KofTwentyTwo/AppKit
2
0 Fork 0
Code Issues 22 Pull Requests 4 Actions Packages Projects Releases 1 Wiki Activity

feat(template): add optional distribution presets for gclo parity #19

New Issue
Open
opened 2026-10-10 16:58:49 +00:00 by KofTwentyTwo · 2 comments
KofTwentyTwo commented 2026-10-10 16:58:49 +00:00 (Migrated from github.com)
Copy link
Copy source

Problem

gclo supports Scoop/Chocolatey and optional winget publication; the starter only carries optional winget. These are optional distribution features, not mandatory core runtime features.

Acceptance criteria

Provide explicitly optional, documented distribution presets with correct generated app identities and stable-only rules; validate generated manifests and packaging; keep secrets scoped to release environments; verify selected integrations before claiming readiness.

Scope

Starter distribution templates.

This issue is part of the user-requested AppKit readiness remediation. Local work is not completion until the applicable published/runtime state and checks are verified. Substantial AI assistance: Codex.

## Problem gclo supports Scoop/Chocolatey and optional winget publication; the starter only carries optional winget. These are optional distribution features, not mandatory core runtime features. ## Acceptance criteria Provide explicitly optional, documented distribution presets with correct generated app identities and stable-only rules; validate generated manifests and packaging; keep secrets scoped to release environments; verify selected integrations before claiming readiness. ## Scope Starter distribution templates. This issue is part of the user-requested AppKit readiness remediation. Local work is not completion until the applicable published/runtime state and checks are verified. Substantial AI assistance: Codex.
KofTwentyTwo commented 2026-10-10 20:09:18 +00:00 (Migrated from github.com)
Copy link
Copy source

Optional distribution presets implemented in signed local starter commit 53eecfc8d54b8f51cda1ba11595c596430fc6f69 (not pushed).

  • Stable-only Scoop/Chocolatey generation for CLI or GUI portable releases; actual final-byte SHA256, validated archive identity/layout and traversal rejection; correct generated package IDs and metadata.
  • Opt-in protected release job verifies ZIP checksum and GitHub provenance, generates manifests, and packs candidates for review. No feed is updated automatically. GUI-only projects explicitly reject CLI distribution selection.
  • winget remains optional/stable-only; configured missing tokens now fail. The pinned v1.12.13.0 client's TokenHelper was inspected: WINGET_CREATE_GITHUB_TOKEN is supported, so credentials now stay in the job environment instead of argv.
  • Documentation explains manager-owned portable upgrades, selected-feed setup and disposable installation tests; threat model updated.

Validation: 24 combined Pester tests pass (7 distribution, 13 setup, 4 coverage), including execution of the generated Chocolatey installation callback with a download test double and helper-shim exclusions. PowerShell/workflow/security/documentation lint and all hooks pass. Both presets generate from provenance-verified published gclo 1.0.1 CLI and portable ZIPs and pass the installed official Scoop schema. Fresh packed CLI/no-CLI templates substitute owner/app/executable identities correctly.

Remaining: no Chocolatey feed/package publication or disposable real package-manager install/upgrade/uninstall has been performed; hosted candidate-job/choco-pack verification is pending. Presets are deliberately optional; source generation is not a live-feed readiness claim. Issue stays open for selected-integration acceptance. Substantial AI assistance: Codex (GPT-6).

Optional distribution presets implemented in signed local starter commit `53eecfc8d54b8f51cda1ba11595c596430fc6f69` (not pushed). - Stable-only Scoop/Chocolatey generation for CLI or GUI portable releases; actual final-byte SHA256, validated archive identity/layout and traversal rejection; correct generated package IDs and metadata. - Opt-in protected release job verifies ZIP checksum and GitHub provenance, generates manifests, and packs candidates for review. No feed is updated automatically. GUI-only projects explicitly reject CLI distribution selection. - winget remains optional/stable-only; configured missing tokens now fail. The pinned v1.12.13.0 client's TokenHelper was inspected: WINGET_CREATE_GITHUB_TOKEN is supported, so credentials now stay in the job environment instead of argv. - Documentation explains manager-owned portable upgrades, selected-feed setup and disposable installation tests; threat model updated. Validation: 24 combined Pester tests pass (7 distribution, 13 setup, 4 coverage), including execution of the generated Chocolatey installation callback with a download test double and helper-shim exclusions. PowerShell/workflow/security/documentation lint and all hooks pass. Both presets generate from provenance-verified published gclo 1.0.1 CLI and portable ZIPs and pass the installed official Scoop schema. Fresh packed CLI/no-CLI templates substitute owner/app/executable identities correctly. Remaining: no Chocolatey feed/package publication or disposable real package-manager install/upgrade/uninstall has been performed; hosted candidate-job/choco-pack verification is pending. Presets are deliberately optional; source generation is not a live-feed readiness claim. Issue stays open for selected-integration acceptance. Substantial AI assistance: Codex (GPT-6).
KofTwentyTwo commented 2026-10-10 20:57:45 +00:00 (Migrated from github.com)
Copy link
Copy source

Corrected portable distribution guidance in locally signed starter commit 90af2f7: a complete Velopack portable bundle with its manifest/updater supports updates. A .portable marker does not disable them; loose publish output differs. The generator's Scoop notes now recommend package-manager upgrades and disabling automatic startup checks to avoid mixing updater ownership.

This is guidance, not an enforced runtime disable for package-manager installations. Feed installation/publication acceptance remains pending. No feeds or public packages were changed.

Corrected portable distribution guidance in locally signed starter commit `90af2f7`: a complete Velopack portable bundle with its manifest/updater supports updates. A `.portable` marker does not disable them; loose publish output differs. The generator's Scoop notes now recommend package-manager upgrades and disabling automatic startup checks to avoid mixing updater ownership. This is guidance, not an enforced runtime disable for package-manager installations. Feed installation/publication acceptance remains pending. No feeds or public packages were changed.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
accessibility
Barrier affecting people with disabilities
 bug
Something isn't working
 deferred
Agreed follow-up, unscheduled
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 needs-owner
Blocked on the owner
 priority
Work this first
 quality
Tests, gates, and code quality
 question
Further information is requested
 refactor
Internal restructuring, no behavior change
 release
Release and packaging
 wontfix
This will not be worked on
No labels enhancement release
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/AppKit#19