[joe4dev]

Motivation

#510 works around Homebrew's deprecated postflight by writing the stanza through custom_block, at two costs: {{staged_path}} has to be escaped past GoReleaser's own template pass, and the stanza renders at the top of the cask, so every stanza after it trips Cask/StanzaOrder. #511 has to skip that cop to stay green.

GoReleaser v2.19.0 (released 2026-10-22, via goreleaser/goreleaser#6873) adds the first-class option, which removes all three.

Solution

Replace custom_block with hooks.post.install_steps, using GoReleaser's new .StagedPath field in place of the escape. Behaviour is unchanged — the step still clears quarantine on the whole staged dir, as #477 made it.

hooks:
  post:
    install_steps: |
      on_macos do
        run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ .StagedPath }}"]
      end

Also drops #511's --except-cops=Cask/StanzaOrder and its TODO(#512), and bumps the GoReleaser pin.

Validation

Ran the released GoReleaser 2.19.0 against this config:

• goreleaser check passes; 2.18.2 rejects it with field install_steps not found in type config.HomebrewCaskHook, so an unbumped pin fails loudly rather than dropping the hook
• make check-cask passes: .StagedPath renders to Homebrew's {{staged_path}} token
• the stanza renders in its proper position, so make lint-cask (brew style + brew audit) reports no offences with no exception

Earlier, against #6873's pre-release build: the generated stanza was byte-identical to #510's, and Homebrew 7.0.4 loaded it as Cask::Artifact::PostflightSteps with no deprecation warning.

The install itself was verified on #510 for the identical stanza: quarantine cleared across all 43 staged files, and lstk --version runs.

Docs

Nothing to document. No change to lstk's commands, flags, env vars or output, and no user-visible change to the cask's behaviour — this swaps the mechanism that generates an identical stanza.

Review

Human review advised: it touches the release pipeline. Both CI and the release job install GoReleaser from .tool-versions, so they move to 2.19.0 together.

Towards DEVX-1124
Closes DEVX-1130

🤖 Generated with Claude Code