feat: publish native Arch Linux packages

.github/workflows/arch-package.yml

@@ -0,0 +1,91 @@
+name: Arch package
+
+on:
+  pull_request:
+    paths:
+      - .goreleaser.yml
+      - .github/workflows/arch-package.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    runs-on: macos-15
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - package: cpm
+            binary: cpm
+            config: .goreleaser.yml
+            go-mod: go.mod
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: ${{ matrix.go-mod }}
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: v2.18.2
+          args: release --snapshot --clean --skip=before --config ${{ matrix.config }}
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number || 0 }}
+      - name: Verify both Arch architectures were rendered
+        shell: bash
+        run: |
+          set -euo pipefail
+          for arch in amd64 arm64; do
+            packages=(dist/*"${arch}.pkg.tar.zst")
+            test "${#packages[@]}" -eq 1
+            test -f "${packages[0]}"
+          done
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: arch-${{ matrix.package }}
+          path: dist/*.pkg.tar.zst
+          if-no-files-found: error
+
+  install:
+    needs: package
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - package: cpm
+            binary: cpm
+            config: .goreleaser.yml
+            go-mod: go.mod
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: arch-${{ matrix.package }}
+          path: packages
+      - name: Install, verify and remove in Arch Linux
+        env:
+          PACKAGE: ${{ matrix.package }}
+          BINARY: ${{ matrix.binary }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm -e PACKAGE -e BINARY -v "$PWD/packages:/packages:ro" archlinux:base bash -c '
+            set -euo pipefail
+            package=(/packages/*amd64.pkg.tar.zst)
+            test "${#package[@]}" -eq 1
+            pacman -U --noconfirm "${package[0]}"
+            "$BINARY" --version
+            "$BINARY" --help > /tmp/cli-help
+            test -s /tmp/cli-help
+            pacman -Qo "/usr/bin/$BINARY"
+            pacman -Qkk "$PACKAGE"
+            pacman -R --noconfirm "$PACKAGE"
+            test ! -e "/usr/bin/$BINARY"
+            pacman -U --noconfirm "${package[0]}"
+            "$BINARY" --version
+          '

.github/workflows/auto-release.yml

@@ -4,11 +4,14 @@ on:
   push:
     branches:
       - main
-    # Gate 1: Only trigger when Go code actually changes
+    # Gate 1: Release code, version, and packaging changes
     paths:
       - '**.go'
       - 'go.mod'
       - 'go.sum'
+      - 'version.txt'
+      - '.goreleaser.yml'
+      - '.github/workflows/release.yml'
 
 permissions:
   contents: write

.github/workflows/release.yml

@@ -44,3 +44,22 @@ jobs:
           canonical-token: cpm
           tap-repo: open-cli-collective/homebrew-tap
           tap-token: ${{ secrets.TAP_GITHUB_TOKEN }}
+
+  linux-packages:
+    needs: goreleaser
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: Dispatch Linux packages
+        env:
+          GH_TOKEN: ${{ secrets.LINUX_PACKAGES_DISPATCH_TOKEN }}
+          VERSION: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          test -n "$GH_TOKEN"
+          jq -nc --arg version "$VERSION" \
+            '{event_type:"package-release",client_payload:{package:"cpm",version:$version,repo:"open-cli-collective/cpm"}}' \
+            | gh api --method POST repos/open-cli-collective/linux-packages/dispatches --input -
+      - name: Report Linux publication failure
+        if: failure()
+        run: echo 'Linux package dispatch failed; see this job for details.' >> "$GITHUB_STEP_SUMMARY"

.goreleaser.yml

@@ -55,6 +55,22 @@ archives:
       - LICENSE
       - README.md
 
+nfpms:
+  - id: cpm
+    package_name: cpm
+    vendor: Open CLI Collective
+    homepage: https://github.com/open-cli-collective/cpm
+    maintainer: Open CLI Collective <open-cli-collective@users.noreply.github.com>
+    description: TUI for managing Claude Code plugins
+    license: MIT
+    formats: [deb, rpm, archlinux]
+    # Keep tar entry timestamps aligned with pacman integrity metadata.
+    mtime: "{{ .CommitDate }}"
+    bindir: /usr/bin
+    contents:
+      - src: LICENSE
+        dst: /usr/share/licenses/cpm/LICENSE
+
 # Homebrew cask with auto-quarantine removal for unsigned binaries
 homebrew_casks:
   - name: cpm

README.md

@@ -37,6 +37,10 @@ go install github.com/open-cli-collective/cpm/cmd/cpm@latest
 
 Download the latest release from the [releases page](https://github.com/open-cli-collective/cpm/releases/latest).
 
+### Arch Linux / Omarchy
+
+Add the signed [Open CLI Collective pacman repository](https://github.com/open-cli-collective/linux-packages#arch-linux-pacman), then install with `sudo pacman -Syu cpm`. Linux packages publish on new releases.
+
 ## Usage
 
 ```bash