[EwoutH]

Lets macOS and Linux users install and upgrade q2 with Homebrew:

brew install quarto-dev/q2/q2
brew upgrade q2

Today the only way to upgrade is re-running install.sh, since q2 update isn't implemented.

What this adds

• scripts/homebrew-formula.sh renders Formula/q2.rb from a release's checksums.sha256. It uses the prebuilt darwin/linux arm64 and amd64 archives the pipeline already publishes. If an archive is missing or the version isn't a bare X.Y.Z, it fails without printing a formula.
• A homebrew-tap job at the end of release-pipeline.yml. After a stable release is published, it downloads the release's checksums, renders the formula, runs ruby -c on it, and pushes it to quarto-dev/homebrew-q2. Nightlies, prereleases and dry runs skip it.
• Four tests in crates/quarto/tests/integration/homebrew_formula.rs. They are unix-only, like nightly_gate.rs.
• One runbook row for the new secret.

Setup needed before it does anything

1. Create a public, empty quarto-dev/homebrew-q2 repo.
2. Add a HOMEBREW_TAP_TOKEN secret to this repo: a fine-grained token with Contents read/write on the tap only.

Until the secret is set, the job logs a notice and exits. It runs after the release job, so a tap failure can't block or undo a release.

Design choices

• A formula in our own tap, not homebrew-core or a cask. homebrew-core builds from source and has notability rules. Casks get quarantined by Gatekeeper, and q2 isn't notarized. A formula that installs the prebuilt binary avoids both and covers Linux too.
• WinGet and Scoop are left out. Each WinGet version is a reviewed PR to microsoft/winget-pkgs, which is a lot of churn at the current release rate. Also, WinGet IDs are hard to change if q2 ships under another name.

Testing

• The 4 tests fail without the script and pass with it, run under Linux (WSL). Clippy passes with -D warnings.
• Against the real v0.42.0 checksums.sha256, the script renders a formula with the right URLs and checksums, and ruby -c reports Syntax OK.
• Not tested: the job itself (it needs the tap repo and secret) and an actual brew install. Both should be checked after the first release once the setup is done.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.