[FEATURE] Automate Homebrew formula updates in CI/CD release pipeline

[raphaelsamy-quantumlends]

Is your feature request related to a problem?

The Homebrew tap (datadog-labs/pack) is currently several versions behind the latest release. As of today, brew install datadog-labs/pack/pup installs v0.19.1, while the latest GitHub release is v0.22.0 (released today). This means users relying on Homebrew — arguably the most convenient installation method on macOS — are missing 3 releases worth of features and fixes.

The root cause appears to be that the homebrew-pack formula is updated manually, so it falls behind whenever a new release is cut.

Describe the solution you'd like

Integrate automatic Homebrew formula updates into the existing release CI/CD pipeline (.github/workflows/release.yml).

GoReleaser (already used in the release workflow) natively supports this via the brews section in .goreleaser.yaml. Adding something like this would automatically push an updated formula to the datadog-labs/homebrew-pack tap on every release:

brews:
  - repository:
      owner: datadog-labs
      name: homebrew-pack
    directory: Formula
    homepage: "https://github.com/datadog-labs/pup"
    description: "CLI companion for AI agents with 200+ commands across 33+ Datadog products"
    license: "Apache-2.0"
    install: |
      bin.install "pup"

This would require a HOMEBREW_TAP_GITHUB_TOKEN secret (or a PAT with repo scope) to push to the homebrew-pack repository from the release workflow.

Describe alternatives you've considered

• GitHub Actions bot: A separate workflow in homebrew-pack that watches for new releases in datadog-labs/pup and updates the formula automatically (e.g., using repository_dispatch or a scheduled check).
• Manual process with reminders: A release checklist that includes updating the Homebrew formula — but this is error-prone and clearly the current approach that led to the version lag.

Additional context

• Current release workflow: .github/workflows/release.yml — uses GoReleaser with cosign signing and SBOM generation
• Homebrew tap repo: datadog-labs/homebrew-pack
• Current formula version: 0.19.1 (pinned in Formula/pup.rb)
• Latest GitHub release: 0.22.0
• GoReleaser already supports the brews configuration natively, so this should be a minimal addition to the existing .goreleaser.yaml

[star-gusto]

FYI — the update-formula.sh script added in datadog-labs/homebrew-pack#24 has a bug that broke brew install for v0.32.1. The get_sha() function uses grep "$filename" which matches both the .tar.gz and .tar.gz.sbom.json lines from the checksums file, producing a corrupted two-line sha256 value in the formula.

Opened a fix PR: datadog-labs/homebrew-pack#27

This is worth keeping in mind if/when this gets automated in CI — the checksum lookup needs exact filename matching to avoid picking up SBOM checksums.