Make the Homebrew cask generator arm64-only to match the Intel-macOS drop #2171

Problem

#2169 dropped Intel (x86_64) macOS from release CI, making Apple Silicon the only supported macOS target. Most of the distribution surface already reflects that decision, but scripts/update-homebrew-cask.ts still carries a full Intel code path that can no longer be exercised.

This is cleanup, not a live defect. The generator already degrades correctly: resolveArchDigests() treats a missing architecture as non-fatal, and renderCask() falls through to its single-architecture branch, emitting depends_on arch: :arm64 and no Intel URL. Confirmed against the published tap — Casks/nodespace.rb is arm64-only today, correctly documented, and brew install --cask nodespace is not broken.

The cost is dead code that reads as if Intel were still supported, and a two-architecture rendering branch that is now unreachable and untestable against any real release.

Current state (verified 2026-08-19)

Already consistent with #2169 — no action needed:

• scripts/release.ts — release-notes table dropped the Intel DMG row and the stale "Intel Mac Support" changelog entry (fixed in Drop Intel (x86_64) macOS from release CI #2169)
• scripts/publish-install-script.ts — x86_64-apple-darwin is deliberately excluded from the target list, with a comment saying so
• homebrew-nodespace Casks/nodespace.rb — published cask is arm64-only, depends_on arch: :arm64, with a platform-support note

Still carrying Intel:

• scripts/update-homebrew-cask.ts
  • ArchDigest.arch: "arm" | "intel"
  • ARCH_SUFFIX: Record<"arm" | "intel", string> = { arm: "aarch64", intel: "x64" }
  • ArchDigestResult.intel?
  • resolveArchDigests() builds a wanted map including the Intel .dmg and loops both architectures — so every run downloads-or-misses an asset CI no longer produces, and reports it in missing, printing a ⚠ missing release assets warning on every release
  • renderCask()'s two-architecture branch emitting on_arm/on_intel, plus the Intel half of archNote
• scripts/update-homebrew-cask.test.ts — a test asserting the on_arm/on_intel both-architectures rendering, and intelDigest fixtures

Fix direction

Make the generator arm64-only, matching the decision rather than tolerating its absence:

• Collapse the arch union to arm; replace ARCH_SUFFIX with a single aarch64 constant
• resolveArchDigests() resolves only the Apple Silicon .dmg. A missing arm asset should be a hard error (there is no other architecture to fall back to), not a warning
• renderCask() keeps one rendering path — top-level url/sha256 plus depends_on arch: :arm64 — and drops the on_arm/on_intel branch
• Update the tests: delete the both-architectures case and the Intel fixtures; keep coverage that the rendered cask pins arm64 and contains no x64 URL
• Carry the rationale in a comment, as publish-install-script.ts and the published cask already do: Apple Silicon is the only supported target because x86_64 macOS artifacts cannot be tested, and this is reversible

The eliminated warning is a side benefit: today every release prints ⚠ missing release assets ... NodeSpace_<v>_x64.dmg, which is noise that trains operators to ignore that warning line.

Also in scope: correct the file's stale header comment

scripts/update-homebrew-cask.ts's header docblock still describes the script as not yet wired into CI, which is no longer true and actively misleads anyone reading it (it misled a review of this exact area). Since this issue already edits the file, fix the comment here rather than filing separately.

Two stale claims:

1. "a PAT ... set as a repo secret once this is wired into the release flow"

   HOMEBREW_TAP_TOKEN is set as a repo secret (added 2026-08-19).

2. "this script is a natural sibling job there, or a manual step run right after bun run release:watch reports the build finished, until it is wired into CI directly."

   It is wired in. release.yml has a sync-homebrew-cask job that runs --push on the release event with HOMEBREW_TAP_TOKEN in its env, gated on build-tauri-macos-arm (deliberately not on build-tauri, so a Windows failure cannot block the cask sync), with a notify-failure job that opens an issue if it fails. homebrew-drift-check.yml is a scheduled backstop.

Rewrite the "Where this hooks in" paragraph to describe the actual wiring and point at the sync-homebrew-cask job, so the file documents what happens rather than what was once planned. The --push/HOMEBREW_TAP_TOKEN usage lines above it stay accurate and can remain.

Comment-only — no behavior change.

Non-goals

• No change to release.ts, publish-install-script.ts, or the published cask — all already correct
• Not re-litigating Drop Intel (x86_64) macOS from release CI #2169. Re-adding an architecture later means restoring a suffix map and a rendering branch; the comment should say so

Acceptance criteria

• scripts/update-homebrew-cask.ts has no intel / x64 code path
• A missing Apple Silicon .dmg fails loudly rather than rendering a cask with no URL
• No ⚠ missing release assets warning on a normal arm64-only release
• renderCask() output is byte-identical to the currently published Casks/nodespace.rb for v0.2.0 (pure refactor — no behavior change to the artifact)
• Tests updated; both-architectures test and Intel fixtures removed; bun run test:scripts passes
• Comment records why Apple Silicon is the only target and what re-adding one would involve
• Header docblock no longer claims the script is unwired/manual; it describes the sync-homebrew-cask job and the already-set HOMEBREW_TAP_TOKEN secret

Related

• Drop Intel (x86_64) macOS from release CI #2169 — dropped Intel from release CI (the decision this aligns to)
• Automate Homebrew tap sync + drift guard #2157 — added the cask generator, which predates that decision