From 2d51f1ac630cd3044d146ce8e5b9abe383ad73ad Mon Sep 17 00:00:00 2001
From: Akeem Jenkins <accounts@akeemjenkins.com>
Date: Tue, 25 Aug 2026 21:43:11 -0600
Subject: [PATCH 1/2] feat: publish okf cask to homebrew-okf tap on release

GoReleaser now pushes a cask to okfcli/homebrew-okf on every
non-prerelease tag. The push uses a short-lived GitHub App installation
token minted in the release workflow (Contents read/write on the tap
repo only); the default Actions token cannot push to a second repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KuW9gYCf2iURYquY2S6bMq
---
 .github/workflows/release.yml | 15 ++++++++++++++-
 .goreleaser.yaml              | 24 ++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ec165b0..c48f73b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.x'
+          go-version: '1.27.x'
           cache: true
 
       - name: Install Syft (SBOM generator)
@@ -36,6 +36,18 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.2
 
+      # Short-lived installation token for pushing the cask to homebrew-okf.
+      # The App has Contents read/write on that one repository only; the
+      # token expires after an hour and is revoked when the job ends.
+      - name: Mint tap push token
+        id: tap-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.TAP_APP_CLIENT_ID }}
+          private-key: ${{ secrets.TAP_APP_PRIVATE_KEY }}
+          owner: okfcli
+          repositories: homebrew-okf
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v7
         with:
@@ -44,3 +56,4 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index a715e12..ad717e1 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -84,3 +84,27 @@ release:
   draft: false
   prerelease: auto
   name_template: "v{{ .Version }}"
+
+# Publishes the okf cask to the tap on every non-prerelease release. The token
+# is a short-lived GitHub App installation token minted in release.yml; the
+# default Actions token cannot push to a second repository.
+homebrew_casks:
+  - name: okf
+    homepage: https://github.com/okfcli/okf
+    description: "Go CLI toolkit for the Open Knowledge Format (OKF), agentic-first and JSON-native"
+    skip_upload: auto
+    url:
+      verified: github.com/okfcli/okf/
+    # The binaries are not signed or notarized, so strip the Gatekeeper
+    # quarantine bit on macOS; without this, users get "okf is damaged and
+    # cannot be opened".
+    hooks:
+      post:
+        install: |
+          if OS.mac?
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/okf"]
+          end
+    repository:
+      owner: okfcli
+      name: homebrew-okf
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"

From 62bf6f0d8fb1b6353251562f12312d3afd65cc60 Mon Sep 17 00:00:00 2001
From: Akeem Jenkins <accounts@akeemjenkins.com>
Date: Tue, 25 Aug 2026 21:43:11 -0600
Subject: [PATCH 2/2] chore: upgrade to Go 1.27

Bump go.mod to 1.27.0 and move CI/release workflows to 1.27.x.
Build, vet, race tests, and golangci-lint all pass on 1.27.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KuW9gYCf2iURYquY2S6bMq
---
 .github/workflows/ci.yml | 8 ++++----
 go.mod                   | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4d40b7..bff3a3c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        go: ['1.26.x']
+        go: ['1.27.x']
     runs-on: ${{ matrix.os }}
     defaults:
       run:
@@ -68,7 +68,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.x'
+          go-version: '1.27.x'
           cache: true
 
       - name: golangci-lint
@@ -87,7 +87,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.x'
+          go-version: '1.27.x'
           cache: true
 
       - name: Install govulncheck
@@ -108,7 +108,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
-          go-version: '1.26.x'
+          go-version: '1.27.x'
           cache: true
 
       - name: make build
diff --git a/go.mod b/go.mod
index afb9daf..12e2b02 100644
--- a/go.mod
+++ b/go.mod
@@ -1,5 +1,5 @@
 module github.com/okfcli/okf
 
-go 1.26.5
+go 1.27.0
 
 require gopkg.in/yaml.v3 v3.0.1