From d505f29e9fdd1c3ac0f72703377f4cbef79140a6 Mon Sep 17 00:00:00 2001 From: Rian Stockbower Date: Fri, 25 Sep 2026 11:15:26 -0400 Subject: [PATCH 1/4] fix: render literal Chocolatey download URLs --- packaging/chocolatey/tools/chocolateyInstall.ps1 | 13 ++++++------- scripts/verify-package-render.sh | 10 ++++------ 2 files changed, 10 insertions(+), 13 deletions(-) diff --git a/packaging/chocolatey/tools/chocolateyInstall.ps1 b/packaging/chocolatey/tools/chocolateyInstall.ps1 index 281cb2ed..85980c2f 100644 --- a/packaging/chocolatey/tools/chocolateyInstall.ps1 +++ b/packaging/chocolatey/tools/chocolateyInstall.ps1 @@ -1,27 +1,26 @@ $ErrorActionPreference = 'Stop' -$version = $env:ChocolateyPackageVersion $toolsDir = Split-Path -Parent $MyInvocation.MyCommand.Definition -# Checksums injected by release workflow - DO NOT EDIT MANUALLY +# URLs and checksums injected by release workflow - DO NOT EDIT MANUALLY +$urlAmd64 = 'URL_AMD64_PLACEHOLDER' +$urlArm64 = 'URL_ARM64_PLACEHOLDER' $checksumAmd64 = 'CHECKSUM_AMD64_PLACEHOLDER' $checksumArm64 = 'CHECKSUM_ARM64_PLACEHOLDER' if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { $arch = 'arm64' + $url = $urlArm64 $checksum = $checksumArm64 } elseif ([Environment]::Is64BitOperatingSystem) { $arch = 'amd64' + $url = $urlAmd64 $checksum = $checksumAmd64 } else { throw "32-bit Windows is not supported. cr requires 64-bit Windows." } -$baseUrl = "https://github.com/open-cli-collective/codereview-cli/releases/download/v${version}" -$zipFile = "cr_v${version}_windows_${arch}.zip" -$url = "${baseUrl}/${zipFile}" - -Write-Host "Installing cr ${version} for Windows ${arch}..." +Write-Host "Installing cr for Windows ${arch}..." Write-Host "URL: ${url}" Write-Host "Checksum (SHA256): ${checksum}" diff --git a/scripts/verify-package-render.sh b/scripts/verify-package-render.sh index e4af2118..449e9784 100755 --- a/scripts/verify-package-render.sh +++ b/scripts/verify-package-render.sh @@ -53,10 +53,8 @@ for kind in deb rpm; do done done -# Winget and Chocolatey keep version/checksum placeholders in source; the shared -# release workflow substitutes them from the real release assets before publish. -# The generated windows archives above prove the archive naming those templates -# reference is rendered by GoReleaser. +# Winget keeps version/checksum placeholders; Chocolatey keeps URL/checksum +# placeholders. The shared release workflow substitutes them before publish. require_grep "winget: { id: OpenCLICollective.codereview-cli, bootstrap: true }" "packaging/identity.yml" require_grep "chocolatey: { id: codereview-cli }" "packaging/identity.yml" @@ -81,8 +79,8 @@ require_grep "cr_v0.0.0_windows_arm64.zip" "$winget_installer" require_file "packaging/chocolatey/codereview-cli.nuspec" require_file "packaging/chocolatey/tools/chocolateyInstall.ps1" require_grep "codereview-cli" "packaging/chocolatey/codereview-cli.nuspec" -require_grep 'releases/download/v${version}' "packaging/chocolatey/tools/chocolateyInstall.ps1" -require_grep 'cr_v${version}_windows_${arch}.zip' "packaging/chocolatey/tools/chocolateyInstall.ps1" +require_grep 'URL_AMD64_PLACEHOLDER' "packaging/chocolatey/tools/chocolateyInstall.ps1" +require_grep 'URL_ARM64_PLACEHOLDER' "packaging/chocolatey/tools/chocolateyInstall.ps1" require_grep 'homebrew-tap-token: ${{ secrets.TAP_GITHUB_TOKEN }}' ".github/workflows/release.yml" require_grep 'chocolatey-api-key: ${{ secrets.CHOCOLATEY_API_KEY }}' ".github/workflows/release.yml" From d6e117c85f167ee6e97e58aa17231f65c98ff536 Mon Sep 17 00:00:00 2001 From: Rian Stockbower Date: Fri, 25 Sep 2026 11:49:19 -0400 Subject: [PATCH 2/4] fix: use static Chocolatey renderer in release workflow --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 845305a2..619f139f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ permissions: jobs: release: - uses: open-cli-collective/.github/.github/workflows/release.yml@b6382514b809d960c6fbdc85745a60c14cde04f1 # shared .github + uses: open-cli-collective/.github/.github/workflows/release.yml@86df1fd5b2f0b0c2e3b2c9b91b40a376d9ceb972 # shared .github with: # tag push is live (false); workflow_dispatch honors the checkbox. Compare # against both true and 'true' because a workflow_dispatch boolean input From ffb4fa358fb0a41f962c811634de647fda5a2e3f Mon Sep 17 00:00:00 2001 From: Rian Stockbower Date: Fri, 25 Sep 2026 11:55:41 -0400 Subject: [PATCH 3/4] docs: describe Chocolatey URL rendering contract --- docs/development.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/development.md b/docs/development.md index 84a4814c..88c2bb91 100644 --- a/docs/development.md +++ b/docs/development.md @@ -182,9 +182,9 @@ shared workflow owns publish mechanics. `open-cli-collective/homebrew-tap` with `TAP_GITHUB_TOKEN`. - Chocolatey: the shared Chocolatey job rewrites `packaging/chocolatey/codereview-cli.nuspec` from version `0.0.0` to the release version - and replaces `CHECKSUM_AMD64_PLACEHOLDER` / - `CHECKSUM_ARM64_PLACEHOLDER` in `chocolateyInstall.ps1` before packing and - pushing. + and replaces `URL_AMD64_PLACEHOLDER`, `URL_ARM64_PLACEHOLDER`, + `CHECKSUM_AMD64_PLACEHOLDER`, and `CHECKSUM_ARM64_PLACEHOLDER` in + `chocolateyInstall.ps1` before packing and pushing. - winget: the shared winget job resolves the release asset URLs/checksums and submits `OpenCLICollective.codereview-cli` with `WINGET_GITHUB_TOKEN`; because this is a first-time package id, `packaging/identity.yml` keeps From 552089d7202940e066d82f2ebf858071cba1d883 Mon Sep 17 00:00:00 2001 From: Rian Stockbower Date: Fri, 25 Sep 2026 12:16:01 -0400 Subject: [PATCH 4/4] fix(chocolatey): pin shared release asset resolver --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 619f139f..7874f7dc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ permissions: jobs: release: - uses: open-cli-collective/.github/.github/workflows/release.yml@86df1fd5b2f0b0c2e3b2c9b91b40a376d9ceb972 # shared .github + uses: open-cli-collective/.github/.github/workflows/release.yml@776a11fe7a86dccb73bccb5dbf3824fe2ec8d4af # shared .github with: # tag push is live (false); workflow_dispatch honors the checkbox. Compare # against both true and 'true' because a workflow_dispatch boolean input