Conversation
Homebrew deprecated the `postflight` stanza that GoReleaser writes from `homebrew_casks.hooks.post.install`, so every `brew` command that loads the cask warned. GoReleaser does not yet have `hooks.post.install_steps` (goreleaser/goreleaser#6873), so the quarantine xattr strip moves into `custom_block` as `postflight_steps` with an `on_macos` guard. The `{{ "{{staged_path}}" }}` escape survives GoReleaser's second template pass and becomes Homebrew's install-time `{{staged_path}}` token. Linux installs still skip `/usr/bin/xattr`.
There was a problem hiding this comment.
🟡 Changes recommended
Add regression coverage for the Homebrew cask postflight configuration before approval.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Updates GoReleaser Homebrew cask generation to use non-deprecated postflight_steps and documents the fix.
Changes:
- Adds a macOS-only quarantine-removal step via
custom_block. - Records the Homebrew warning fix in the changelog.
File summaries
| File | Summary | Findings |
|---|---|---|
CHANGELOG.md |
Documents the Homebrew fix. | None |
.goreleaser.yml |
Configures the custom postflight_steps workaround. |
Moderate: add regression coverage for the generated cask configuration (2 votes). |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+74
to
+77
| custom_block: | | ||
| postflight_steps do | ||
| on_macos do | ||
| run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ "{{staged_path}}" }}/mnemon"] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Homebrew now warns on every command that loads the generated cask:
GoReleaser still wraps
homebrew_casks.hooks.post.installinpostflight do(goreleaser/goreleaser#6873 is open). Until that ships, this moves the quarantine strip intocustom_blockaspostflight_steps+on_macos+run, which Homebrew accepts.{{ "{{staged_path}}" }}is a two-pass Go template escape: GoReleaser applies the rendered cask a second time, and this form becomes Homebrew's install-time{{staged_path}}token. The macOS-only guard is unchanged so Linuxbrew installstill does not invoke/usr/bin/xattr.Companion tap PR (stops the warning on the current v0.2.8 cask): mnemon-dev/homebrew-tap#1
Drop
custom_blockoncehooks.post.install_stepsexists.