[antoinetoussaint-byte]

What broke

v0.1.216 was tagged by codefly publish (release PR #1190), but the release workflow failed at Qualify the clean tag before building anything (run 40437865278):

• DEPRECATED:  homebrew_casks.url.verified  should not be used anymore
• .goreleaser.yaml  error=configuration is valid, but uses deprecated properties
⨯ check failed

#1101 moved the release image from goreleaser-cross:v1.26.4 to v1.27.3, which bundles GoReleaser v2.18.3. Since v2.18.1, homebrew_casks.url.verified is deprecated: Homebrew deprecated the stanza (Homebrew/brew#23280), and GoReleaser no longer writes it into the cask. goreleaser check exits non-zero on any deprecated property. No PR workflow runs GoReleaser, so the first run under the new image was the tag.

The change

Drops the one deprecated key. Homebrew's default URL verification covers the release-download URL the template already names. .github/scripts/verify-homebrew-cask.sh and pkg/cliupdate/release_contract_test.go do not read it.

Classification: fix, at the config that owns the behaviour. No gate is relaxed, and the workflow's check stays as it is.

Verified

• goreleaser check with GoReleaser v2.18.3 (the same binary the image bundles): fails on main (d3af5843) with the error above, passes on this branch.
• The workflow's local snapshot qualification (goreleaser-cross:v1.27.3 release --snapshot --clean, the 4-archive, SBOM and signature assertions) has been run against this head. The result is in the comment below.

After merge

v0.1.216 is a tag with no release. Per docs/runbooks/cut-a-release.md, a published tag is never moved, so the next codefly publish cuts v0.1.217 from main with this fix.

🤖 Generated with Claude Code

[antoinetoussaint-byte]

Local qualification of head ba8ac461, reproducing the release workflow's Qualify the clean tag step:

• goreleaser check in ghcr.io/goreleaser/goreleaser-cross:v1.27.3 (GoReleaser 2.18.3): 1 configuration file(s) validated. The same check on main d3af5843 fails with the homebrew_casks.url.verified deprecation.
• release --snapshot --clean in the same image (CGO, all four cross toolchains, syft 1.44.0, a throwaway signing key in place of the release secret): release succeeded after 2m24s.
• The workflow's assertions all hold: one archive each for darwin/amd64, darwin/arm64, linux/amd64 and linux/arm64; 4 SBOMs; 1 signature; non-empty checksums.txt and .sig; signature verifies against the key's public half; every checksum matches.
• The darwin/arm64 snapshot binary runs: codefly version → 0.1.216-SNAPSHOT-ba8ac461.
• Cask URL: GoReleaser 2.18.3 still rewrites ctx.Version to #{version} (internal/pipe/cask/cask.go:467), so a real release writes releases/download/v#{version}/, which verify-homebrew-cask.sh requires. The snapshot shows a literal tag only because a snapshot version is not a substring of the tag.

Not verified locally: notarization, which is disabled outside a real release, and the signature against the real release certificate, which needs the secret.