fix: replace mislav action with shell script for tap updates

.github/workflows/release.yml

@@ -114,9 +114,29 @@ jobs:
     # No repo permissions needed — the PAT authenticates to the tap repo.
     permissions: {}
     steps:
-      - uses: mislav/bump-homebrew-formula-action@56a283fa15557e9abaa4bdb63b8212abc68e655c # tag: v3.6
-        with:
-          formula-name: smoosh
-          homebrew-tap: K1-R1/homebrew-tap
+      - name: Update formula
         env:
           COMMITTER_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          version="${TAG_NAME#v}"
+          tarball_url="https://github.com/K1-R1/smoosh/archive/refs/tags/${TAG_NAME}.tar.gz"
+
+          # Compute SHA256 from the release tarball.
+          curl -fsSL "${tarball_url}" -o /tmp/smoosh-src.tar.gz
+          sha256="$(sha256sum /tmp/smoosh-src.tar.gz | awk '{print $1}')"
+
+          # Clone, patch, push.
+          git clone \
+            "https://x-access-token:${COMMITTER_TOKEN}@github.com/K1-R1/homebrew-tap.git" \
+            /tmp/homebrew-tap
+          cd /tmp/homebrew-tap
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+
+          sed -i "s|url \".*\"|url \"${tarball_url}\"|" Formula/smoosh.rb
+          sed -i "s|sha256 \".*\"|sha256 \"${sha256}\"|" Formula/smoosh.rb
+
+          git add Formula/smoosh.rb
+          git commit -m "smoosh ${version}"
+          git push origin main

CHANGELOG.md

@@ -34,6 +34,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 - CI and release workflow install shfmt via `go install` (Go module sum
   database) instead of a raw binary download, which had no integrity check.
+- Homebrew tap update replaced `mislav/bump-homebrew-formula-action` with a
+  shell script — removes the Node.js 20 runtime dependency and works
+  reliably with fine-grained PATs.
 - Demo GIFs and VHS tape moved to `assets/` directory.
 
 ## [1.0.0] - 2026-03-14

MAINTAINING.md

@@ -33,7 +33,6 @@ Everything else needs manual bumping.
 |---|---|---|
 | `actions/checkout` | `ci.yml`, `release.yml` | v6.0.2 |
 | `actions/upload-artifact` | `ci.yml` | v7.0.0 |
-| `mislav/bump-homebrew-formula-action` | `release.yml` | v3.6 |
 
 ### Manual
 
@@ -50,13 +49,6 @@ When bumping a manual dependency: update the version pin, run CI locally
 (`prek run && bats test/*.bats`), and commit with
 `chore: bump <tool> to vX.Y.Z`.
 
-## Known deprecation
-
-`mislav/bump-homebrew-formula-action` v3.6 uses the Node.js 20 runtime,
-which GitHub deprecates in **June 2026**. Watch for a v4 release or plan
-a replacement (a shell script in the release workflow that computes the
-SHA256 and commits to the tap directly).
-
 ## Periodic checks
 
 **Quarterly — dependency audit**