From 6b3d4796aae532d4ec82b1a39b093f4c46bfab1a Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:40:55 -0400
Subject: [PATCH 1/7] docs: document native Arch package enrollment and CLI
 inventory

---
 README.md | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index a8f2a484..fb2d4200 100644
--- a/README.md
+++ b/README.md
@@ -44,6 +44,12 @@ curl -fsSL https://open-cli-collective.github.io/linux-packages/keys/gpg.asc \
   -o "$key_file"
 fingerprint=$(gpg --with-colons --import-options show-only --import "$key_file" 2>/dev/null \
   | awk -F: '$1 == "fpr" { print $10; exit }')
+# Check the repository's pinned primary key before trusting it.
+[ "$fingerprint" = "1CB5DA9AA0FC049E7D75966B631EF017ACC6C776" ] || {
+  echo "Unexpected repository signing key" >&2
+  rm -f "$key_file"
+  exit 1
+}
 sudo pacman-key --add "$key_file"
 sudo pacman-key --lsign-key "$fingerprint"
 rm -f "$key_file"
@@ -55,10 +61,17 @@ SigLevel = Required DatabaseOptional
 Server = https://open-cli-collective.github.io/linux-packages/arch/$arch
 EOF
 
-sudo pacman -Syu
-sudo pacman -S google-readonly google-readwrite
+# Packages become available after their release publication finishes.
+sudo pacman -Syu cr slck cfl jtk hspt sfdc nrq cpm spotify-cli retune \
+  google-readonly google-readwrite
 ```
 
+The pacman channel currently contains `google-readonly` and `google-readwrite`.
+The remaining packages above require their Arch-enabled release to finish before
+the combined install command succeeds. After enrollment, `sudo pacman -Syu`
+updates these packages alongside the rest of the system. Repository setup is a
+one-time step; do not append the same repository stanza more than once.
+
 Arch Linux officially supports `x86_64`. The repository also publishes
 `aarch64` packages for compatible Arch Linux ARM systems when source releases
 provide them.
@@ -67,8 +80,13 @@ provide them.
 
 | Package | Description | Source Repo |
 |---------|-------------|-------------|
+| `cr` | Automated pull-request review CLI | [codereview-cli](https://github.com/open-cli-collective/codereview-cli) |
+| `cpm` | TUI for managing Claude Code plugins | [cpm](https://github.com/open-cli-collective/cpm) |
+| `hspt` | HubSpot CLI | [hubspot-cli](https://github.com/open-cli-collective/hubspot-cli) |
+| `spotify-cli` | Spotify CLI (`sptfy`) | [spotify-cli](https://github.com/open-cli-collective/spotify-cli) |
 | `cfl` | Confluence Cloud CLI | [atlassian-cli](https://github.com/open-cli-collective/atlassian-cli) |
-| `google-readonly` | Google read-only CLI (Gmail, Calendar, Contacts) | [google-readonly](https://github.com/open-cli-collective/google-readonly) |
+| `google-readonly` | Google read-only CLI (Gmail, Calendar, Contacts) | [google-cli](https://github.com/open-cli-collective/google-cli) |
+| `google-readwrite` | Google read-write CLI (`grw`) | [google-cli](https://github.com/open-cli-collective/google-cli) |
 | `jtk` | Jira Cloud CLI | [atlassian-cli](https://github.com/open-cli-collective/atlassian-cli) |
 | `nrq` | New Relic CLI | [newrelic-cli](https://github.com/open-cli-collective/newrelic-cli) |
 | `retune` | Desktop music player for local files and Spotify | [Retune](https://github.com/open-cli-collective/Retune) |

From fc815b33612f25e3784a2d29890c2260d8e397e1 Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:44:53 -0400
Subject: [PATCH 2/7] fix: avoid downloading historical packages for repository
 updates

---
 .github/workflows/receive-package.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/receive-package.yml b/.github/workflows/receive-package.yml
index c819e9c2..39daaf3b 100644
--- a/.github/workflows/receive-package.yml
+++ b/.github/workflows/receive-package.yml
@@ -35,7 +35,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          # Only the current repository tree is needed to add/sign packages.
+          # Historical package blobs make full-history fetches very expensive.
+          fetch-depth: 1
 
       - name: Install tools
         run: |

From cb6b7838910504b396fe0ca8c021c9de16757701 Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:46:05 -0400
Subject: [PATCH 3/7] ci: validate signed repository publication workflows

---
 .github/workflows/ci.yml | 29 +++++++++++++++++++++++++++++
 README.md                |  1 +
 2 files changed, 30 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..f731fb0a
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,29 @@
+name: CI
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  workflows:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - name: Validate workflows with checksum-verified Actionlint
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tools=$(mktemp -d)
+          gh release download v1.7.12 --repo rhysd/actionlint \
+            --pattern actionlint_1.7.12_linux_amd64.tar.gz \
+            --pattern actionlint_1.7.12_checksums.txt --dir "$tools"
+          (cd "$tools"; sha256sum -c actionlint_1.7.12_checksums.txt --ignore-missing)
+          tar -xzf "$tools/actionlint_1.7.12_linux_amd64.tar.gz" -C "$tools" actionlint
+          "$tools/actionlint"
diff --git a/README.md b/README.md
index fb2d4200..0830f502 100644
--- a/README.md
+++ b/README.md
@@ -118,6 +118,7 @@ nfpms:
       - deb
       - rpm
       - archlinux
+    mtime: "{{ .CommitDate }}"
     bindir: /usr/bin
     contents:
       - src: LICENSE

From 68164bb07ed76f6ea2568ee5897d6f5a3d7578f1 Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:52:37 -0400
Subject: [PATCH 4/7] fix: quote GitHub environment-file paths in receiver
 steps

---
 .github/workflows/receive-package.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/receive-package.yml b/.github/workflows/receive-package.yml
index 39daaf3b..67e1ae17 100644
--- a/.github/workflows/receive-package.yml
+++ b/.github/workflows/receive-package.yml
@@ -79,7 +79,7 @@ jobs:
 
           # Get the key ID
           KEY_ID=$(gpg --list-secret-keys --keyid-format LONG | grep sec | head -1 | awk '{print $2}' | cut -d'/' -f2)
-          echo "GPG_KEY_ID=$KEY_ID" >> $GITHUB_ENV
+          echo "GPG_KEY_ID=$KEY_ID" >> "$GITHUB_ENV"
 
           # Test signing works
           echo "test" | gpg --batch --sign > /dev/null 2>&1 && echo "GPG signing test passed" || echo "GPG signing test failed"
@@ -203,11 +203,11 @@ jobs:
 
           if git diff --staged --quiet; then
             echo "No changes to commit"
-            echo "HAS_CHANGES=false" >> $GITHUB_ENV
+            echo "HAS_CHANGES=false" >> "$GITHUB_ENV"
           else
             git commit -m "feat: update $PACKAGE to $VERSION"
             git push
-            echo "HAS_CHANGES=true" >> $GITHUB_ENV
+            echo "HAS_CHANGES=true" >> "$GITHUB_ENV"
           fi
 
       - name: Trigger Pages deployment

From fd26d4559860463fb42811a5f08d572a1ed1d5ee Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:55:41 -0400
Subject: [PATCH 5/7] docs: provide a working native install example after cr
 publication

---
 README.md | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 0830f502..b3682fad 100644
--- a/README.md
+++ b/README.md
@@ -61,14 +61,13 @@ SigLevel = Required DatabaseOptional
 Server = https://open-cli-collective.github.io/linux-packages/arch/$arch
 EOF
 
-# Packages become available after their release publication finishes.
-sudo pacman -Syu cr slck cfl jtk hspt sfdc nrq cpm spotify-cli retune \
-  google-readonly google-readwrite
+# Install the package you want; see the inventory below for other names.
+sudo pacman -Syu cr
 ```
 
