BUILD: GoReleaser integration for Homebrew Cask

[cafferata]

GoReleaser can generate and publish (since v2.10) a Homebrew Cask into a repository (Tap), reducing the delay for Brew users to receive the latest release.

After this initial setup, SLSA Provenance can be revisited:

• Add SLSA3 provenance to your builds #3468 for further discussion
• https://goreleaser.com/blog/slsa-generation-for-your-artifacts/

See also:

• DNSControl version (Homebrew) #2354 (comment)
• Homebrew updates
  • dnscontrol 4.23.0 Homebrew/homebrew-core#232556
  • dnscontrol 4.22.0 Homebrew/homebrew-core#230111
  • dnscontrol 4.21.0 Homebrew/homebrew-core#225742

These tasks are currently blocked, pending the creation of the StackExchange/homebrew-tap repository by @tlimoncelli, as discussed today in #3674.

[cafferata]

This PR is kept in draft state for now.

Work here depends on the outcome of the migration path within Homebrew.
See Homebrew/brew#20585 and goreleaser discussion #5563.

[tlimoncelli]

@cafferata
I haven't touched this since it is marked as draft. Is this still being worked on?

[cafferata]

Hi @tlimoncelli! Yes, this is still being worked on. I just reviewed and finalized the configuration.

To give some background: the reason this PR stayed in draft was because there was a lot of uncertainty around the migration path within Homebrew. The short version:

• Homebrew's stance is that prebuilt binaries should be distributed as casks, not formulas (Homebrew/brew#20585). GoReleaser is phasing out formula support in favor of casks.
• The migration mechanism (tap_migrations.json) to automatically move users from formula → cask was broken until Homebrew 5.0.6. This is now resolved.

After merging this PR, GoReleaser will automatically publish the prebuilt binary as a Homebrew cask to StackExchange/homebrew-tap on each release. The existing homebrew-core formula (which builds from source) will continue to exist independently. A deprecation request to Homebrew can be considered later once the cask distribution is proven stable.

Action needed from you: Please configure a HOMEBREW_TAP_TOKEN secret in the repository settings. This needs to be a GitHub personal access token (classic) with repo scope, granting push access to the StackExchange/homebrew-tap repository. The regular GITHUB_TOKEN doesn't have cross-repo permissions, so this separate token is required for GoReleaser to push the cask definition.

Once the secret is in place, I'll mark this PR as ready for (re)review.

goreleaser build --snapshot --clean

  • skipping validate...
  • cleaning distribution directory
  • loading environment variables
  • getting and validating git state
    • git state                                      commit=f61e020501b53cb5b042460cd8d6daf72d99e08d branch=build/goreleaser-homebrew current_tag=v4.33.1 previous_tag=v4.33.0 dirty=true
    • pipe skipped or partially skipped              reason=disabled during snapshot mode
  • parsing tag
  • setting defaults
    • dockers and docker_manifests are being phased out and will eventually be replaced by dockers_v2, check https://goreleaser.com/deprecations#dockers for more info
    • dockers and docker_manifests are being phased out and will eventually be replaced by dockers_v2, check https://goreleaser.com/deprecations#dockers for more info
  • snapshotting
    • building snapshot...                           version=4.33.2-next
  • running before hooks
    • running                                        hook=go fmt ./...
    • running                                        hook=go mod tidy
    • running                                        hook=go generate ./...
  • ensuring distribution directory
  • setting up metadata
  • writing release metadata
  • loading go mod information
  • build prerequisites
  • building binaries
    • building                                       binary=dist/build_darwin_amd64_v1/dnscontrol
    • building                                       binary=dist/build_windows_amd64_v1/dnscontrol.exe
    • building                                       binary=dist/build_darwin_arm64_v8.0/dnscontrol
    • building                                       binary=dist/build_linux_amd64_v1/dnscontrol
    • building                                       binary=dist/build_freebsd_amd64_v1/dnscontrol
    • building                                       binary=dist/build_windows_arm64_v8.0/dnscontrol.exe
    • building                                       binary=dist/build_freebsd_arm64_v8.0/dnscontrol
    • building                                       binary=dist/build_linux_arm64_v8.0/dnscontrol
  • universal binaries
    • creating from 2 binaries                       id=build binary=dist/build_darwin_all/dnscontrol
  • writing artifacts metadata
  • build succeeded after 9s
  • thanks for using GoReleaser!

[tlimoncelli]

Wow! Thank you for working out all that! Sounds rather complicated.

The PAT has been created as specified. It has repo access to the StackExchange org.

It expires on Sat, Feb 6 2027. I've created a google calendar entry for Jan 18, 2027 to remind us to rotate the key.

It should be ready to go. Thanks for looking into this! I've become a big fan of Homebrew recently.

[cafferata]

Wow! Thank you for working out all that! Sounds rather complicated.

No worries, it's not as complicated as it looks, mostly just a lot of reading along and connecting the dots.

The PAT has been created as specified. It has repo access to the StackExchange org.

Great, thanks! I've marked the pull request as ready for review.

It expires on Sat, Feb 6 2027. I've created a google calendar entry for Jan 18, 2027 to remind us to rotate the key.

Good thinking! I've accepted the calendar invite.

It should be ready to go. Thanks for looking into this! I've become a big fan of Homebrew recently.

That's great to hear! What got you interested in Homebrew recently?