feat: publish native Arch Linux packages

.github/workflows/arch-package.yml

@@ -0,0 +1,64 @@
+name: Arch package
+
+on:
+  pull_request:
+    paths:
+      - .goreleaser.yml
+      - .github/workflows/arch-package.yml
+      - scripts/verify-package-render.sh
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    runs-on: macos-15
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: v2.18.2
+          args: release --snapshot --clean --skip=before
+      - name: Verify rendered packages
+        run: scripts/verify-package-render.sh
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: arch-packages
+          path: dist/*.pkg.tar.zst
+          if-no-files-found: error
+
+  install:
+    needs: package
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: arch-packages
+          path: packages
+      - name: Install, verify and remove in Arch Linux
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm -v "$PWD/packages:/packages:ro" archlinux:base bash -c '
+            set -euo pipefail
+            package=(/packages/*amd64.pkg.tar.zst)
+            test "${#package[@]}" -eq 1
+            pacman -U --noconfirm "${package[0]}"
+            cr --version
+            cr --help > /tmp/cr-help
+            grep -q review /tmp/cr-help
+            pacman -Qo /usr/bin/cr
+            pacman -Qkk cr
+            pacman -R --noconfirm cr
+            test ! -e /usr/bin/cr
+            pacman -U --noconfirm "${package[0]}"
+            cr --version
+          '

.github/workflows/auto-release.yml

@@ -24,6 +24,7 @@ jobs:
   auto-release:
     uses: open-cli-collective/.github/.github/workflows/auto-release.yml@b6382514b809d960c6fbdc85745a60c14cde04f1 # shared .github
     with:
+      release-paths: "**.go,go.mod,go.sum,version.txt,.goreleaser.yml"
       # push is live (false); workflow_dispatch honors the checkbox. Compare
       # against both true and 'true' because a workflow_dispatch boolean input
       # may surface as a real boolean or the string "true" depending on context

.goreleaser.yml

@@ -94,7 +94,10 @@ nfpms:
     formats:
       - deb
       - rpm
+      - archlinux
     bindir: /usr/bin
+    # Whole-second timestamps keep tar entries and pacman MTREE checks aligned.
+    mtime: "{{ .CommitDate }}"
     contents:
       - src: LICENSE
         dst: /usr/share/licenses/cr/LICENSE

README.md

@@ -42,6 +42,10 @@ choco install codereview-cli
 [open-cli-collective/linux-packages](https://github.com/open-cli-collective/linux-packages)
 repository.
 
+### Arch Linux / Omarchy
+
+Add the signed [Open CLI Collective pacman repository](https://github.com/open-cli-collective/linux-packages#arch-linux-pacman) once. Native Arch packages are published with new releases and updated by `sudo pacman -Syu`. Package names are listed in that repository; executable names remain unchanged.
+
 ### Binary Download
 
 Download a release archive from the

docs/development.md

@@ -189,12 +189,12 @@ shared workflow owns publish mechanics.
   submits `OpenCLICollective.codereview-cli` with `WINGET_GITHUB_TOKEN`;
   because this is a first-time package id, `packaging/identity.yml` keeps
   `packages.winget.bootstrap: true` until the package exists upstream.
-- Linux packages: GoReleaser renders `.deb` and `.rpm` artifacts named `cr`;
+- Linux packages: GoReleaser renders `.deb`, `.rpm`, and Arch `.pkg.tar.zst` artifacts named `cr`;
   the shared workflow dispatches `package-release` to
   `open-cli-collective/linux-packages` with `LINUX_PACKAGES_DISPATCH_TOKEN`.
 
 `make snapshot` runs a local GoReleaser snapshot and then
-`scripts/verify-package-render.sh`, which asserts the rendered cask, deb/rpm
+`scripts/verify-package-render.sh`, which asserts the rendered cask, deb/rpm/Arch
 artifacts, native package templates, and release secret wiring match the
 declared package IDs.
 

scripts/verify-package-render.sh

@@ -101,7 +101,7 @@ raise "failure path did not keep refresh warning-only" unless failure.calls.last
 puts "rendered package hook behavior check OK"
 RUBY
 
-for kind in deb rpm; do
+for kind in deb rpm pkg.tar.zst; do
   for arch in amd64 arm64; do
     jq -e --arg kind "$kind" --arg dotted ".$kind" --arg arch "$arch" '
       .[] | select(