fix: streamline native package publication and document installation

.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  workflows:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - name: Validate workflows with checksum-verified Actionlint
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tools=$(mktemp -d)
+          gh release download v1.7.12 --repo rhysd/actionlint \
+            --pattern actionlint_1.7.12_linux_amd64.tar.gz \
+            --pattern actionlint_1.7.12_checksums.txt --dir "$tools"
+          (cd "$tools"; sha256sum -c actionlint_1.7.12_checksums.txt --ignore-missing)
+          tar -xzf "$tools/actionlint_1.7.12_linux_amd64.tar.gz" -C "$tools" actionlint
+          # v1.7.12 does not yet recognize GitHub's supported queue property.
+          # Keep this exception narrow until rhysd/actionlint#657 is released.
+          "$tools/actionlint" -ignore 'unexpected key "queue" for "concurrency" section'

.github/workflows/receive-package.yml

@@ -17,6 +17,8 @@ on:
 
 concurrency:
   group: linux-package-repository-update
+  # Preserve every package dispatch during multi-repository release trains.
+  queue: max
   cancel-in-progress: false
 
 jobs:
@@ -35,7 +37,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          # A queued dispatch may carry an older event SHA; fetch the latest
+          # branch after acquiring the concurrency slot to keep pushes current.
+          ref: main
+          # Only the current repository tree is needed to add/sign packages.
+          # Historical package blobs make full-history fetches very expensive.
+          fetch-depth: 1
 
       - name: Install tools
         run: |
@@ -77,7 +84,7 @@ jobs:
 
           # Get the key ID
           KEY_ID=$(gpg --list-secret-keys --keyid-format LONG | grep sec | head -1 | awk '{print $2}' | cut -d'/' -f2)
-          echo "GPG_KEY_ID=$KEY_ID" >> $GITHUB_ENV
+          echo "GPG_KEY_ID=$KEY_ID" >> "$GITHUB_ENV"
 
           # Test signing works
           echo "test" | gpg --batch --sign > /dev/null 2>&1 && echo "GPG signing test passed" || echo "GPG signing test failed"
@@ -201,11 +208,11 @@ jobs:
 
           if git diff --staged --quiet; then
             echo "No changes to commit"
-            echo "HAS_CHANGES=false" >> $GITHUB_ENV
+            echo "HAS_CHANGES=false" >> "$GITHUB_ENV"
           else
             git commit -m "feat: update $PACKAGE to $VERSION"
             git push
-            echo "HAS_CHANGES=true" >> $GITHUB_ENV
+            echo "HAS_CHANGES=true" >> "$GITHUB_ENV"
           fi
 
       - name: Trigger Pages deployment

README.md

@@ -44,6 +44,12 @@ curl -fsSL https://open-cli-collective.github.io/linux-packages/keys/gpg.asc \
   -o "$key_file"
 fingerprint=$(gpg --with-colons --import-options show-only --import "$key_file" 2>/dev/null \
   | awk -F: '$1 == "fpr" { print $10; exit }')
+# Check the repository's pinned primary key before trusting it.
+[ "$fingerprint" = "1CB5DA9AA0FC049E7D75966B631EF017ACC6C776" ] || {
+  echo "Unexpected repository signing key" >&2
+  rm -f "$key_file"
+  exit 1
+}
 sudo pacman-key --add "$key_file"
 sudo pacman-key --lsign-key "$fingerprint"
 rm -f "$key_file"
@@ -55,10 +61,16 @@ SigLevel = Required DatabaseOptional
 Server = https://open-cli-collective.github.io/linux-packages/arch/$arch
 EOF
 
-sudo pacman -Syu
-sudo pacman -S google-readonly google-readwrite
+# Install the package you want; see the inventory below for other names.
+sudo pacman -Syu cr
 ```
 
+The pacman channel currently contains `cr`, `google-readonly`, and
+`google-readwrite`. Other packages in the inventory require their Arch-enabled
+release publication to finish before installation. After enrollment, `sudo pacman -Syu`
+updates these packages alongside the rest of the system. Repository setup is a
+one-time step; do not append the same repository stanza more than once.
+
 Arch Linux officially supports `x86_64`. The repository also publishes
 `aarch64` packages for compatible Arch Linux ARM systems when source releases
 provide them.
@@ -67,8 +79,13 @@ provide them.
 
 | Package | Description | Source Repo |
 |---------|-------------|-------------|
+| `cr` | Automated pull-request review CLI | [codereview-cli](https://github.com/open-cli-collective/codereview-cli) |
+| `cpm` | TUI for managing Claude Code plugins | [cpm](https://github.com/open-cli-collective/cpm) |
+| `hspt` | HubSpot CLI | [hubspot-cli](https://github.com/open-cli-collective/hubspot-cli) |
+| `spotify-cli` | Spotify CLI (`sptfy`) | [spotify-cli](https://github.com/open-cli-collective/spotify-cli) |
 | `cfl` | Confluence Cloud CLI | [atlassian-cli](https://github.com/open-cli-collective/atlassian-cli) |
-| `google-readonly` | Google read-only CLI (Gmail, Calendar, Contacts) | [google-readonly](https://github.com/open-cli-collective/google-readonly) |
+| `google-readonly` | Google read-only CLI (Gmail, Calendar, Contacts) | [google-cli](https://github.com/open-cli-collective/google-cli) |
+| `google-readwrite` | Google read-write CLI (`grw`) | [google-cli](https://github.com/open-cli-collective/google-cli) |
 | `jtk` | Jira Cloud CLI | [atlassian-cli](https://github.com/open-cli-collective/atlassian-cli) |
 | `nrq` | New Relic CLI | [newrelic-cli](https://github.com/open-cli-collective/newrelic-cli) |
 | `retune` | Desktop music player for local files and Spotify | [Retune](https://github.com/open-cli-collective/Retune) |
@@ -100,6 +117,7 @@ nfpms:
       - deb
       - rpm
       - archlinux
+    mtime: "{{ .CommitDate }}"
     bindir: /usr/bin
     contents:
       - src: LICENSE