Skip to content

fix(release): emit .zip.sha512 sidecars + close Scoop install gotchas (#2758) #2761

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bpamiri merged 5 commits into from
May 18, 2026
Merged

fix(release): emit .zip.sha512 sidecars + close Scoop install gotchas (#2758) #2761

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f01ea44
fix(release): emit .zip.{sha512,md5} sidecars + add Scoop install got…
bpamiri May 18, 2026
a81345a
docs: address Reviewer A/B consensus findings (round 1)
github-actions[bot] May 18, 2026
e0ff7a1
ci: dispatch scoop-wheels, retire chocolatey
bpamiri May 18, 2026
b22429a
docs: address Reviewer A/B consensus findings (round 2)
github-actions[bot] May 18, 2026
0aef64d
docs: address Reviewer A/B consensus findings (round 3)
github-actions[bot] May 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 16 additions & 16 deletions .github/workflows/release-candidate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,35 +191,35 @@ jobs:
name: rc-build-artifacts-base-template
path: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.sha512

- name: Upload Wheels Core Artifact
uses: actions/upload-artifact@v7
with:
name: rc-build-artifacts-core
path: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.sha512

- name: Upload Wheels CLI Artifact
uses: actions/upload-artifact@v7
with:
name: rc-build-artifacts-cli
path: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip.sha512

- name: Upload Wheels Starter App Artifact
uses: actions/upload-artifact@v7
with:
name: rc-build-artifacts-starter-app
path: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.sha512

- name: Upload All Wheels Artifacts (Combined)
uses: actions/upload-artifact@v7
Expand Down Expand Up @@ -262,14 +262,14 @@ jobs:
prerelease: true
files: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.sha512
78 changes: 42 additions & 36 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,11 @@ on:
FORGEBOX_PASS:
required: true
# Optional — when present, the build job's "Dispatch downstream package
# managers" step fires repository_dispatch on homebrew/chocolatey-wheels
# so their auto-update workflows pick up the new release in ~5min instead
# of waiting for the daily cron. When absent, the step warns and exits 0.
# managers" step fires repository_dispatch on homebrew-wheels and
# scoop-wheels so their auto-update workflows pick up the new release
# in ~5min instead of waiting for the daily cron. When absent, the step
# warns and exits 0. The chocolatey path was retired in favor of Scoop
# for the v4.x Windows install — see scoop-wheels#4.
DOWNSTREAM_DISPATCH_TOKEN:
required: false
# Optional — when present, the build job's "Dispatch Linux repo buckets"
Expand Down Expand Up @@ -307,8 +309,8 @@ jobs:
name: build-artifacts-base-template
path: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.sha512
artifacts/wheels/wheels-base-template-be.zip

- name: Upload Wheels Core Artifact
Expand All @@ -317,8 +319,8 @@ jobs:
name: build-artifacts-core
path: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.sha512
artifacts/wheels/wheels-core-be.zip

- name: Upload Wheels CLI Artifact
Expand All @@ -327,8 +329,8 @@ jobs:
name: build-artifacts-cli
path: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip.sha512
artifacts/wheels/wheels-cli-be.zip

- name: Upload Wheels Starter App Artifact
Expand All @@ -337,8 +339,8 @@ jobs:
name: build-artifacts-starter-app
path: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.sha512
artifacts/wheels/wheels-starter-app-be.zip

- name: Upload Wheels Module Artifact
Expand Down Expand Up @@ -418,17 +420,17 @@ jobs:
overwrite_files: true
files: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz.sha512
Expand Down Expand Up @@ -477,17 +479,17 @@ jobs:
token: ${{ secrets.WHEELS_SNAPSHOTS_TOKEN }}
files: |
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-base-template-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-core-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-cli-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-starter-app-*.zip.sha512
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz.md5
artifacts/wheels/${{ env.WHEELS_VERSION }}/wheels-module-*.tar.gz.sha512
Expand All @@ -501,13 +503,17 @@ jobs:
# Dispatch downstream package managers
#
# Fires repository_dispatch on wheels-dev/homebrew-wheels and
# wheels-dev/chocolatey-wheels so their auto-update workflows pick
# up the new release within minutes instead of waiting up to 24h
# for their daily cron. Both repos have:
# wheels-dev/scoop-wheels so their auto-update workflows pick up
# the new release within minutes instead of waiting up to 24h for
# their daily cron. Both repos have:
# on:
# repository_dispatch:
# types: [wheels-released]
#
# Chocolatey was dropped — the v1.x chocolatey-wheels package is
# CommandBox-based and can't drive v4. Windows installs go through
# Scoop now. See scoop-wheels#4 for the bucket's autoupdate workflow.
#
# Requires DOWNSTREAM_DISPATCH_TOKEN — a fine-grained PAT (or app
# token) with `metadata: read` + `actions: write` on the two
# downstream repos. If the secret is unset, this step warns and
Expand All @@ -522,7 +528,7 @@ jobs:
set -euo pipefail

if [ -z "${GH_DISPATCH_TOKEN:-}" ]; then
echo "::warning::DOWNSTREAM_DISPATCH_TOKEN is not set on the repository — homebrew/chocolatey auto-update will fall back to the daily cron tick."
echo "::warning::DOWNSTREAM_DISPATCH_TOKEN is not set on the repository — homebrew-wheels and scoop-wheels auto-update will fall back to the daily cron tick."
exit 0
fi

Expand All @@ -546,7 +552,7 @@ jobs:
# Static event type, fixed repo list — no untrusted input flows
# into the curl arguments. WHEELS_RELEASE_VERSION is generated
# earlier in the same workflow from wheels.json + run number.
for repo in homebrew-wheels chocolatey-wheels; do
for repo in homebrew-wheels scoop-wheels; do
echo "Dispatching wheels-released to wheels-dev/${repo}..."
http_status=$(curl -sS -o /tmp/dispatch-resp.txt -w "%{http_code}" \
-X POST \
Expand All @@ -564,7 +570,7 @@ jobs:
fi
done

echo "Downstream package manager workflows dispatched (homebrew + chocolatey)."
echo "Downstream package manager workflows dispatched (homebrew + scoop)."

#############################################
# Dispatch Linux repo buckets (apt.wheels.dev / yum.wheels.dev)
Expand Down Expand Up @@ -596,7 +602,7 @@ jobs:
exit 0
fi

# Same channel derivation as the homebrew/chocolatey dispatch.
# Same channel derivation as the homebrew/scoop dispatch.
# apt-wheels-dev / yum-wheels-dev route on `channel` in the payload
# to slot the .deb/.rpm into the right pool (stable vs bleeding-edge).
# RC releases aren't currently published to apt/yum, so we skip them.
Expand Down Expand Up @@ -645,7 +651,7 @@ jobs:
exit 0
fi

# Reuse the same channel-derivation rule as the homebrew/chocolatey
# Reuse the same channel-derivation rule as the homebrew/scoop
# step so this stays in sync. Only stable GA releases bump develop.
if echo "${WHEELS_RELEASE_VERSION}" | grep -qiE '\-snapshot[\.\+]'; then
CHANNEL="bleeding-edge"
Expand All @@ -657,7 +663,7 @@ jobs:

# Fire bump-develop at this repo to open the develop-bump PR.
# Only stable GA releases bump develop; snapshots and RCs don't.
# Same workaround as the homebrew/chocolatey dispatches above:
# Same workaround as the homebrew/scoop dispatches above:
# the release-publish step runs under the default workflow token,
# which cannot trigger downstream workflows. We dispatch from
# this step (which runs under DOWNSTREAM_DISPATCH_TOKEN, a PAT)
Expand Down
Loading
Loading