From e0c59b3b6efd1a251977ed28856817b6e20ab0df Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:07:15 -0400
Subject: [PATCH 1/4] feat: publish native Arch Linux packages

---
 .github/workflows/auto-release.yml | 1 +
 .goreleaser.yml                    | 1 +
 README.md                          | 4 ++++
 docs/development.md                | 4 ++--
 scripts/verify-package-render.sh   | 2 +-
 5 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index 88d33504..48ce3ca3 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -24,6 +24,7 @@ jobs:
   auto-release:
     uses: open-cli-collective/.github/.github/workflows/auto-release.yml@b6382514b809d960c6fbdc85745a60c14cde04f1 # shared .github
     with:
+      release-paths: "**.go,go.mod,go.sum,version.txt,.goreleaser.yml"
       # push is live (false); workflow_dispatch honors the checkbox. Compare
       # against both true and 'true' because a workflow_dispatch boolean input
       # may surface as a real boolean or the string "true" depending on context
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 35a80fab..1c38d59c 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -94,6 +94,7 @@ nfpms:
     formats:
       - deb
       - rpm
+      - archlinux
     bindir: /usr/bin
     contents:
       - src: LICENSE
diff --git a/README.md b/README.md
index 007e8518..fcbda5e5 100644
--- a/README.md
+++ b/README.md
@@ -1608,3 +1608,7 @@ between `internal/pipeline`, `internal/reviewrun`, `internal/reviewplan`, and
 `internal/outbox`.
 
 See [docs/development.md](docs/development.md) for local development notes.
+
+### Arch Linux / Omarchy
+
+Add the signed [Open CLI Collective pacman repository](https://github.com/open-cli-collective/linux-packages#arch-linux-pacman) once. Native Arch packages are published with new releases and updated by `sudo pacman -Syu`. Package names are listed in that repository; executable names remain unchanged.
diff --git a/docs/development.md b/docs/development.md
index 84a4814c..cc0c2027 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -189,12 +189,12 @@ shared workflow owns publish mechanics.
   submits `OpenCLICollective.codereview-cli` with `WINGET_GITHUB_TOKEN`;
   because this is a first-time package id, `packaging/identity.yml` keeps
   `packages.winget.bootstrap: true` until the package exists upstream.
-- Linux packages: GoReleaser renders `.deb` and `.rpm` artifacts named `cr`;
+- Linux packages: GoReleaser renders `.deb`, `.rpm`, and Arch `.pkg.tar.zst` artifacts named `cr`;
   the shared workflow dispatches `package-release` to
   `open-cli-collective/linux-packages` with `LINUX_PACKAGES_DISPATCH_TOKEN`.
 
 `make snapshot` runs a local GoReleaser snapshot and then
-`scripts/verify-package-render.sh`, which asserts the rendered cask, deb/rpm
+`scripts/verify-package-render.sh`, which asserts the rendered cask, deb/rpm/Arch
 artifacts, native package templates, and release secret wiring match the
 declared package IDs.
 
diff --git a/scripts/verify-package-render.sh b/scripts/verify-package-render.sh
index 9230425e..b5e2762f 100755
--- a/scripts/verify-package-render.sh
+++ b/scripts/verify-package-render.sh
@@ -101,7 +101,7 @@ raise "failure path did not keep refresh warning-only" unless failure.calls.last
 puts "rendered package hook behavior check OK"
 RUBY
 
-for kind in deb rpm; do
+for kind in deb rpm pkg.tar.zst; do
   for arch in amd64 arm64; do
     jq -e --arg kind "$kind" --arg dotted ".$kind" --arg arch "$arch" '
       .[] | select(

From 0770a80bbae6460732a36bd40a9ff55f915c5238 Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:09:22 -0400
Subject: [PATCH 2/4] test: verify rendered packages install on Arch Linux

---
 .github/workflows/arch-package.yml | 64 ++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 .github/workflows/arch-package.yml

diff --git a/.github/workflows/arch-package.yml b/.github/workflows/arch-package.yml
new file mode 100644
index 00000000..8db1ccdd
--- /dev/null
+++ b/.github/workflows/arch-package.yml
@@ -0,0 +1,64 @@
+name: Arch package
+
+on:
+  pull_request:
+    paths:
+      - .goreleaser.yml
+      - .github/workflows/arch-package.yml
+      - scripts/verify-package-render.sh
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    runs-on: macos-15
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: v2.18.2
+          args: release --snapshot --clean --skip=before
+      - name: Verify rendered packages
+        run: scripts/verify-package-render.sh
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: arch-packages
+          path: dist/*.pkg.tar.zst
+          if-no-files-found: error
+
+  install:
+    needs: package
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: arch-packages
+          path: packages
+      - name: Install, verify and remove in Arch Linux
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm -v "$PWD/packages:/packages:ro" archlinux:base bash -c '
+            set -euo pipefail
+            package=(/packages/*amd64.pkg.tar.zst)
+            test "${#package[@]}" -eq 1
+            pacman -U --noconfirm "${package[0]}"
+            cr --version
+            cr --help > /tmp/cr-help
+            grep -q review /tmp/cr-help
+            pacman -Qo /usr/bin/cr
+            pacman -Qkk cr
+            pacman -R --noconfirm cr
+            test ! -e /usr/bin/cr
+            pacman -U --noconfirm "${package[0]}"
+            cr --version
+          '

From 3acde12f84985eb15b2b4f64f8b9bfbae428eed6 Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:13:53 -0400
Subject: [PATCH 3/4] fix: align native package timestamps with integrity
 metadata

---
 .goreleaser.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 1c38d59c..c11a9fbd 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -96,6 +96,8 @@ nfpms:
       - rpm
       - archlinux
     bindir: /usr/bin
+    # Whole-second timestamps keep tar entries and pacman MTREE checks aligned.
+    mtime: "{{ .CommitDate }}"
     contents:
       - src: LICENSE
         dst: /usr/share/licenses/cr/LICENSE

From 04ffb46b7d90e97325ed3e753f7489adcc150a6e Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:30:00 -0400
Subject: [PATCH 4/4] docs: place Arch installation alongside other package
 channels

---
 README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index fcbda5e5..9b391c71 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,10 @@ choco install codereview-cli
 [open-cli-collective/linux-packages](https://github.com/open-cli-collective/linux-packages)
 repository.
 
+### Arch Linux / Omarchy
+
+Add the signed [Open CLI Collective pacman repository](https://github.com/open-cli-collective/linux-packages#arch-linux-pacman) once. Native Arch packages are published with new releases and updated by `sudo pacman -Syu`. Package names are listed in that repository; executable names remain unchanged.
+
 ### Binary Download
 
 Download a release archive from the
@@ -1608,7 +1612,3 @@ between `internal/pipeline`, `internal/reviewrun`, `internal/reviewplan`, and
 `internal/outbox`.
 
 See [docs/development.md](docs/development.md) for local development notes.
-
-### Arch Linux / Omarchy
-
-Add the signed [Open CLI Collective pacman repository](https://github.com/open-cli-collective/linux-packages#arch-linux-pacman) once. Native Arch packages are published with new releases and updated by `sudo pacman -Syu`. Package names are listed in that repository; executable names remain unchanged.