feat: eliminate PAT using repository_dispatch pattern

Instead of checking out homebrew-tap with a cross-repo token, dispatch a
repository_dispatch event to CloudNativeBergen/homebrew-tap. The tap repo
handles the update using its own GITHUB_TOKEN — no manually managed secret.

The built-in github.token has permission to send repository_dispatch events
to public repos in the same org.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Starefossen

.github/workflows/release.yml

@@ -140,6 +140,8 @@ jobs:
     name: Update Homebrew tap
     needs: [release]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/download-artifact@v8
         with:
@@ -155,65 +157,17 @@ jobs:
           echo "linux_arm=$(sha256sum cnctl-aarch64-unknown-linux-gnu.tar.gz | awk '{print $1}')" >> "$GITHUB_OUTPUT"
           echo "linux_x86=$(sha256sum cnctl-x86_64-unknown-linux-gnu.tar.gz | awk '{print $1}')" >> "$GITHUB_OUTPUT"
 
-      - name: Checkout homebrew tap
-        uses: actions/checkout@v6
-        with:
-          repository: CloudNativeBergen/homebrew-tap
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          path: homebrew-tap
-
-      - name: Write formula
+      # Dispatch to homebrew-tap so its own GITHUB_TOKEN writes the formula —
+      # no cross-repo PAT needed.
+      - name: Trigger tap update
         env:
-          VERSION: ${{ needs.release.outputs.tag }}
-          MAC_ARM_SHA: ${{ steps.sums.outputs.mac_arm }}
-          MAC_X86_SHA: ${{ steps.sums.outputs.mac_x86 }}
-          LINUX_ARM_SHA: ${{ steps.sums.outputs.linux_arm }}
-          LINUX_X86_SHA: ${{ steps.sums.outputs.linux_x86 }}
-        run: |
-          mkdir -p homebrew-tap/Formula
-          cat > homebrew-tap/Formula/cnctl.rb << FORMULA
-          class Cnctl < Formula
-            desc "Organizer CLI for Cloud Native Days Norway"
-            homepage "https://github.com/CloudNativeBergen/cnctl"
-            version "${VERSION}"
-            license "MIT"
-
-            on_macos do
-              if Hardware::CPU.arm?
-                url "https://github.com/CloudNativeBergen/cnctl/releases/download/${VERSION}/cnctl-aarch64-apple-darwin.tar.gz"
-                sha256 "${MAC_ARM_SHA}"
-              else
-                url "https://github.com/CloudNativeBergen/cnctl/releases/download/${VERSION}/cnctl-x86_64-apple-darwin.tar.gz"
-                sha256 "${MAC_X86_SHA}"
-              end
-            end
-
-            on_linux do
-              if Hardware::CPU.arm?
-                url "https://github.com/CloudNativeBergen/cnctl/releases/download/${VERSION}/cnctl-aarch64-unknown-linux-gnu.tar.gz"
-                sha256 "${LINUX_ARM_SHA}"
-              else
-                url "https://github.com/CloudNativeBergen/cnctl/releases/download/${VERSION}/cnctl-x86_64-unknown-linux-gnu.tar.gz"
-                sha256 "${LINUX_X86_SHA}"
-              end
-            end
-
-            def install
-              bin.install "cnctl"
-            end
-
-            test do
-              assert_match version.to_s, shell_output("#{bin}/cnctl --version")
-            end
-          end
-          FORMULA
-
-      - name: Commit and push
+          GH_TOKEN: ${{ github.token }}
         run: |
-          cd homebrew-tap
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add Formula/cnctl.rb
-          git diff --cached --quiet && echo "No changes" && exit 0
-          git commit -m "chore: update cnctl to ${{ needs.release.outputs.tag }}"
-          git push
+          gh api repos/CloudNativeBergen/homebrew-tap/dispatches \
+            --method POST \
+            --field event_type=update-formula \
+            --field client_payload[version]="${{ needs.release.outputs.tag }}" \
+            --field client_payload[mac_arm]="${{ steps.sums.outputs.mac_arm }}" \
+            --field client_payload[mac_x86]="${{ steps.sums.outputs.mac_x86 }}" \
+            --field client_payload[linux_arm]="${{ steps.sums.outputs.linux_arm }}" \
+            --field client_payload[linux_x86]="${{ steps.sums.outputs.linux_x86 }}"