From 2d6b576d3a96a4f932c87afbf52d32de9c3601bf Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Sun, 16 Aug 2026 18:42:36 +0800
Subject: [PATCH] feat: bump Homebrew cask on release

---
 .github/workflows/release.yml           | 59 ++++++++++++++++++++++++-
 README.md                               | 12 +++++
 packaging/homebrew/gridline.rb.template | 54 ++++++++++++++++++++++
 scripts/render-cask.sh                  | 41 +++++++++++++++++
 src-tauri/Cargo.lock                    |  2 +-
 5 files changed, 166 insertions(+), 2 deletions(-)
 create mode 100644 packaging/homebrew/gridline.rb.template
 create mode 100755 scripts/render-cask.sh

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4e190f4..6f80cd3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -320,4 +320,61 @@ jobs:
           # Assets use tauri-action's default versioned naming (e.g.
           # Gridline_0.7.5_aarch64.dmg, Gridline-0.7.5-1.x86_64.rpm) and the
           # README download tables link to them statically per release —
-          # remember to update both README tables when cutting a new version.
\ No newline at end of file
+          # remember to update both README tables when cutting a new version.
+
+  # After the installers are uploaded, refresh the Homebrew cask in the
+  # AdrianBonpin/homebrew-gridline tap: hash the freshly-published DMGs,
+  # render Casks/gridline.rb from the template, and push it. Users then get
+  # the new version via `brew upgrade --cask gridline`.
+  #
+  # Requires the HOMEBREW_TAP_TOKEN secret (a PAT with `repo` scope on the tap
+  # repo — the default GITHUB_TOKEN cannot push to a different repo). The job
+  # no-ops until that secret is set, so releases stay green before this is
+  # configured.
+  bump-cask:
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Resolve version and DMG checksums
+        id: meta
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          gh release download "$GITHUB_REF_NAME" -p "Gridline_${VERSION}_aarch64.dmg" -O /tmp/arm.dmg
+          gh release download "$GITHUB_REF_NAME" -p "Gridline_${VERSION}_x64.dmg" -O /tmp/intel.dmg
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "sha_arm=$(shasum -a 256 /tmp/arm.dmg | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+          echo "sha_intel=$(shasum -a 256 /tmp/intel.dmg | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout tap repo
+        uses: actions/checkout@v4
+        with:
+          repository: AdrianBonpin/homebrew-gridline
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          path: tap
+
+      - name: Render and push cask
+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+          SHA_ARM: ${{ steps.meta.outputs.sha_arm }}
+          SHA_INTEL: ${{ steps.meta.outputs.sha_intel }}
+        run: |
+          mkdir -p tap/Casks
+          ./scripts/render-cask.sh "$VERSION" "$SHA_ARM" "$SHA_INTEL" > tap/Casks/gridline.rb
+          cat tap/Casks/gridline.rb
+          cd tap
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add Casks/gridline.rb
+          if git diff --cached --quiet; then
+            echo "cask already up to date"
+          else
+            git commit -m "gridline $VERSION"
+            git push
+          fi
\ No newline at end of file
diff --git a/README.md b/README.md
index 08c9f4b..e5c18b3 100644
--- a/README.md
+++ b/README.md
@@ -41,6 +41,16 @@ Grab the installer for your OS from the [latest release](https://github.com/Adri
 | **Fedora / RHEL / openSUSE** | x86_64                       | [Gridline-0.7.10-1.x86_64.rpm](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.10/Gridline-0.7.10-1.x86_64.rpm)     |
 | **Other Linux**              | amd64                        | [Gridline_0.7.10_amd64.AppImage](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.10/Gridline_0.7.10_amd64.AppImage) |
 
+**macOS via Homebrew** (recommended for Mac users):
+
+```bash
+brew install --cask AdrianBonpin/gridline/gridline
+# or, after a one-time `brew tap AdrianBonpin/gridline`:
+brew install --cask gridline
+```
+
+The cask strips the macOS quarantine flag automatically during install, so **no manual `xattr` step is needed** on the Homebrew path — the app just launches. (Direct-DMG downloads still need the [first-launch instructions](#installers-are-unsigned-for-now) below.)
+
 > **macOS first launch:** macOS may say *"Gridline is damaged and can't be opened"* or *"the developer cannot be verified"* — this is expected; the app isn't Developer-ID signed/notarized yet. See the [macOS first-launch instructions](#installers-are-unsigned-for-now) (right-click → Open, or the one-time `xattr` fix). Not sure if your Mac is Intel or Apple Silicon? See [Which file should I download?](#which-file-should-i-download) below.
 