-The pacman channel currently contains `google-readonly` and `google-readwrite`.
-The remaining packages above require their Arch-enabled release to finish before
-the combined install command succeeds. After enrollment, `sudo pacman -Syu`
+The pacman channel currently contains `cr`, `google-readonly`, and
+`google-readwrite`. Other packages in the inventory require their Arch-enabled
+release publication to finish before installation. After enrollment, `sudo pacman -Syu`
 updates these packages alongside the rest of the system. Repository setup is a
 one-time step; do not append the same repository stanza more than once.
 

From 88d5e8f58486bfad235e05589e60f9d71344e5c3 Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:57:16 -0400
Subject: [PATCH 6/7] fix: preserve queued package releases and fetch current
 repository state

---
 .github/workflows/receive-package.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/receive-package.yml b/.github/workflows/receive-package.yml
index 67e1ae17..8aa8e444 100644
--- a/.github/workflows/receive-package.yml
+++ b/.github/workflows/receive-package.yml
@@ -17,6 +17,8 @@ on:
 
 concurrency:
   group: linux-package-repository-update
+  # Preserve every package dispatch during multi-repository release trains.
+  queue: max
   cancel-in-progress: false
 
 jobs:
@@ -35,6 +37,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
+          # A queued dispatch may carry an older event SHA; fetch the latest
+          # branch after acquiring the concurrency slot to keep pushes current.
+          ref: main
           # Only the current repository tree is needed to add/sign packages.
           # Historical package blobs make full-history fetches very expensive.
           fetch-depth: 1

From 500e949ad38c412826417eb848f3937586efd4b8 Mon Sep 17 00:00:00 2001
From: Rian Stockbower <7378790+rianjs@users.noreply.github.com>
Date: Sun, 4 Oct 2026 17:58:33 -0400
Subject: [PATCH 7/7] ci: account for documented concurrency syntax missing
 from actionlint

---
 .github/workflows/ci.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f731fb0a..ad81285f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,4 +26,6 @@ jobs:
             --pattern actionlint_1.7.12_checksums.txt --dir "$tools"
           (cd "$tools"; sha256sum -c actionlint_1.7.12_checksums.txt --ignore-missing)
           tar -xzf "$tools/actionlint_1.7.12_linux_amd64.tar.gz" -C "$tools" actionlint
-          "$tools/actionlint"
+          # v1.7.12 does not yet recognize GitHub's supported queue property.
+          # Keep this exception narrow until rhysd/actionlint#657 is released.
+          "$tools/actionlint" -ignore 'unexpected key "queue" for "concurrency" section'