Use hooks.post.install_steps for the cask quarantine step

.goreleaser.yaml

@@ -104,17 +104,14 @@ homebrew_casks:
       bash: completions/lstk.bash
       zsh: completions/lstk.zsh
       fish: completions/lstk.fish
-    # hooks.post.install emits Homebrew's deprecated `postflight`; the
-    # replacement arrives as hooks.post.install_steps in GoReleaser v2.19
-    # (goreleaser/goreleaser#6873). Until then custom_block writes the stanza,
-    # escaping `{{staged_path}}` past GoReleaser's template pass. It renders
-    # first in the cask, so `brew style` reports stanza-order offences.
-    custom_block: |
-      postflight_steps do
-        on_macos do
-          # The whole staged dir, not only lstk: the bundled extensions binary
-          # sits next to it and would otherwise be blocked by Gatekeeper on its
-          # first run.
-          run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ "{{staged_path}}" }}"]
-        end
-      end
+    hooks:
+      post:
+        # `.StagedPath` is GoReleaser's field; it renders to Homebrew's own
+        # `{{staged_path}}` token, which resolves at install time.
+        install_steps: |
+          on_macos do
+            # The whole staged dir, not only lstk: the bundled extensions binary
+            # sits next to it and would otherwise be blocked by Gatekeeper on its
+            # first run.
+            run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ .StagedPath }}"]
+          end

.tool-versions

@@ -1,2 +1,2 @@
 golangci-lint 2.14.0
-goreleaser 2.18.2
+goreleaser 2.19.0

scripts/check-cask.sh

@@ -54,9 +54,8 @@ grep -q 'postflight_steps do' "$CASK" ||
 grep -q 'com.apple.quarantine' "$CASK" ||
   fail "cask no longer clears com.apple.quarantine"
 
-# Homebrew's tokens share GoReleaser's delimiters. An unescaped
-# `{{staged_path}}` fails the release; a broken escape emits a literal pointing
-# somewhere else.
+# `.StagedPath` must reach the cask as Homebrew's `{{staged_path}}` token; a
+# hard-coded or Ruby-interpolated path would miss the staged dir.
 grep -q '"{{staged_path}}"' "$CASK" ||
   fail "quarantine step does not target the whole staged dir"
 

scripts/lint-cask.sh

@@ -33,10 +33,7 @@ TAP_CASKS="$(brew --repository "$TAP")/Casks"
 mkdir -p "$TAP_CASKS"
 cp "$CASK" "$TAP_CASKS/lstk.rb"
 
-# TODO(#512): drop --except-cops once hooks.post.install_steps replaces
-# custom_block, which renders the stanza first and trips Cask/StanzaOrder on
-# everything after it. Scoped to that cop so the deprecation cops still fire.
-brew style --except-cops=Cask/StanzaOrder "$TAP_CASKS/lstk.rb"
+brew style "$TAP_CASKS/lstk.rb"
 
 # Passes on a deprecated stanza, so this guards other faults, not #501. Its
 # `--online` form checks urls and checksums, but only the tap has a published