feat: stage Homebrew cask and make cask helper

Makefile

@@ -3,6 +3,8 @@ BINARY  = build/trapps
 SOURCES = $(wildcard Sources/trapps/*.swift)
 VERSION = $(shell /usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' Support/Info.plist)
 ZIP     = build/Trapps-$(VERSION).zip
+CASK_TMPL = packaging/trapps.cask.tmpl
+CASK     = build/trapps.rb
 MACOS_TARGET = apple-macos13.0
 
 # -O for release; complete concurrency checking to match the SwiftPM build and
@@ -41,7 +43,7 @@ RELEASE_IDENTITY ?= $(shell security find-identity -v -p codesigning 2>/dev/null
 # CI overrides this with explicit --key/--key-id/--issuer flags.
 NOTARY_AUTH ?= --keychain-profile trapps-notary
 
-.PHONY: build bundle run release notarize reset-ax clean
+.PHONY: build bundle run release notarize cask reset-ax clean
 
 build: $(BINARY)
 
@@ -108,6 +110,15 @@ notarize:
 	ditto -c -k --keepParent $(APP) $(ZIP)
 	@echo "Notarized, stapled, and re-zipped $(ZIP)"
 
+# Render the Homebrew cask from the template, filling in the current version and
+# the sha256 of the built zip. Run after `make release && make notarize`; the
+# resulting build/trapps.rb goes into the homebrew-tap repo. See packaging/README.md.
+cask: $(CASK_TMPL)
+	@test -f $(ZIP) || { echo "error: $(ZIP) not found - run 'make release && make notarize' first."; exit 1; }
+	@sha=$$(shasum -a 256 $(ZIP) | awk '{print $$1}'); \
+	sed -e 's/@@VERSION@@/$(VERSION)/' -e "s/@@SHA256@@/$$sha/" $(CASK_TMPL) > $(CASK); \
+	echo "Rendered $(CASK) (version $(VERSION), sha256 $$sha)"
+
 reset-ax:
 	tccutil reset Accessibility com.gregthegreek.trapps
 

packaging/README.md

@@ -0,0 +1,33 @@
+# Homebrew packaging
+
+Trapps ships as a [Homebrew cask](https://docs.brew.sh/Cask-Cookbook) from a
+personal tap so users can `brew install --cask gregthegreek/tap/trapps`.
+
+`trapps.cask.tmpl` is the cask with `@@VERSION@@` / `@@SHA256@@` placeholders.
+`make cask` renders it against the freshly built, notarized zip.
+
+## Publishing a release to the tap
+
+The tap is a separate repo named `GregTheGreek/homebrew-tap` (the `homebrew-`
+prefix is what makes `brew tap gregthegreek/tap` resolve). Its casks live under
+`Casks/`.
+
+Prerequisite: a real notarized zip must already be attached to the GitHub
+release (see the "Releasing" section in the top-level README) - the cask's
+`sha256` is computed from it, and `brew install` downloads it from there.
+
+```sh
+make release && make notarize      # produces build/Trapps-<version>.zip
+make cask                          # renders build/trapps.rb (version + sha256 filled in)
+
+# One time, if the tap does not exist yet:
+#   create the public repo GregTheGreek/homebrew-tap with a Casks/ dir.
+
+# Copy the rendered cask into the tap and push:
+cp build/trapps.rb /path/to/homebrew-tap/Casks/trapps.rb
+# commit + push in the tap repo
+```
+
+Until the tap exists and a notarized asset is published, `brew install` will
+not work - this directory is staged ahead of an Apple Developer account
+clearing review.

packaging/trapps.cask.tmpl

@@ -0,0 +1,18 @@
+cask "trapps" do
+  version "@@VERSION@@"
+  sha256 "@@SHA256@@"
+
+  url "https://github.com/GregTheGreek/trapps/releases/download/v#{version}/Trapps-#{version}.zip"
+  name "Trapps"
+  desc "Menu bar app revealing every menu bar item, including ones behind the notch"
+  homepage "https://github.com/GregTheGreek/trapps"
+
+  depends_on macos: ">= :ventura" # macOS 13+
+
+  app "Trapps.app"
+
+  zap trash: [
+    "~/Library/Preferences/com.gregthegreek.trapps.plist",
+    "~/Library/Saved Application State/com.gregthegreek.trapps.savedState",
+  ]
+end