Use hooks.post.install_steps for the cask quarantine step

[joe4dev]

Warning

Blocked by upstream — do not merge yet.

hooks.post.install_steps exists in no released GoReleaser. It arrives in v2.19 through goreleaser/goreleaser#6873 (open, closes goreleaser/goreleaser#6870). Until then CI here fails twice over: the pin check rejects the released 2.18.2, and goreleaser check rejects the field itself:

line 91: field install_steps not found in type config.HomebrewCaskHook

When v2.19 ships, re-running CI is enough — this PR already bumps .tool-versions to goreleaser 2.19.0.

Motivation

#510 works around Homebrew's deprecated postflight by writing the stanza through custom_block, at two costs: {{staged_path}} has to be escaped past GoReleaser's own template pass, and the stanza renders at the top of the cask, so every stanza after it trips Cask/StanzaOrder. #511 has to skip that cop to stay green.

GoReleaser v2.19 adds the first-class option, which removes all three.

Solution

Replace custom_block with hooks.post.install_steps, using GoReleaser's new .StagedPath field in place of the escape. Behaviour is unchanged — the step still clears quarantine on the whole staged dir, as #477 made it.

hooks:
  post:
    install_steps: |
      on_macos do
        run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ .StagedPath }}"]
      end

Also drops #511's --except-cops=Cask/StanzaOrder and its TODO(#512), and bumps the GoReleaser pin.

Validation

Built GoReleaser from #6873 at its head (38c7541) and ran it against this config:

• goreleaser check passes on the #6873 build, and fails on 2.18.2 with the error above
• .StagedPath renders to Homebrew's {{staged_path}} token, and the generated stanza is byte-identical to the one Fix deprecated postflight stanza in the generated Homebrew cask #510 produces
• the stanza renders in its proper position, so brew style reports no offences with no exception — against 9 on Fix deprecated postflight stanza in the generated Homebrew cask #510's output
• Homebrew 7.0.4 loads the cask as Cask::Artifact::PostflightSteps with no deprecation warning
• make check-cask passes, since it checks generated output rather than config

The install itself was verified on #510 for the identical stanza: quarantine cleared across all 43 staged files, and lstk --version runs.

Stacking

Based on #511, so the diff reads as "replace the workaround". Retarget to main once #511 merges.

Docs

Nothing to document. No change to lstk's commands, flags, env vars or output, and no user-visible change to the cask's behaviour — this swaps the mechanism that generates an identical stanza.

Review

Human review advised: it touches the release pipeline, and merging it before v2.19 would break the release.

Todo

• Wait for GoReleaser v2.19, then re-run CI
• Confirm 2.19.0 is the version that actually ships #6873 before merging

Towards DEVX-1124

🤖 Generated with Claude Code