From 9f346c8513abf04d3100ce7e573f9e2b4c1b1956 Mon Sep 17 00:00:00 2001 From: James Maes Date: Sun, 11 Oct 2026 07:33:08 -0500 Subject: [PATCH] ci(release): open the packaging manifests PR before the Chocolatey push chocolatey.org holds one version of a package in moderation at a time and rejects a second push with HTTP 403 (v1.1.0 while 1.0.1 was queued), which left the Scoop manifests PR unopened. The packages job now mints the App token and opens the manifests PR right after the manifests are updated, then packs and pushes to Chocolatey; a failed push still fails the job for a re-run. RELEASING.md documents the behaviour. Closes #129 Co-Authored-By: Claude Fable 5.1 Signed-off-by: James Maes --- .github/workflows/release.yml | 33 ++++++++++++++++++--------------- docs/RELEASING.md | 6 +++++- 2 files changed, 23 insertions(+), 16 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a541aae..af89272 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -296,19 +296,9 @@ jobs: shell: pwsh run: ./.github/scripts/Update-PackageManifests.ps1 -Version $env:K22_VERSION -CliZipPath "artifacts/gclo-cli-win-x64-$env:K22_VERSION.zip" - - name: Pack the Chocolatey package - shell: pwsh - run: | - New-Item -ItemType Directory -Force artifacts/chocolatey | Out-Null - choco pack packaging/chocolatey/gclo.nuspec --outputdirectory artifacts/chocolatey - Get-ChildItem artifacts/chocolatey - - - name: Push the Chocolatey package - shell: pwsh - env: - CHOCO_API_KEY: ${{ secrets.CHOCO_API_KEY }} - run: choco push (Get-ChildItem artifacts/chocolatey/*.nupkg | Select-Object -First 1).FullName --source https://push.chocolatey.org/ --api-key $env:CHOCO_API_KEY - + # The manifests PR opens BEFORE the Chocolatey push: chocolatey.org holds one + # version in moderation at a time and rejects a second push (HTTP 403, v1.1.0), + # which must not stop Scoop from being pointed at the release (#129). # protect-main requires signed commits and a DCO sign-off. The action only # signs with a bot token (a PAT is explicitly unsupported), so the PR is # opened with a short-lived token of the release GitHub App: GitHub signs @@ -340,8 +330,8 @@ jobs: `gclo-cli-win-x64-${{ needs.release.outputs.version }}.zip` (SHA-256 `${{ steps.manifests.outputs.sha256 }}`). - `scoop update gclo` picks this up as soon as this PR is merged (Scoop - reads the manifest from `main`); the Chocolatey package was pushed to - chocolatey.org. + reads the manifest from `main`); the Chocolatey package is pushed to + chocolatey.org by the same job after this PR opens (a failed push re-runs alone). Relates to #9. labels: | @@ -351,6 +341,19 @@ jobs: packaging/chocolatey/gclo.nuspec packaging/chocolatey/tools/chocolateyinstall.ps1 + - name: Pack the Chocolatey package + shell: pwsh + run: | + New-Item -ItemType Directory -Force artifacts/chocolatey | Out-Null + choco pack packaging/chocolatey/gclo.nuspec --outputdirectory artifacts/chocolatey + Get-ChildItem artifacts/chocolatey + + - name: Push the Chocolatey package + shell: pwsh + env: + CHOCO_API_KEY: ${{ secrets.CHOCO_API_KEY }} + run: choco push (Get-ChildItem artifacts/chocolatey/*.nupkg | Select-Object -First 1).FullName --source https://push.chocolatey.org/ --api-key $env:CHOCO_API_KEY + # winget, stable releases only, once the package exists. `wingetcreate update` # can only update a package that already exists in microsoft/winget-pkgs; the # first submission is manual (docs/RELEASING.md), after which WINGET_PACKAGE_ID diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 7f9cffb..489c44f 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -192,7 +192,11 @@ Both install the same asset, `gclo-cli-win-x64-.zip`, by URL and SHA-25 - **Chocolatey** needs a one-time account on chocolatey.org and its API key as `CHOCO_API_KEY`. The first version goes through Chocolatey's moderation queue (expect a few days); later versions are usually auto-approved. Users then run - `choco install gclo`. + `choco install gclo`. The community repository holds **one version of a package + in moderation at a time**: pushing another while one is queued fails with HTTP + 403 (v1.1.0 hit this while 1.0.1 was queued). The `packages` job opens the + manifests PR *before* the push so Scoop is never held up; re-run the failed job + once the queued version is approved or rejected. - To re-point the manifests by hand (for example after a missed release): `./.github/scripts/Update-PackageManifests.ps1 -Version 1.2.3 -CliZipPath `. -- 2.54.0