From fb32843b7203f5c595e6dac7c877db21eb2d8a11 Mon Sep 17 00:00:00 2001
From: Matt Peter <mpeter@gmail.com>
Date: Sat, 22 Aug 2026 00:28:22 -0400
Subject: [PATCH] fix(release): patch the correct stanza's sha256 when updating
 darwin cask

The cask template puts each stanza's sha256 line before its url line,
so scanning forward from the darwin_arm64 marker for the next sha256
grabbed the following stanza's (linux_amd64) line instead of darwin's
own. v0.5.0's published cask has the signed darwin checksum sitting on
the linux_amd64 line, and darwin still carries its stale unsigned hash.
---
 .github/workflows/release.yml | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6e9ac0e..f0c9a3e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -264,13 +264,23 @@ jobs:
             exit 1
           fi
 
+          # The cask puts each stanza's `sha256` line *before* its `url`
+          # line, so the darwin_arm64 marker is only seen after its own
+          # sha256 line has already gone by. Track the most recently seen
+          # sha256 line number and patch *that* one when the marker hits,
+          # instead of scanning forward into the next stanza's sha256.
           awk -v arm64="$ARM64_SHA" '
-            /darwin_arm64/ { found_arm64=1 }
-            /sha256/ && found_arm64 {
-              sub(/sha256 "[^"]*"/, "sha256 \"" arm64 "\"")
-              found_arm64=0
+            { lines[NR] = $0 }
+            /sha256/ { sha_line = NR }
+            /darwin_arm64/ { darwin_sha_line = sha_line }
+            END {
+              for (i = 1; i <= NR; i++) {
+                if (i == darwin_sha_line) {
+                  sub(/sha256 "[^"]*"/, "sha256 \"" arm64 "\"", lines[i])
+                }
+                print lines[i]
+              }
             }
-            { print }
           ' "$CASK_FILE" > "${CASK_FILE}.patched"
           mv "${CASK_FILE}.patched" "$CASK_FILE"