Fix deprecated Homebrew cask DSL usage

[André Silva (askpt)]

Description

Homebrew 6.x reports deprecation warnings for the Aspire cask because it uses the legacy verified: URL parameter and postflight stanza. This updates the generated cask template to use Homebrew's default URL verification behavior and postflight_steps/write_file, so brew update and cask validation no longer emit those warnings.

The Homebrew validation scripts, workflow documentation, and regression tests are updated to use the current brew audit arguments without the removed --signing and --no-signing flags. Dogfood URL rewriting remains compatible with the updated one-line URL stanza.

Validation completed:

• brew style --cask passed.
• brew test-bot --only-tap-syntax passed.
• brew audit --cask passed against the generated cask.
• Targeted Homebrew acquisition tests passed.
• Shell syntax and git diff --check passed.

Fixes # (issue)

Notes

Output from terminal

Warning: Calling the `verified` parameter in the `url` stanza is deprecated! Use the default URL verification behaviour instead.
Please report this issue to the microsoft/homebrew-aspire tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
  /opt/homebrew/Library/Taps/microsoft/homebrew-aspire/Casks/a/aspire.rb:8

Warning: Calling `postflight` is deprecated! Use `postflight_steps` instead.
Please report this issue to the microsoft/homebrew-aspire tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
  /opt/homebrew/Library/Taps/microsoft/homebrew-aspire/Casks/a/aspire.rb:24

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19965

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19965"

[Copilot]

🟢 Approval recommended

The changes consistently adopt supported Homebrew APIs, preserve validation behavior, and include focused regression coverage.

Pull request overview

Updates Homebrew cask generation and validation for Homebrew 6.x compatibility.

Changes:

• Replaces deprecated verified: and postflight DSL usage.
• Removes obsolete signing audit flags.
• Updates tests and documentation accordingly.

File summaries

File	Description
eng/homebrew/aspire.rb.template	Uses current cask DSL.
eng/homebrew/dogfood.sh	Simplifies one-line URL rewriting.
eng/homebrew/validate-cask-artifact.sh	Removes obsolete audit flags.
eng/homebrew/README.md	Updates validation documentation.
docs/release-process.md	Updates release audit commands.
.github/workflows/homebrew-validate-release.yml	Corrects workflow documentation.
tests/Aspire.Acquisition.Tests/Scripts/PRScriptInstallerModeTests.cs	Adds regression assertions for generated DSL and audit arguments.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[James Newton-King (JamesNK)]

Added follow-up commit be34a06 to preserve release-binary signing validation.

During a security-focused review, I found that current Homebrew disables the --signing switch and skips audit_signing automatically for casks installed from non-official taps. Because our validation uses local/aspire, changing the command to brew audit --cask --online would otherwise stop checking the release binary's Apple signature/notarization.

The follow-up now:

• Locates the installed Caskroom aspire binary in LiveRelease mode.
• Runs codesign --verify -R=notarized --check-notarization against that binary.
• Fails validation and invokes the existing uninstall cleanup when signing verification fails.
• Adds regression coverage for invocation and failure cleanup.
• Updates the workflow and release documentation to describe the explicit notarization gate.

Local validation: Git Bash syntax check passed, Aspire.Acquisition.Tests builds successfully, and git diff --check passed. The affected Bash tests are platform-skipped on this Windows host and will run on the PR's Ubuntu/macOS CI lanes.

[github-actions]

🔍 CI Failure Analysis: Transient Infrastructure Failure

The CI build failed due to transient infrastructure issues.

Failed jobs:

• Tests / No-package tests (regular, Aspire.Dashboard.Tests, Dashboard, Dashboard, tests/Aspire.Dashboard.T... / Dashboard (windows-latest) — Job failed at the 'Build test project' step with a generic 'Process completed with exit code 1' annotation and no retrievable job logs. The PR only changes Homebrew release scripts, docs, and an Acquisition test file (tests/Aspire.Acquisition.Tests/Scripts/PRScriptInstallerModeTests.cs), none of which touch Aspire.Dashboard.Tests or the Dashboard project, so the build failure cannot be attributed to the PR's changes. This matches a known recurring pattern of unrelated 'Build test project' jobs failing with a generic exit code 1 across multiple projects (Hosting.RemoteHost, Hosting.Azure, Hosting.Azure.Kubernetes, Playground, Dashboard) with logs unavailable, tracked under issue [CI Failure] Multiple unrelated 'Build test project' jobs (Hosting.Azure, Hosting.Azure.Kubernetes, Playground) fail with generic exit code 1 #19838. (transient-infra)

If a rerun was not already requested automatically, visit the workflow run page to rerun the failed jobs manually.

[Jose Perez Rodriguez (joperezr)]

/backport to release/13.5

[github-actions]

Started backporting to release/13.5 (link to workflow run)

[aspire-repo-bot]

Jose Perez Rodriguez (@joperezr) backporting to release/13.5 failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Fix deprecated Homebrew cask DSL usage
Using index info to reconstruct a base tree...
A	.github/workflows/homebrew-validate-release.yml
M	docs/release-process.md
M	eng/homebrew/README.md
M	eng/homebrew/validate-cask-artifact.sh
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): .github/workflows/homebrew-validate-release.yml deleted in HEAD and modified in Fix deprecated Homebrew cask DSL usage.  Version Fix deprecated Homebrew cask DSL usage of .github/workflows/homebrew-validate-release.yml left in tree.
Auto-merging docs/release-process.md
CONFLICT (content): Merge conflict in docs/release-process.md
Auto-merging eng/homebrew/README.md
CONFLICT (content): Merge conflict in eng/homebrew/README.md
Auto-merging eng/homebrew/validate-cask-artifact.sh
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Fix deprecated Homebrew cask DSL usage
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output