Ship the Homebrew build as a cask, speed up the release, patch shipped deps

[mathieubrunpicard]

Follow-up to #2, which published a Homebrew formula. That formula cannot be installed on macOS.

Why the formula was broken

It ships no bottle, so brew install classifies it as a build from source, and the source-build path requires a current Xcode and Command Line Tools before the formula's install block runs — for a tarball that only needs unpacking:

==> Installing pipecorn from pipecorn/tap
Error: Your Xcode (15.4) at /Applications/Xcode.app is too outdated.
Error: Your Command Line Tools are too outdated.

Casks are the vehicle for prebuilt binaries and skip those checks entirely.

Changes

Cask instead of formula (ecb3bec)

• homebrew/pipecorn.cask.rb.tmpl replaces homebrew/pipecorn.rb.tmpl. The arch arm:/intel: stanza collapses the formula's four on_macos/on_linux blocks into one url, and zap trash: covers ~/.config/pipecorn and ~/.local/share/pipecorn.
• scripts/render-homebrew-cask.sh replaces the formula renderer: two SHA256s instead of four, still failing hard on a missing tarball or an unrendered placeholder.
• The release job writes Casks/pipecorn.rb and deletes Formula/pipecorn.rb from the tap. A formula wins over a cask with the same token, so leaving the 0.1.3 formula in place would keep serving the error above.
• Casks are macOS-only, so the README sends Linux and Windows users to npm, and documents brew trust pipecorn/tap — Homebrew 6.0 requires that once per machine for any third-party tap.

Faster releases (d1aae82)

The 0.1.3 run took ~12 minutes, ~6.5 of it in oclif pack tarballs.

• --no-xz: oclif builds .tar.gz and .tar.xz for all five targets; nothing consumes the xz ones and they dominate the step.
• --parallel: targets build concurrently rather than in sequence.
• cache: npm on both release jobs, matching ci.yml.

Patch the advisories that actually reach users (d3d79d3)

Of the packages flagged on this repo, only two are present in the packed tarball: brace-expansion (via minimatch) and fast-uri (via ajv). Both bumped by patch releases, lockfile only. npm audit --omit=dev now reports no vulnerabilities.

Everything still flagged is a dev dependency. The critical one is vitest — "when Vitest UI server is listening, arbitrary file can be read and executed" — and this repo runs vitest run with no UI package and no listening server. Clearing those needs a vitest 2 → 5 migration, which belongs on its own branch.

Verification

• Cask renders correctly from real 0.1.3 tarballs, with Ruby #{version}/#{arch} interpolation surviving the placeholder pass; renderer exits 1 on a missing tarball.
• Confirmed against the published pipecorn-v0.1.3-linux-x64.tar.gz that the archive root is pipecorn/ containing bin/pipecorn, so the binary "pipecorn/bin/pipecorn" path is right, and that oclif's shim resolves symlinks itself — it finds its bundled node when invoked through the symlink a cask creates.
• --no-xz and --parallel checked against oclif's pack/tarballs.ts flag definitions.
• npm ci, npm run lint, npm run typecheck, npm test (25/25), npm run build all pass on the new lockfile.

Untested: whether Gatekeeper blocks the first run. Casks quarantine their downloads where formulae do not, and the bundled node is unsigned. If it does, the fix is a postflight that strips the xattr — deliberately left out until the problem is observed rather than weakening a protection pre-emptively.

The cask reaches the tap on the next tag push, not on merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VJDs7niXGGW2dmPXd1e93S

---

Generated by Claude Code