Thanks for fixing the brew style compliance issues. The switch to quoted heredoc with explicit sed substitution is a good maintainability improvement.

One minor suggestion: Consider adding shell escaping to the sed substitution for better robustness against special characters:

# Substitute shell variables into the generated cask
sed -i "s|\\${VERSION}|${VERSION}|g" cog.rb
sed -i "s|\\${SHA_ARM}|${SHA_ARM}|g" cog.rb
sed -i "s|\\${SHA_X86}|${SHA_X86}|g" cog.rb
sed -i "s|\\${BASE_URL}|${BASE_URL//\\/\\\\/}|g" cog.rb

The additional escaping ensures the literal ${VAR} pattern is matched even if shell expansion occurs unexpectedly. The BASE_URL escaping handles forward slashes in URLs more safely. However, this is optional since the inputs are controlled in this workflow context.

Posted a suggestion about improving the sed variable substitution robustness. The current implementation is functional since inputs are controlled, but the escaping would make it more defensive against edge cases. Otherwise LGTM - the changes properly address all five brew style compliance issues mentioned in the PR description.

github run

I'm Bonk, and I've done a quick review of your PR.

This PR fixes the Homebrew cask generation workflow to comply with brew style and brew audit checks, eliminating the need for manual fixes on generated PRs.

The changes properly address all the style and audit issues mentioned. The switch to a quoted heredoc with explicit sed substitution is a clean approach that makes the template readable while avoiding shell expansion issues.

One small suggestion for additional robustness:

# Substitute shell variables into the generated cask.
# Only version and sha256 need substitution — URLs use Ruby #{version}
# interpolation which Homebrew evaluates at install time.
sed -i "s|\\\${VERSION}|${VERSION}|g" cog.rb
sed -i "s|\\\${SHA_ARM}|${SHA_ARM}|g" cog.rb
sed -i "s|\\\${SHA_X86}|${SHA_X86}|g" cog.rb

The extra backslash ensures the literal ${VAR} pattern is matched even in edge cases. However, since the inputs are controlled (validated tag format and extracted checksums), the current implementation is functionally correct.

LGTM

github run