Description
When a semver tag is pushed to a brew-enabled repo, custard auto-publishes a new formula to the homebrew-tap — no manual brew-release.sh. Soft Serve fires a branch_tag_create webhook (signed) to a custard endpoint; custard archives the tag, writes the tarball to /dl, renders the formula, and commits it to the tap. Per-repo opt-in via a .custard.yaml file. Built in, works out-of-box for any custard deployer.
Acceptance Criteria
- #1 Soft Serve branch_tag_create webhook (signed w/ secret) → custard endpoint POST /hooks/release
- #2 Endpoint verifies the HMAC signature against a configured secret; rejects bad/unsigned
- #3 Only semver tags (vX.Y.Z) trigger a release; non-semver/branch events ignored
- #4 Per-repo opt-in: .custard.yaml at repo root (brew.enabled: true, optional package path); no file or disabled = skipped
- #5 Release runs in custard (Go): archive tag → tarball to /dl → sha256 → render formula → commit to homebrew-tap bare repo
- #6 Re-publishing same version overwrites cleanly; logged
- #7 Docs: how to enable a repo + how to register the webhook (ssh soft repo webhook create)