From a4aa279497ff8fcc0819ce815449ceaff77e5459 Mon Sep 17 00:00:00 2001
From: Andrei Taranik <andrey@cicd.team>
Date: Fri, 22 May 2026 23:49:53 +0300
Subject: [PATCH 1/2] build(release): bump goreleaser pin v2.10.0 -> v2.15.4 +
 binaries plural

GoReleaser v2.10 emits a deprecation warning for the singular `binary` key in
homebrew_casks. The plural `binaries: [...]` form is the new shape and is
available since v2.12.6. Bump the Makefile pin to the current stable
(v2.15.4) and switch to the plural form.

`make release-check` clean. The release workflow already pulls v2.x via
`goreleaser-action@v7` with `version: "~> v2"` so CI was effectively running
v2.15.4 already; this aligns local tooling with CI.

Two remaining minor deprecation warnings (`dockers` and `docker_manifests`
phasing out for `dockers_v2`) are left for a separate change.
---
 .goreleaser.yml | 2 +-
 Makefile        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index f2e6520..364fb87 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -95,7 +95,7 @@ homebrew_casks:
     directory: Casks
     homepage: "https://remetric.dev"
     description: "Re-metric your stack - find waste in Prometheus, Grafana & Loki"
-    binary: "remetric"
+    binaries: ["remetric"]
     commit_author:
       name: "remetric-dev-bot"
       email: "noreply@remetric.dev"
diff --git a/Makefile b/Makefile
index 00b8e7c..6b9b09f 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@ GOLANGCI_VERSION := v2.12.1
 GOLANGCI_IMAGE   := golangci/golangci-lint:$(GOLANGCI_VERSION)
 GOFUMPT_VERSION  := v0.7.0
 GOVULN_VERSION   := v1.3.0
-GORELEASER_VERSION := v2.10.0
+GORELEASER_VERSION := v2.15.4
 LOCAL_PREFIX     := github.com/remetric-dev/remetric
 
 VERSION          ?= $(shell git describe --tags --dirty --always 2>/dev/null || echo dev)

From c63731f551bd18ff763b4091cb6dfe738e88d72e Mon Sep 17 00:00:00 2001
From: Andrei Taranik <andrey@cicd.team>
Date: Fri, 22 May 2026 23:57:33 +0300
Subject: [PATCH 2/2] build(release): strip macOS Gatekeeper quarantine xattr
 on cask install

Unsigned binaries on macOS get a com.apple.quarantine xattr applied by
Gatekeeper at download time, and exec'ing them produces SIGKILL with no
output (exit 137). v0.1.0-rc.8's brew install reproduced this exactly.

Add a post-install hook to the cask that runs `xattr -dr` on the staged
binary when on macOS. Linux installs are unaffected.

This is a temporary workaround. The proper fix is Apple Developer Program
membership + codesign + notarytool. Until then this lets `brew install
remetric-dev/tap/remetric && remetric --version` actually print a version.
---
 .goreleaser.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 364fb87..bb238d1 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -99,6 +99,15 @@ homebrew_casks:
     commit_author:
       name: "remetric-dev-bot"
       email: "noreply@remetric.dev"
+    # Strip macOS Gatekeeper quarantine on install so the unsigned binary
+    # actually executes. Once we sign + notarize (Apple Developer Program),
+    # remove this hook block and let Gatekeeper verify normally.
+    hooks:
+      post:
+        install: |
+          if OS.mac?
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/remetric"]
+          end
     # Publish on every tag, including pre-releases (v0.1.0-rc.N), so we can
     # validate the tap end-to-end before v0.1.0. Switch to `auto` post-v0.1
     # if you want to stop polluting the tap with alphas.