fix: update github actions deps

.github/workflows/ci.yml

@@ -10,12 +10,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [self-hosted, macos-14, windows-2022]
+        os: [self-hosted, macos-26, windows-2025]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
-        with: { go-version: "1.25", cache: true }
+        with: { go-version: "1.26", cache: true }
       - run: go vet ./...
       - run: go test ./... -race -cover
 
@@ -26,8 +26,8 @@ jobs:
       - uses: actions/checkout@v6
         with: { fetch-depth: 0 }
       - uses: actions/setup-go@v6
-        with: { go-version: "1.25", cache: true }
+        with: { go-version: "1.26", cache: true }
       - uses: goreleaser/goreleaser-action@v6
         with:
-          version: latest
+          version: "~> v2"
           args: build --snapshot --clean

.github/workflows/release-please.yml

@@ -0,0 +1,26 @@
+name: Release Please
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    name: Create Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Release Please
+        uses: googleapis/release-please-action@v5
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.github/workflows/release.yml

@@ -1,44 +1,45 @@
-name: release
+name: Publish Release Packages
 
 on:
   push:
-    branches: [main]
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to publish, for example v0.1.13
+        required: true
+        type: string
 
 permissions:
   contents: write
-  pull-requests: write
 
 jobs:
-  release-please:
-    runs-on: self-hosted
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
-      version: ${{ steps.release.outputs.version }}
+  goreleaser:
+    name: Publish packages
+    runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v5
-        id: release
+      - name: Checkout
+        uses: actions/checkout@v6
         with:
-          config-file: release-please-config.json
-          manifest-file: .release-please-manifest.json
+          fetch-depth: 0
+          ref: ${{ inputs.tag || github.ref }}
 
-  goreleaser:
-    needs: release-please
-    if: ${{ needs.release-please.outputs.release_created }}
-    runs-on: self-hosted
-    steps:
-      - uses: actions/checkout@v6
-        with: { fetch-depth: 0 }
-      - uses: actions/setup-go@v6
-        with: { go-version: "1.25", cache: true }
-      - uses: goreleaser/goreleaser-action@v6
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.26"
+          cache: true
+
+      - name: Publish release packages
+        uses: goreleaser/goreleaser-action@v6
         with:
-          version: latest
+          version: "~> v2"
           args: release --clean
         env:
           # GITHUB_TOKEN: default per-repo token. Used for the grounds-cli
           # release itself (artifact upload, release-notes update). Auto-
-          # scoped to grounds-cli only — fine.
+          # scoped to grounds-cli only - fine.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # HOMEBREW_TAP_PAT: cross-repo PAT used by the brews + scoops
           # blocks in .goreleaser.yml to push to the homebrew-tap +
@@ -47,23 +48,29 @@ jobs:
           HOMEBREW_TAP_PAT: ${{ secrets.HOMEBREW_TAP_PAT }}
 
   glitchtip-release:
-    # Mark the new release in GlitchTip so the Issues view groups
-    # crashes by `release` (the Sentry release tag the CLI sets via
-    # ldflags equals the goreleaser .Version, which equals
-    # release-please's tag minus the leading `v`). Also associates
-    # the commits in this release so the GlitchTip "Suspect commits"
-    # heuristic has data to work with.
-    #
-    # SENTRY_AUTH_TOKEN secret: created in glitch.grounds.gg ➜
-    # Account ➜ API Tokens with `org:read` + `project:releases`
-    # scopes. Add to repo secrets as SENTRY_AUTH_TOKEN.
-    needs: [release-please, goreleaser]
-    if: ${{ needs.release-please.outputs.release_created }}
-    runs-on: self-hosted
+    name: Mark GlitchTip release
+    needs: goreleaser
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-        with: { fetch-depth: 0 }
-      - uses: getsentry/action-release@v3
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.tag || github.ref }}
+
+      - name: Resolve release version
+        id: version
+        shell: bash
+        run: |
+          if [ -n "${{ inputs.tag }}" ]; then
+            tag_name="${{ inputs.tag }}"
+          else
+            tag_name="${GITHUB_REF#refs/tags/}"
+          fi
+          echo "version=${tag_name#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Mark release in GlitchTip
+        uses: getsentry/action-release@v3
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_ORG: grounds
@@ -73,4 +80,4 @@ jobs:
           # GlitchTip doesn't implement Sentry's `releases deploys`
           # API; skip the `environment` input that triggers it. The
           # release-marker + commit-association still happen.
-          version: ${{ needs.release-please.outputs.version }}
+          version: ${{ steps.version.outputs.version }}

.goreleaser.yml

@@ -47,23 +47,27 @@ nfpms:
     formats: [deb, rpm]
     bindir: /usr/bin
 
-brews:
+homebrew_casks:
   - repository:
       owner: groundsgg
       name: homebrew-tap
       # Sibling-repo push needs cross-repo write — use the PAT
       # exposed as HOMEBREW_TAP_PAT in the workflow.
       token: "{{ .Env.HOMEBREW_TAP_PAT }}"
     name: grounds
+    binaries:
+      - grounds
+    url:
+      verified: github.com/groundsgg/grounds-cli
     homepage: https://grounds.gg
     description: Grounds Internal Developer Platform CLI
     license: Apache-2.0
-    # Cask was the old setup; goreleaser wrote 0.1.10+ into Casks/
-    # while the top-level Formula (where `brew install grounds/tap/grounds`
-    # looks) stuck at 0.1.7. Formula is the conventional shape for a
-    # CLI binary and lets users keep the formula install path.
-    test: |
-      assert_match "grounds version", shell_output("#{bin}/grounds version")
+    hooks:
+      post:
+        install: |
+          if OS.mac?
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/grounds"]
+          end
 
 scoops:
   - repository:

README.md

@@ -7,7 +7,7 @@ Drives the Grounds Internal Developer Platform from your terminal.
 ### macOS / Linux (Homebrew)
 
 ```bash
-brew install groundsgg/tap/grounds
+brew install --cask groundsgg/tap/grounds
 ```
 
 ### Windows (Scoop)

go.mod

@@ -1,6 +1,6 @@
 module github.com/groundsgg/grounds-cli
 
-go 1.25.0
+go 1.26
 
 require (
 	github.com/charmbracelet/huh v1.0.0