 <!--
@@ -299,6 +309,8 @@ Pre-built installers for macOS, Windows, and Linux are published on the [Release
 
 Gridline is currently distributed **unsigned** — it doesn't pay for code-signing certificates yet (macOS builds are *ad-hoc signed*, so they pass Apple Silicon's launch checks but aren't Developer-ID signed or notarized). Your OS will warn you the first time you open it. This is expected — the app is safe, it just hasn't paid the signing fee:
 
+> **Homebrew users:** the [Homebrew cask](#download) strips the quarantine flag automatically during install, so you skip all of the steps below — the app just launches.
+
 - **macOS:** if you see *"Gridline can't be opened because the developer cannot be verified"* (or the app simply won't open from Finder), right-click the app → **Open** → **Open** (or System Settings → Privacy & Security → **Open Anyway**). Do this once per version.
 - **macOS — "Gridline is damaged and can't be opened":** remove the quarantine flag macOS attaches to downloaded apps, then launch normally:
 
diff --git a/packaging/homebrew/gridline.rb.template b/packaging/homebrew/gridline.rb.template
new file mode 100644
index 0000000..cbaa5e2
--- /dev/null
+++ b/packaging/homebrew/gridline.rb.template
@@ -0,0 +1,54 @@
+# Homebrew Cask formula for Gridline.
+#
+# This file is the template; `scripts/render-cask.sh` substitutes
+# @VERSION@ / @ARM_SHA256@ / @INTEL_SHA256@ on each release and pushes the
+# rendered file to the `AdrianBonpin/homebrew-gridline` tap as
+# `Casks/gridline.rb`. End users then install with
+#
+#   brew install --cask AdrianBonpin/gridline/gridline
+#
+# or — after a one-time `brew tap AdrianBonpin/gridline` — with the short
+#
+#   brew install --cask gridline
+#
+# QUARANTINE: Gridline is ad-hoc signed (not Developer-ID signed/notarized),
+# so Homebrew casks (which deliberately set com.apple.quarantine on the
+# downloaded artifact) would make Gatekeeper refuse to launch it. The
+# `postflight` block strips the quarantine flag automatically — the standard
+# GoReleaser-documented pattern for unsigned casks — so `brew install` works
+# with no manual `xattr` step. This is a Gatekeeper bypass; drop the
+# postflight once the app is properly signed + notarized.
+
+cask "gridline" do
+  arch arm: "aarch64", intel: "x64"
+
+  version "@VERSION@"
+  sha256 arm:   "@ARM_SHA256@",
+         intel: "@INTEL_SHA256@"
+
+  url "https://github.com/AdrianBonpin/gridline/releases/download/v#{version}/Gridline_#{version}_#{arch}.dmg"
+  name "Gridline"
+  desc "Open-source, cross-platform database GUI client for PostgreSQL"
+  homepage "https://github.com/AdrianBonpin/gridline"
+
+  depends_on macos: ">= :monterey"
+
+  app "Gridline.app"
+
+  # The "installation step" — strip the quarantine flag so the unsigned
+  # (ad-hoc signed) app launches without the Gatekeeper prompt.
+  postflight do
+    if OS.mac?
+      system_command "/usr/bin/xattr",
+                     args: ["-dr", "com.apple.quarantine", "#{appdir}/Gridline.app"]
+    end
+  end
+
+  zap trash: [
+    "~/Library/Application Support/com.adrianbonpin.gridline",
+    "~/Library/Caches/com.adrianbonpin.gridline",
+    "~/Library/Preferences/com.adrianbonpin.gridline.plist",
+    "~/Library/Saved Application State/com.adrianbonpin.gridline.savedState",
+    "~/Library/WebKit/com.adrianbonpin.gridline",
+  ]
+end
\ No newline at end of file
diff --git a/scripts/render-cask.sh b/scripts/render-cask.sh
new file mode 100755
index 0000000..6f9c513
--- /dev/null
+++ b/scripts/render-cask.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+#
+# Render the Homebrew cask for a Gridline release.
+#
+# Usage:
+#   scripts/render-cask.sh <version> <arm_sha256> <intel_sha256>
+#
+# Reads packaging/homebrew/gridline.rb.template, substitutes the version and
+# per-arch SHA256 checksums, and prints the rendered cask to stdout. The
+# release workflow pipes this into the tap repo's Casks/gridline.rb.
+#
+# Example:
+#   scripts/render-cask.sh 0.7.10 \
+#     aaaa...bbbb \
+#     cccc...dddd > Casks/gridline.rb
+set -euo pipefail
+
+if [ "$#" -ne 3 ]; then
+  echo "usage: $0 <version> <arm_sha256> <intel_sha256>" >&2
+  exit 1
+fi
+
+VERSION="$1"
+ARM_SHA256="$2"
+INTEL_SHA256="$3"
+
+# Validate the checksums look like SHA-256 (64 hex chars) before we ship them.
+for sha in "$ARM_SHA256" "$INTEL_SHA256"; do
+  if ! [[ "$sha" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "error: invalid sha256 '$sha' (expected 64 hex chars)" >&2
+    exit 1
+  fi
+done
+
+TEMPLATE="$(dirname "$0")/../packaging/homebrew/gridline.rb.template"
+TEMPLATE="$(cd "$(dirname "$TEMPLATE")" && pwd)/$(basename "$TEMPLATE")"
+
+sed -e "s/@VERSION@/${VERSION}/g" \
+    -e "s/@ARM_SHA256@/${ARM_SHA256}/g" \
+    -e "s/@INTEL_SHA256@/${INTEL_SHA256}/g" \
+    "$TEMPLATE"
\ No newline at end of file
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 761f8e7..b7190d4 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -1783,7 +1783,7 @@ dependencies = [
 
 [[package]]
 name = "gridline"
-version = "0.7.9"
+version = "0.7.10"
 dependencies = [
  "chrono",
  "deadpool-postgres",