Stop pushing to the tap; it pulls now

The update-homebrew-formula job sent a repository_dispatch that needed a
personal access token with write access to the tap. That token expired
after a year, the dispatch returned 401, and the step reported success
regardless — so v0.5.0 shipped with the formula still pointing at a
release that had been deleted.

The tap now runs formula-sync.yml on a schedule: it reads the latest
release here, which is public and needs no credential, and commits with
its own GITHUB_TOKEN. Nothing expires, and a missed run is corrected by
the next one.

The job is kept rather than deleted because post-release depends on it
and reads its result; its body is now a note explaining where formula
updates happen and how to trigger one immediately. No reference to
HOMEBREW_TAP_DISPATCH_TOKEN remains, so that secret can be deleted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017rmyikdjWveP99ZUCDLY89

Author: beriberikix

.github/workflows/release.yml

@@ -729,135 +729,27 @@ jobs:
     needs: [release-validation, create-release, generate-homebrew-metadata]
     if: always() && needs.create-release.result == 'success'
     steps:
-      - name: 🏺 Starting Homebrew Formula Update
+      # The tap pulls; this repository no longer pushes to it.
+      #
+      # This job used to send a repository_dispatch to homebrew-usbipd-mac, which needed
+      # a personal access token with write access there. The token expired after a year,
+      # the dispatch began returning 401, and the step reported success regardless — so
+      # v0.5.0 shipped with the formula still pointing at a deleted release.
+      #
+      # homebrew-usbipd-mac now runs formula-sync.yml on a schedule: it reads the latest
+      # release here, which is public and needs no credential, and commits with its own
+      # GITHUB_TOKEN. Nothing expires, and a missed run is corrected by the next one.
+      - name: 🏺 Homebrew formula updates by pull
         run: |
-          echo "::notice title=Homebrew Update::Starting automated Homebrew formula update via repository dispatch"
-          echo "🏺 This stage triggers formula update in the tap repository"
-          echo "📊 Status: STARTING"
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: 📥 Download Homebrew Metadata
-        uses: actions/download-artifact@v4
-        with:
-          name: homebrew-metadata-${{ needs.release-validation.outputs.version }}
-          path: homebrew-metadata/
-
-      - name: 🔧 Extract Metadata for Dispatch
-        id: extract-metadata
-        run: |
-          echo "::group::Metadata Extraction"
-          echo "::notice title=Metadata::Extracting metadata for repository dispatch"
-          
-          METADATA_FILE="homebrew-metadata/homebrew-metadata.json"
-          
-          if [ ! -f "$METADATA_FILE" ]; then
-            echo "::error title=Metadata Missing::Homebrew metadata file not found"
-            exit 1
-          fi
-          
-          # Extract metadata fields using jq
-          VERSION=$(jq -r '.metadata.version' "$METADATA_FILE")
-          ARCHIVE_URL=$(jq -r '.metadata.archive_url' "$METADATA_FILE")
-          BINARY_URL=$(jq -r '.metadata.binary_url' "$METADATA_FILE")
-          SHA256=$(jq -r '.metadata.sha256' "$METADATA_FILE")
-          TIMESTAMP=$(jq -r '.metadata.timestamp' "$METADATA_FILE")
-          
-          echo "🔍 Extracted metadata:"
-          echo "   • Version: $VERSION"
-          echo "   • Archive URL: $ARCHIVE_URL"
-          echo "   • Binary URL: $BINARY_URL"
-          echo "   • SHA256: ${SHA256:0:16}..."
-          echo "   • Timestamp: $TIMESTAMP"
-          
-          # Output for next step
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "archive_url=$ARCHIVE_URL" >> $GITHUB_OUTPUT
-          echo "binary_url=$BINARY_URL" >> $GITHUB_OUTPUT
-          echo "sha256=$SHA256" >> $GITHUB_OUTPUT
-          echo "timestamp=$TIMESTAMP" >> $GITHUB_OUTPUT
-          echo "::endgroup::"
-
-      - name: 🚀 Send Repository Dispatch
-        run: |
-          echo "::group::Repository Dispatch"
-          echo "::notice title=Repository Dispatch::Sending formula update event to tap repository"
-          
-          VERSION="${{ steps.extract-metadata.outputs.version }}"
-          ARCHIVE_URL="${{ steps.extract-metadata.outputs.archive_url }}"
-          BINARY_URL="${{ steps.extract-metadata.outputs.binary_url }}"
-          SHA256="${{ steps.extract-metadata.outputs.sha256 }}"
-          TIMESTAMP="${{ steps.extract-metadata.outputs.timestamp }}"
-          PRERELEASE="${{ needs.release-validation.outputs.is-prerelease }}"
-          
-          echo "🏺 Sending repository dispatch to tap repository..."
-          echo "   • Target: beriberikix/homebrew-usbipd-mac"
-          echo "   • Event: formula_update"
-          echo "   • Version: $VERSION"
-          
-          # The token is a PAT with access to the tap repository. GITHUB_TOKEN cannot
-          # write to another repository, so an absent secret means the dispatch silently
-          # 401s — which is exactly what happened for v0.5.0.
-          if [ -z "${{ secrets.HOMEBREW_TAP_DISPATCH_TOKEN }}" ]; then
-            echo "::error title=Missing Token::HOMEBREW_TAP_DISPATCH_TOKEN is not set; the tap cannot be updated"
-            exit 1
-          fi
-
-          # Capture the status. Without this the step reported success on a 401 and the
-          # formula sat pointing at a deleted release.
-          HTTP_STATUS=$(curl -sS -o /tmp/dispatch-response.json -w '%{http_code}' \
-            -X POST \
-            -H "Authorization: token ${{ secrets.HOMEBREW_TAP_DISPATCH_TOKEN }}" \
-            -H "Accept: application/vnd.github.v3+json" \
-            -H "Content-Type: application/json" \
-            https://api.github.com/repos/beriberikix/homebrew-usbipd-mac/dispatches \
-            -d '{
-              "event_type": "formula_update",
-              "client_payload": {
-                "version": "'"$VERSION"'",
-                "binary_url": "'"$BINARY_URL"'",
-                "sha256": "'"$SHA256"'",
-                "timestamp": "'"$TIMESTAMP"'",
-                "source_repository": "'"${{ github.repository }}"'",
-                "source_workflow_run": "'"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"'",
-                "triggered_by": "automated-release",
-                "prerelease": '"$PRERELEASE"'
-              }
-            }')
-
-          # A successful dispatch is 204 No Content.
-          if [ "$HTTP_STATUS" != "204" ]; then
-            echo "::error title=Dispatch Failed::Tap dispatch returned HTTP $HTTP_STATUS"
-            cat /tmp/dispatch-response.json 2>/dev/null || true
-            echo ""
-            echo "401 or 404 means HOMEBREW_TAP_DISPATCH_TOKEN is missing, expired, or"
-            echo "lacks access to beriberikix/homebrew-usbipd-mac."
-            echo "The formula will keep pointing at the previous release until this is fixed."
-            exit 1
-          fi
-
-          echo "::notice title=Dispatch Sent::Repository dispatch accepted (HTTP 204)"
-          echo "✅ Formula update event dispatched to tap repository"
-          echo "🔗 Monitor tap repository: https://github.com/beriberikix/homebrew-usbipd-mac/actions"
-          echo "::endgroup::"
+          echo "::notice title=Homebrew Update::The tap syncs itself; no dispatch is sent"
+          echo "The formula is updated by formula-sync.yml in homebrew-usbipd-mac,"
+          echo "which polls this repository's latest release every six hours."
+          echo ""
+          echo "To update immediately rather than waiting for the schedule:"
+          echo "  gh workflow run formula-sync.yml --repo beriberikix/homebrew-usbipd-mac"
+          echo ""
+          echo "Tap runs: https://github.com/beriberikix/homebrew-usbipd-mac/actions"
 
