homebrew users?

Users will benefit from a more robust, secure release process.

What alternatives to the feature have been considered?

Leave immutable releases off, and maintain status quo.</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #20751

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[MikeMcQuaid]

@copilot try again

[Copilot]

@copilot try again

Implemented the workflow-based release process. The key changes:

1. Added workflow_dispatch trigger to pkg-installer.yml
2. Modified brew release to create the tag, trigger the workflow, and wait for completion
3. The workflow now uploads the package to the draft release before it's published

This enables immutable releases by ensuring the package is attached before publication.

Commit: bc517ab

[MikeMcQuaid]

@copilot fix this CI failure:

+ brew typecheck
dev-cmd/release.rb:141: Changing the type of a variable is not permitted in loops and blocks https://srb.help/7001
     141 |                workflow_run_url = run["html_url"]
                                             ^^^^^^^^^^^^^^^
  Existing variable has type: `NilClass`
  Attempting to change type to: `T.untyped`

  Autocorrect: Use `-a` to autocorrect
    dev-cmd/release.rb:125: Replace with `T.let(nil, T.untyped)`
     125 |        workflow_run_url = nil
                                     ^^^

dev-cmd/release.rb:159: Changing the type of a variable is not permitted in loops and blocks https://srb.help/7001
     159 |          rescue *GitHub::API::ERRORS => e
                                                   ^
  Existing variable has type: `NilClass`
  Attempting to change type to: `Exception`

  Original type from:
    dev-cmd/release.rb:37: Possibly uninitialized (`NilClass`) in:
    37 |      def run
              ^^^^^^^
Errors: 2
Check https://docs.brew.sh/Typechecking for more information on how to resolve these errors.
Error: Process completed with exit code 1.

[Copilot]

@copilot fix this CI failure:

...

Fixed the Sorbet type checking errors:

1. Added proper type annotation: workflow_run_url = T.let(nil, T.nilable(String))
2. Changed exception variable in rescue block from e to _e to avoid Sorbet scoping issues with loops

Commit: will be in next push