feat(homebrew): add a Homebrew tap formula + release job

Add `brew install codellm-devkit/tap/codeanalyzer-python`:
- packaging/homebrew/generate_formula.sh emits a formula that depends on `uv`
  and installs version-pinned wrappers running the published PyPI release via
  `uvx`. The package is pure-Python with heavy native deps (ray, pandas, numpy),
  so vendoring every transitive dependency as a Homebrew resource is impractical
  and pip-at-build-time is blocked by the sandbox; the uv-tool approach keeps the
  formula tiny and `brew install` sandbox-safe.
- release.yml gains a `homebrew` job (needs: release) that regenerates the
  formula on each tag and pushes it to codellm-devkit/homebrew-tap (requires the
  HOMEBREW_TAP_TOKEN secret, same as the codeanalyzer-typescript release).
- README: Install via Homebrew section; CHANGELOG: Unreleased entry.

Author: rahlk

.github/workflows/release.yml

@@ -136,3 +136,43 @@ jobs:
 
       - name: Publish to PyPI via Trusted Publishing
         run: uv publish
+
+  # Regenerate the Homebrew formula and push it to the shared tap. Split into its
+  # own job (needs: release) so a tap-push failure -- e.g. a missing
+  # HOMEBREW_TAP_TOKEN -- is isolated from the PyPI and GitHub Release steps above.
+  # The non-Rust equivalent of what cargo-dist does for you.
+  homebrew:
+    needs: release
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Derive version from tag
+        id: ver
+        run: echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
+
+      - name: Generate Homebrew formula
+        env:
+          REPO: ${{ github.repository }}
+          VERSION: ${{ steps.ver.outputs.version }}
+        run: |
+          chmod +x packaging/homebrew/generate_formula.sh
+          ./packaging/homebrew/generate_formula.sh > codeanalyzer-python.rb
+          cat codeanalyzer-python.rb
+
+      - name: Push formula to codellm-devkit/homebrew-tap
+        env:
+          TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}   # PAT with write access to homebrew-tap
+          VERSION: ${{ steps.ver.outputs.version }}
+        run: |
+          git clone "https://x-access-token:${TAP_TOKEN}@github.com/codellm-devkit/homebrew-tap.git" tap
+          mkdir -p tap/Formula
+          cp codeanalyzer-python.rb tap/Formula/codeanalyzer-python.rb
+          cd tap
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add Formula/codeanalyzer-python.rb
+          git commit -m "codeanalyzer-python ${VERSION}" || { echo "no formula change"; exit 0; }
+          git push

CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+- **Homebrew tap** — `brew install codellm-devkit/tap/codeanalyzer-python`. The release workflow auto-generates a formula (`packaging/homebrew/generate_formula.sh`) that installs the pinned PyPI release as an isolated `uv` tool, and pushes it to `codellm-devkit/homebrew-tap`. Because the package is pure-Python with heavy native dependencies (`ray`, `pandas`, `numpy`), the formula depends on `uv` and runs the release via `uvx` rather than vendoring every transitive dependency as a Homebrew resource.
+
 ## [0.2.0] - 2026-06-20
 
 ### Added

README.md

@@ -36,6 +36,7 @@ and merges them with the Jedi-derived edges, also backfilling callees Jedi could
   - [Prerequisites](#prerequisites)
   - [Install via pip (PyPI)](#install-via-pip-pypi)
   - [Install via shell script](#install-via-shell-script)
+  - [Install via Homebrew](#install-via-homebrew)
   - [Build from source](#build-from-source)
 - [Usage](#usage)
   - [Options](#options)
@@ -102,6 +103,15 @@ Install the CLI as an isolated tool with the one-line installer (provisions via
 curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-python/releases/latest/download/canpy-installer.sh | sh
 ```
 
+### Install via Homebrew
+
+```sh
+brew install codellm-devkit/tap/codeanalyzer-python
+```
+
+The formula depends on [uv](https://docs.astral.sh/uv/) and installs `canpy` as an isolated,
+version-pinned uv tool (the package and its dependencies are resolved and cached on first run).
+
 ### Build from source
 
 This project uses [uv](https://docs.astral.sh/uv/) for dependency management.

packaging/homebrew/generate_formula.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+#
+# Generate the Homebrew formula for codeanalyzer-python (the `canpy` CLI).
+#
+# Unlike the codeanalyzer-typescript sibling -- which ships a single self-contained
+# binary that the formula just downloads -- codeanalyzer-python is a pure-Python
+# package published to PyPI with heavy native dependencies (ray, pandas, numpy).
+# Vendoring every transitive dependency as a Homebrew `resource` is impractical
+# (ray is not buildable from an sdist), and pip-installing at build time is blocked
+# by Homebrew's network sandbox.
+#
+# So the formula stays tiny: it depends on `uv` and installs version-pinned wrapper
+# scripts that run the published PyPI release via `uvx` (uv resolves and caches the
+# isolated environment on first run). This keeps `brew install` sandbox-safe (no
+# network at build time) while pinning the exact released version.
+#
+# Usage:
+#   REPO=codellm-devkit/codeanalyzer-python VERSION=0.2.0 \
+#     ./generate_formula.sh > codeanalyzer-python.rb
+#
+set -euo pipefail
+
+REPO="${REPO:?set REPO, e.g. codellm-devkit/codeanalyzer-python}"
+VERSION="${VERSION:?set VERSION, e.g. 0.2.0}"
+
+cat <<EOF
+# This file is auto-generated by packaging/homebrew/generate_formula.sh on release.
+# Do not edit by hand -- changes will be overwritten on the next tag.
+class CodeanalyzerPython < Formula
+  desc "CLDK Python analyzer (canpy) -- emits canonical analysis.json or a Neo4j graph"
+  homepage "https://github.com/${REPO}"
+  version "${VERSION}"
+  license "Apache-2.0"
+
+  # codeanalyzer-python is a pure-Python PyPI package with heavy native deps
+  # (ray, pandas, numpy). Rather than vendor every transitive dependency as a
+  # Homebrew resource, install the pinned PyPI release as an isolated uv tool;
+  # uv resolves and caches the environment on first run.
+  depends_on "uv"
+
+  def install
+    %w[canpy codeanalyzer].each do |exe|
+      (bin/exe).write <<~SH
+        #!/bin/bash
+        exec uvx --from "codeanalyzer-python==#{version}" #{exe} "\$@"
+      SH
+      chmod 0755, bin/exe
+    end
+  end
+
+  test do
+    assert_match "codeanalyzer-python==#{version}", File.read(bin/"canpy")
+    assert_predicate bin/"canpy", :executable?
+  end
+end
+EOF