-      - name: ⏳ Wait for Formula Update
-        run: |
-          echo "::group::Formula Update Monitoring"
-          echo "::notice title=Monitoring::Waiting for tap repository formula update"
-          
-          echo "⏳ Allowing time for tap repository to process update..."
-          echo "   • Repository dispatch events are processed asynchronously"
-          echo "   • Tap repository workflow will validate and update formula"
-          echo "   • Check tap repository actions for detailed progress"
-          
-          # Wait 30 seconds to allow dispatch to be processed
-          sleep 30
-          
-          echo "✅ Formula update dispatch completed"
-          echo "🔍 Check tap repository for update status: https://github.com/beriberikix/homebrew-usbipd-mac/actions"
-          echo "::endgroup::"
 
   post-release:
     name: Post-Release Validation

Documentation/development/driver-free-release.md

@@ -136,9 +136,14 @@ extensions inside the *calling app's* bundle and requires that bundle to live in
 `/Applications`, so a Homebrew prefix is never consulted. See
 `Sources/USBIPDCore/SystemExtension/README.md`.
 
-The `install-system-extension` command has since been removed from the CLI, so the
-formula's `post_install` instruction to run it now names a command that does not exist.
-Removing that instruction and the staged sysext resource is what remains. That is a change in the tap repository, not here.
+Done: the system extension resource, its staging, and the `post_install` instruction
+were removed from the tap on 2026-08-06.
+
+The formula is now kept current by `formula-sync.yml` in the tap, which polls this
+repository's latest release every six hours and commits with its own `GITHUB_TOKEN`.
+That replaced a `repository_dispatch` which needed a personal access token here — the
+token expired after a year, the dispatch returned 401, and the sending step reported
+success anyway, so v0.5.0 shipped with the formula pointing at a deleted release. That is a change in the tap repository, not here.
 
 A cask is **not** needed for this release. It becomes the right vehicle only if a real
 DriverKit extension appears, since a dext must live in an app bundle in `/Applications`.