fix(release): emit postflight_steps in the Homebrew cask

[audreyt]

Homebrew deprecates the postflight cask stanza. Every brew command that loads the generated cask prints:

Warning: Calling `postflight` is deprecated! Use `postflight_steps` instead.
Please report this issue to the mnemon-dev/homebrew-tap tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
  /opt/homebrew/Library/Taps/mnemon-dev/homebrew-tap/Casks/mnemon.rb:36

GoReleaser's hooks.post.install renders postflight do … end — tracked upstream as goreleaser/goreleaser#6870, with a steps-aware hook proposed in goreleaser/goreleaser#6873 (open). Until that lands, emit the stanza through custom_block.

Change

hooks.post.install → custom_block containing postflight_steps:

• on_macos do … end replaces the if OS.mac? guard (evaluated at install time, same semantics).
• run "/usr/bin/xattr", args: […] replaces system_command (fails the install on error, same as before).
• {{ "{{staged_path}}" }} escapes GoReleaser's template pass so Homebrew's {{staged_path}} install-steps token reaches the generated cask literally. Verified against text/template: the escaped form renders {{staged_path}}; the raw form fails to parse.
• New TestReleaseCaskEmitsPostflightSteps in test/mnemond/architecture parses .goreleaser.yml and asserts the cask carries postflight_steps + the escaped {{staged_path}} token and no hooks.post.install, so a future config edit cannot silently reintroduce postflight.

Known trade-off (stanza order)

custom_block renders at the top of the cask, before version — brew style flags the generated file with Cask/StanzaOrder offenses (verified: 11 correctable offenses on a rendered sample). This is cosmetic: brew install/reinstall/upgrade do not enforce stanza order, and the tap has no style CI. The alternatives are worse: hooks.post.install is style-clean but keeps the deprecation warning (the bug being fixed), and dropping the hook loses the quarantine strip. When goreleaser/goreleaser#6873 ships, hooks.post.install_steps emits the stanza in the correct position and this can be simplified.

Verified

Applied the generated stanza to the installed cask and ran brew reinstall --cask mnemon on Homebrew 6.x: installs cleanly, prints no deprecation warning, and strips the quarantine attribute from the staged binary.

Companion tap-side fix (interim, until the next release regenerates the cask): mnemon-dev/homebrew-tap#2

[Copilot]

🟡 Changes recommended

The generated cask stanza ordering issue remains unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates GoReleaser’s Homebrew cask configuration to emit non-deprecated postflight_steps while preserving quarantine removal.

Changes:

• Replaces the legacy post-install hook with a templated custom_block.
• Documents the fix in CHANGELOG.md.

File summaries

File	Summary	Review findings
CHANGELOG.md	Records the Homebrew deprecation-warning fix.	None.
.goreleaser.yml	Emits the Homebrew postflight_steps stanza.	Moderate (1 vote): generated stanza may violate Homebrew ordering. Nit (2 votes): use “ad hoc”. Nit (1 vote): add coverage for the custom block and literal {{staged_path}}.

Review details

Suppressed comments (2)

.goreleaser.yml:83

• Because GoReleaser emits custom_block at the top of the cask, this places postflight_steps before version, the platform URL stanzas, and binary. Homebrew's stanza order requires postflight_steps after the artifact stanzas, so brew style will flag the generated cask as out of order even though brew reinstall succeeds. Please use a template/GoReleaser hook that emits this block in the normal position, or switch to hooks.post.install_steps when the release tool supports it.

    custom_block: |
      postflight_steps do
        on_macos do
          run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ "{{staged_path}}" }}/mnemon"]

.goreleaser.yml:83

• The release test suite already parses .goreleaser.yml, but it does not assert the Homebrew cask hook. Please add a fixture/assertion for this custom_block—including the literal {{staged_path}} token—so a future GoReleaser/config change cannot silently reintroduce deprecated postflight or break the quarantine fix.

    custom_block: |
      postflight_steps do
        on_macos do
          run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ "{{staged_path}}" }}/mnemon"]

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[audreyt]

@copilot review