Context
.github/workflows/release.yml currently tracks the GoReleaser nightly rather than a pinned release:
This is deliberate but temporary. Casks generated before goreleaser/goreleaser#6752 emit on_intel before on_arm and a blank line before the closing end, both of which the tap's brew style job rejects. That fix was merged on 2026-08-08 and is not in any tagged release — 2.17.1 predates it. See #64 for the full history.
Why not pin a specific nightly
Dated nightlies are pruned: only about a week of vX.Y.Z-<sha>-nightly releases are retained at any time. A pinned tag would 404 the next time a release is cut. The action's version: nightly resolves the latest immutable nightly through the Releases API and verifies its checksums, which is the closest available approximation.
What this costs us today
There is no local packaging check. Mise cannot install the build the workflow uses — its registry lists only stable versions, and GoReleaser's rolling nightly git tag resolves to 2.16.0-nightly, which predates the fix. A locally pinned GoReleaser would generate a different cask from the one published, so goreleaser was removed from [tools] and the test:release tasks were deleted. The tap's own test-bot job is currently the only gate.
The release pipeline tracks a moving target. A regression in a nightly would ship silently.
What to do when 2.18.0 ships
- Set
version: 2.18.0 in .github/workflows/release.yml and delete the explanatory comment.
- Restore
goreleaser = "2.18.0" to [tools] in mise.toml.
- Restore a pre-tag packaging check that inspects the cask GoReleaser writes to
dist/homebrew/Casks/sbxflow.rb, and a task that runs the tap's brew style, brew readall --aliases --os=all --arch=all and brew audit --except=installed against it on a current Homebrew.
- Update
docs/releasing.md and CONTRIBUTING.md, which both currently explain why no local check exists.
The check must be release-shaped
The previous local check passed a package the tap then rejected. It ran against a snapshot, whose version never matches the release URL, so brew audit's version/URL rules could not fire. Any restored check must validate an artifact whose version and URL agree, or it will repeat that failure.
Acceptance criteria
- The release workflow pins a released GoReleaser version, not
nightly.
mise.toml pins the same version, and a local check validates the cask GoReleaser actually writes.- The local check runs the tap's own commands, unmodified, against a release-shaped artifact.
- A release still lands one commit in the tap with one passing test-bot run.
docs/releasing.md and CONTRIBUTING.md no longer explain a missing local check.
Related
Notarisation of the macOS binary is a separate concern: the cask removes the quarantine attribute on install and discloses that in its caveats, but signing and notarising properly would remove the need for either.
Context
.github/workflows/release.ymlcurrently tracks the GoReleaser nightly rather than a pinned release:This is deliberate but temporary. Casks generated before goreleaser/goreleaser#6752 emit
on_intelbeforeon_armand a blank line before the closingend, both of which the tap'sbrew stylejob rejects. That fix was merged on 2026-08-08 and is not in any tagged release — 2.17.1 predates it. See #64 for the full history.Why not pin a specific nightly
Dated nightlies are pruned: only about a week of
vX.Y.Z-<sha>-nightlyreleases are retained at any time. A pinned tag would 404 the next time a release is cut. The action'sversion: nightlyresolves the latest immutable nightly through the Releases API and verifies its checksums, which is the closest available approximation.What this costs us today
There is no local packaging check. Mise cannot install the build the workflow uses — its registry lists only stable versions, and GoReleaser's rolling
nightlygit tag resolves to2.16.0-nightly, which predates the fix. A locally pinned GoReleaser would generate a different cask from the one published, sogoreleaserwas removed from[tools]and thetest:releasetasks were deleted. The tap's own test-bot job is currently the only gate.The release pipeline tracks a moving target. A regression in a nightly would ship silently.
What to do when 2.18.0 ships
version: 2.18.0in.github/workflows/release.ymland delete the explanatory comment.goreleaser = "2.18.0"to[tools]inmise.toml.dist/homebrew/Casks/sbxflow.rb, and a task that runs the tap'sbrew style,brew readall --aliases --os=all --arch=allandbrew audit --except=installedagainst it on a current Homebrew.docs/releasing.mdandCONTRIBUTING.md, which both currently explain why no local check exists.The check must be release-shaped
The previous local check passed a package the tap then rejected. It ran against a snapshot, whose version never matches the release URL, so
brew audit's version/URL rules could not fire. Any restored check must validate an artifact whose version and URL agree, or it will repeat that failure.Acceptance criteria
nightly.mise.tomlpins the same version, and a local check validates the cask GoReleaser actually writes.docs/releasing.mdandCONTRIBUTING.mdno longer explain a missing local check.Related
Notarisation of the macOS binary is a separate concern: the cask removes the quarantine attribute on install and discloses that in its
caveats, but signing and notarising properly would remove the need for either.