ci: update the Homebrew tap on each release

.github/workflows/release.yml

@@ -337,3 +337,52 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./.github/release/node_modules/.bin/semantic-release
+
+  homebrew-tap:
+    needs:
+      - version
+      - release
+    if: needs.version.outputs.new-release-version != ''
+    runs-on: ubuntu-latest
+    environment: homebrew-tap
+    permissions:
+      contents: read
+      attestations: read
+
+    steps:
+      - name: Checkout tap
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          repository: MegaManSec/homebrew-tap
+          ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
+
+      - name: Update cask
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.version.outputs.new-release-version }}
+        run: |
+          CASK=Casks/magic-switch.rb
+          CURRENT="$(sed -nE 's/^  version "(.*)"$/\1/p' "$CASK")"
+          if [ "$(printf '%s\n' "$CURRENT" "$VERSION" | sort -V | tail -n1)" = "$CURRENT" ]; then
+            echo "Cask already at $CURRENT"
+            exit 0
+          fi
+          ZIP="$RUNNER_TEMP/app.zip"
+          gh release download "v$VERSION" --repo "$GITHUB_REPOSITORY" --pattern app.zip --output "$ZIP"
+          gh attestation verify "$ZIP" \
+            --repo "$GITHUB_REPOSITORY" \
+            --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/release.yml" \
+            --source-ref refs/heads/main \
+            --deny-self-hosted-runners
+          SHA256="$(sha256sum "$ZIP" | cut -d' ' -f1)"
+          sed -i -E \
+            -e "s/^  version \".*\"$/  version \"$VERSION\"/" \
+            -e "s/^  sha256 \".*\"$/  sha256 \"$SHA256\"/" \
+            "$CASK"
+          grep -qx "  version \"$VERSION\"" "$CASK"
+          grep -qx "  sha256 \"$SHA256\"" "$CASK"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -am "magic-switch $VERSION"
+          git push

README.md

@@ -15,8 +15,19 @@ This is a security-hardened fork of [HoshimuraYuto/blue-switch](https://github.c
 
 ## Installation
 
+With [Homebrew](https://brew.sh):
+
+```bash
+brew install --cask megamansec/tap/magic-switch
+```
+
+Or manually:
+
 1. Grab the latest build from the [releases page](https://github.com/MegaManSec/magic-switch/releases).
 2. Unzip and move `Magic Switch.app` to `/Applications`.
+
+Then:
+
 3. Approve **Bluetooth** and **Local Network** access when macOS prompts. Both are required — Bluetooth to control the peripherals, Local Network to discover and talk to the other Mac. If you dismiss the prompts, grant them later under System Settings → Privacy & Security.
 4. Allow **Notifications** when asked. Not strictly required, but it's how Magic Switch reports what happened when no window is open — a switch triggered by hotkey, URL scheme, or dock-on-display that fails does so *silently* without it (see [Troubleshooting](#troubleshooting)). Denied it once? Re-enable under System Settings → Notifications → Magic Switch.
 
@@ -201,6 +212,8 @@ Known limits:
 
 ## Support
 
+Magic Switch is made by me, Joshua Rogers. I write about it and my other projects on my blog, [joshua.hu](https://joshua.hu/).
+
 If Magic Switch is useful to you, you can support its development by [sponsoring me on GitHub](https://github.com/sponsors/MegaManSec).
 
 ## License