From f695d9483d6d6b9611f2a2dff4f90ac432ea42f2 Mon Sep 17 00:00:00 2001
From: piekstra <piekstra@users.noreply.github.com>
Date: Tue, 20 Oct 2026 16:25:39 -0400
Subject: [PATCH 1/2] fix(homebrew-alias): fail when a system_command cannot be
 converted

render rewrites only lines that start with system_command, so a call in any
other position (an assignment such as result = system_command ...) was left in
the install-step block, and Homebrew rejected the published cask as invalid.
Fail the render instead, naming the lines, so the release stops before the
tap is updated.
---
 actions/homebrew-alias/modernize.sh      | 17 ++++++++++++++---
 actions/homebrew-alias/test_modernize.sh | 10 ++++++++++
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/actions/homebrew-alias/modernize.sh b/actions/homebrew-alias/modernize.sh
index 4cb5121..2045f06 100644
--- a/actions/homebrew-alias/modernize.sh
+++ b/actions/homebrew-alias/modernize.sh
@@ -4,14 +4,16 @@
 # Usage:
 #   modernize.sh render <cask-file>
 #       Print the cask with only deprecated install-step block declarations
-#       renamed. Already-modern casks pass through unchanged.
+#       renamed. Already-modern casks pass through unchanged. Fails when a
+#       system_command call is left that the rewrite could not convert.
 set -euo pipefail
 
 render() {
   local file="$1"
   [ -f "$file" ] || { echo "::error::cask not found: $file" >&2; return 1; }
 
-  awk '
+  local out
+  out=$(awk '
     /^[[:space:]]*preflight[[:space:]]+do[[:space:]]*$/ {
       sub(/preflight[[:space:]]+do[[:space:]]*$/, "preflight_steps do")
     }
@@ -33,7 +35,16 @@ render() {
       gsub(/#\{staged_path\}/, "{{staged_path}}")
     }
     { print }
-  ' "$file"
+  ' "$file")
+
+  # The install-step DSL has no system_command, so one left in place (an
+  # assignment such as `result = system_command ...`, which the line-start
+  # rewrite above skips) makes Homebrew reject the whole cask as invalid.
+  if printf '%s\n' "$out" | grep -nE '^[^#]*\bsystem_command\b' >&2; then
+    echo "::error::$file: system_command calls above cannot be converted to install steps; make each a bare system_command line" >&2
+    return 1
+  fi
+  printf '%s\n' "$out"
 }
 
 case "${1:-}" in
diff --git a/actions/homebrew-alias/test_modernize.sh b/actions/homebrew-alias/test_modernize.sh
index 57f0ce4..269e0ea 100644
--- a/actions/homebrew-alias/test_modernize.sh
+++ b/actions/homebrew-alias/test_modernize.sh
@@ -45,5 +45,15 @@ rerendered=$(bash modernize.sh render "$tmp/modern.rb")
 bash modernize.sh render "$tmp/missing.rb" >/dev/null 2>&1 \
   && bad "missing file should fail" || ok "missing file fails"
 
+cat > "$tmp/assigned.rb" <<'RB'
+cask "example" do
+  postflight do
+    result = system_command "#{staged_path}/example", args: ["refresh"], must_succeed: false
+  end
+end
+RB
+bash modernize.sh render "$tmp/assigned.rb" >/dev/null 2>&1 \
+  && bad "unconvertible system_command should fail" || ok "unconvertible system_command fails"
+
 echo "----"
 if [ "$fails" -eq 0 ]; then echo "all modernization tests passed"; else echo "$fails failed"; exit 1; fi

From c63c54e9c6f783533c442d7720cb02c96175647f Mon Sep 17 00:00:00 2001
From: piekstra <piekstra@users.noreply.github.com>
Date: Tue, 20 Oct 2026 16:31:42 -0400
Subject: [PATCH 2/2] fix(homebrew-alias): render through a file to keep the
 cask byte-identical

Command substitution strips trailing newlines, so a cask ending in blank lines
came out changed. Write the rewrite to a temp file, check it, then print it.
---
 actions/homebrew-alias/modernize.sh      | 11 +++++++----
 actions/homebrew-alias/test_modernize.sh |  4 ++++
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/actions/homebrew-alias/modernize.sh b/actions/homebrew-alias/modernize.sh
index 2045f06..b2c22ad 100644
--- a/actions/homebrew-alias/modernize.sh
+++ b/actions/homebrew-alias/modernize.sh
@@ -13,7 +13,8 @@ render() {
   [ -f "$file" ] || { echo "::error::cask not found: $file" >&2; return 1; }
 
   local out
-  out=$(awk '
+  out=$(mktemp)
+  awk '
     /^[[:space:]]*preflight[[:space:]]+do[[:space:]]*$/ {
       sub(/preflight[[:space:]]+do[[:space:]]*$/, "preflight_steps do")
     }
@@ -35,16 +36,18 @@ render() {
       gsub(/#\{staged_path\}/, "{{staged_path}}")
     }
     { print }
-  ' "$file")
+  ' "$file" > "$out"
 
   # The install-step DSL has no system_command, so one left in place (an
   # assignment such as `result = system_command ...`, which the line-start
   # rewrite above skips) makes Homebrew reject the whole cask as invalid.
-  if printf '%s\n' "$out" | grep -nE '^[^#]*\bsystem_command\b' >&2; then
+  if grep -nE '^[^#]*\bsystem_command\b' "$out" >&2; then
     echo "::error::$file: system_command calls above cannot be converted to install steps; make each a bare system_command line" >&2
+    rm -f "$out"
     return 1
   fi
-  printf '%s\n' "$out"
+  cat "$out"
+  rm -f "$out"
 }
 
 case "${1:-}" in
diff --git a/actions/homebrew-alias/test_modernize.sh b/actions/homebrew-alias/test_modernize.sh
index 269e0ea..0c048cc 100644
--- a/actions/homebrew-alias/test_modernize.sh
+++ b/actions/homebrew-alias/test_modernize.sh
@@ -45,6 +45,10 @@ rerendered=$(bash modernize.sh render "$tmp/modern.rb")
 bash modernize.sh render "$tmp/missing.rb" >/dev/null 2>&1 \
   && bad "missing file should fail" || ok "missing file fails"
 
+printf 'cask "example" do\nend\n\n' > "$tmp/trailing.rb"
+cmp -s "$tmp/trailing.rb" <(bash modernize.sh render "$tmp/trailing.rb") \
+  && ok "trailing blank lines preserved" || bad "trailing blank lines preserved"
+
 cat > "$tmp/assigned.rb" <<'RB'
 cask "example" do
   postflight do