fix(release): give npm the repository field, and open a PR for the formula

.github/workflows/release.yml

@@ -281,19 +281,23 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   # A formula updated by hand drifts, the way npm did before it was automated.
-  # This runs after the release exists, because it pins the checksums from that
-  # release's own SHA256SUMS.txt.
+  # Runs after the release exists, because it pins that release's own checksums.
+  #
+  # It opens a pull request rather than pushing: main requires status checks, so
+  # a direct push from CI is rejected outright (GH006). A PR opened with
+  # GITHUB_TOKEN does not start those checks either — close and reopen it once.
   homebrew:
     name: Update Homebrew formula
     needs: [publish]
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      pull-requests: write
     steps:
-      # Checks out main, not the tag: the formula update is a commit on the
-      # branch. persist-credentials stays on here — unlike every other job in
-      # this repo — because this one has to push.
+      # Checks out main, not the tag: the formula change belongs on the branch.
+      # persist-credentials stays on here — unlike every other job in this repo
+      # — because this one has to push a branch.
       # actions/checkout v7.0.0
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
@@ -306,17 +310,35 @@ jobs:
       - name: Regenerate the formula
         run: node scripts/update-homebrew-formula.mjs --version "${GITHUB_REF_NAME#v}"
 
-      - name: Commit if it changed
+      - name: Open a pull request if it changed
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
+          set -euo pipefail
           if git diff --quiet -- Formula/dvalincode.rb; then
             echo "::notice::Formula already current for ${GITHUB_REF_NAME}."
             exit 0
           fi
+          branch="chore/homebrew-${GITHUB_REF_NAME}"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$branch"
           git add Formula/dvalincode.rb
           git commit -m "chore(homebrew): pin formula to ${GITHUB_REF_NAME}"
-          git push origin main
+          git push --force origin "$branch"
+          if gh pr view "$branch" --json number >/dev/null 2>&1; then
+            echo "::notice::Pull request for ${branch} is already open."
+            exit 0
+          fi
+          printf '%s\n' \
+            'Generated by `scripts/update-homebrew-formula.mjs` from this release'"'"'s own SHA256SUMS.' \
+            '' \
+            'Required checks do not start by themselves: GitHub does not trigger workflows' \
+            'for a pull request opened with `GITHUB_TOKEN`. Close and reopen this PR once' \
+            'to run them, then merge.' > pr-body.md
+          gh pr create --base main --head "$branch" \
+            --title "chore(homebrew): pin formula to ${GITHUB_REF_NAME}" \
+            --body-file pr-body.md
 
   # Listing the MCP server is what makes it findable by agents at all. OIDC
   # rather than a token: the registry derives the namespace from this

package.json

@@ -4,6 +4,10 @@
   "description": "A local-first, provider-neutral CLI foundation for agentic coding workflows.",
   "type": "module",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/arthurpanhku/dvalincode.git"
+  },
   "bin": {
     "dvalincode": "dist/index.js"
   },