fix(ci): wire homebrew + npm publish jobs into release.yml

[aram-devdocs]

Summary

cargo-dist v0.0.10 run 25496775188 generated all 5 native builds + the four installer artifacts (`plumb-cli-installer.sh`, `plumb-cli-installer.ps1`, `plumb-cli.rb`, `plumb-cli-npm-package.tar.gz`) successfully, but:

1. Attest step glob mismatch — `subject-path: target/distrib/plumb-installer.` didn't match the actual `plumb-cli` filenames cargo-dist 0.28 emits.
2. No `publish-homebrew` or `publish-npm` jobs existed — the homebrew tap never received the formula and `plumb-cli` never went to npm.

Fix

• Glob: `plumb-installer.` → `plumb-cli`.
• Add `publish-homebrew` job: clones `aram-devdocs/homebrew-plumb`, copies `plumb-cli.rb` to `Formula/plumb.rb`, commits, pushes via `HOMEBREW_TAP_TOKEN`.
• Add `publish-npm` job: extracts `plumb-cli-npm-package.tar.gz` and runs `npm publish` via `NPM_TOKEN`.
• Both depend on the existing `publish` job so they only run after the GitHub Release exists.
• Update `dist-workspace.toml` comments to reflect that publish-jobs are hand-authored (cargo-dist's built-in publish-jobs require its auto-generated workflow).

Test plan

• `python3 -c "import yaml; yaml.safe_load(...)"` ✅
• After merge: release-please cuts v0.0.11 → cargo-dist runs full chain → brew formula appears in tap, `plumb-cli` lands on npm
• `brew install aram-devdocs/plumb/plumb` works
• `npm i -g plumb-cli` works

🤖 Generated with Claude Code

[github-actions]

Now I have a complete picture. Let me write the review.

---

PR #272 — fix(ci): wire homebrew + npm publish jobs into release.yml

Buckets changed: ci, docs (CHANGELOG)
No Rust source was touched, so determinism, layer rules, unsafe, unwrap, and test-coverage invariants do not apply.

---

Security pass (CI surface)

Token handling in publish-homebrew

.github/workflows/release.yml:197

git clone "https://x-access-token:${TAP_TOKEN}@github.com/aram-devdocs/homebrew-plumb.git" tap

TAP_TOKEN is passed as an env var (not inline in the YAML expression), so GitHub Actions' secret-masking covers the value in standard log output. The pattern is idiomatic and acceptable. One edge case: if git clone itself emits a credential error to stderr, the URL with the token could appear unmasked. Mitigations exist (GIT_TERMINAL_PROMPT=0, or separating the credential from the URL via .netrc / gh auth), but this is a cosmetic hardening note — not a blocker.

set -euo pipefail is present in both new job scripts. Artifact-existence guards (if [ ! -f ... ]) give clear error messages and non-zero exits. Both jobs look robust.

Scope of permissions

The workflow-level block (contents: write, id-token: write, attestations: write) is inherited by both new jobs, which use neither GITHUB_TOKEN for repo writes nor the OIDC token. This is harmless oversharing but not a risk.

---

Correctness

Attest glob fix (release.yml:148)

-subject-path: target/distrib/plumb-installer.*
+subject-path: target/distrib/plumb-cli*

Correct. cargo-dist 0.28 names artifacts plumb-cli*; the old glob matched nothing, silently producing empty provenance attestations.

needs: [plan, publish] on both new jobs

Correct dependency ordering: GitHub Release must exist before a formula push or npm publish. The plan gate also validates the tag via dist plan before any artifact is produced.

Idempotency guard in publish-homebrew

if git diff --cached --quiet; then
  echo "No formula changes for ${RELEASE_TAG}"
else
  git commit -m "plumb ${RELEASE_TAG}"
  git push
fi

Correct. A re-run for the same tag (e.g., after a workflow retry) will not produce a duplicate tap commit.

npm publish --access public

Redundant for an unscoped package (unscoped packages are always public on npm), but harmless.

actions/download-artifact@v8

Already used in the pre-existing publish job. If the running pipeline accepted it, the version pin is self-consistent. Not introduced by this PR.

CHANGELOG — correctly placed under ## [Unreleased] per repo convention.

dist-workspace.toml — comments now accurately reflect that publishing is hand-authored, not delegated to cargo-dist's built-in publish-jobs. No functional changes.

---

Punch list

#	File:line	Severity	Note
1	release.yml:197	Advisory	Token embedded in clone URL. Consider GIT_TERMINAL_PROMPT=0 + a .netrc-style credential store to prevent the token appearing in git's error output. Not a blocker.
2	release.yml:222	Nit	--access public on an unscoped package is a no-op. Remove for clarity if desired.

No blockers found.

Verdict: APPROVE