Publish Chocolatey package to community repository

[rianjs]

Summary

The Chocolatey package definition was created in #71 / #74, but hasn't been published yet. This issue tracks the actual submission to the Chocolatey Community Repository.

Prerequisites

• feat: add Chocolatey package for Windows distribution #74 merged (package definition)
• A release exists on GitHub (need real version number)

Steps to Publish

1. Update version in nuspec

   cd packaging/chocolatey
   # Edit confluence-cli.nuspec, change <version>0.0.0</version> to match release

2. Pack the package

   choco pack
   # Creates confluence-cli.<version>.nupkg

3. Test locally

   choco install confluence-cli -s . --force
   cfl --version
   choco uninstall confluence-cli -y

4. Push to Chocolatey

   # First time: configure API key from https://community.chocolatey.org/account
   choco apikey --key <your-api-key> --source https://push.chocolatey.org/
   
   # Push
   choco push confluence-cli.<version>.nupkg --source https://push.chocolatey.org/

5. Wait for moderation (typically 1-3 days)

   • Automated checks verify download works
   • Human moderator reviews package
   • Status updates sent via email

After Approval

• Add Chocolatey installation instructions to README.md:

  ### Chocolatey (Windows)
  
  ```powershell
  choco install confluence-cli

References

• Chocolatey Package Publishing Docs
• Package definition: packaging/chocolatey/

[rianjs]

PR #81 adds automated Chocolatey publishing to the release workflow.

Once merged:

1. Add CHOCOLATEY_API_KEY secret to the repository
2. The next feat: or fix: commit that changes Go code will automatically publish to Chocolatey

The first submission will go through Chocolatey's moderation process (1-3 days typically), but subsequent versions should be faster once we're trusted maintainers.

[rianjs]

Moderation Feedback

The Chocolatey package was flagged for two guideline violations:

CPMR0041 - ProjectSourceUrl and ProjectUrl are identical

https://docs.chocolatey.org/en-us/community-repository/moderation/package-validator/rules/cpmr0041/

Both projectUrl and projectSourceUrl point to https://github.com/open-cli-collective/confluence-cli. These should be different URLs:

• projectUrl → main project page/documentation
• projectSourceUrl → source code repository

CPMR0055 - Script uses custom downloaders

https://docs.chocolatey.org/en-us/community-repository/moderation/package-validator/rules/cpmr0055/

The install script uses Invoke-WebRequest to fetch checksums.txt. Should use Chocolatey's built-in Get-ChocolateyWebFile instead.

[rianjs]

Fix Plan

1. Fix CPMR0041 - Differentiate URLs

In packaging/chocolatey/confluence-cli.nuspec:

<!-- Before -->
<projectUrl>https://github.com/open-cli-collective/confluence-cli</projectUrl>
<projectSourceUrl>https://github.com/open-cli-collective/confluence-cli</projectSourceUrl>

<!-- After -->
<projectUrl>https://github.com/open-cli-collective/confluence-cli#readme</projectUrl>
<projectSourceUrl>https://github.com/open-cli-collective/confluence-cli</projectSourceUrl>

The #readme fragment makes them technically different URLs while directing users to the documentation.

2. Fix CPMR0055 - Use Chocolatey download functions

In packaging/chocolatey/tools/chocolateyInstall.ps1:

# Before
$checksums = (Invoke-WebRequest -Uri $checksumsUrl -UseBasicParsing).Content

# After
$checksumFile = Join-Path $toolsDir 'checksums.txt'
Get-ChocolateyWebFile -PackageName 'checksums' -FileFullPath $checksumFile -Url $checksumsUrl
$checksums = Get-Content $checksumFile -Raw
Remove-Item $checksumFile -Force

Files to modify

• packaging/chocolatey/confluence-cli.nuspec
• packaging/chocolatey/tools/chocolateyInstall.ps1

Verification

After merging, trigger the manual Chocolatey publish workflow to resubmit the package.

[rianjs]

CPMR0073 - Download not using a checksum (REQUIREMENT)

https://docs.chocolatey.org/en-us/community-repository/moderation/package-validator/rules/cpmr0073/

This is a blocker, not just a guideline. The current approach of downloading checksums.txt at runtime creates a chicken-and-egg problem - we can't validate checksums.txt with a checksum.

---

Revised Plan

Instead of downloading checksums.txt at runtime, inject checksums directly into the install script during the release workflow. This solves both CPMR0055 and CPMR0073 at once.

Changes

1. packaging/chocolatey/confluence-cli.nuspec - Fix CPMR0041

<projectUrl>https://github.com/open-cli-collective/confluence-cli#readme</projectUrl>

2. packaging/chocolatey/tools/chocolateyInstall.ps1 - Template with placeholders

Replace runtime checksum fetching with hardcoded placeholders that the release workflow fills in:

# Checksums injected by release workflow
$checksumAmd64 = 'CHECKSUM_AMD64_PLACEHOLDER'
$checksumArm64 = 'CHECKSUM_ARM64_PLACEHOLDER'

if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
    $arch = 'arm64'
    $checksum = $checksumArm64
} elseif ([Environment]::Is64BitOperatingSystem) {
    $arch = 'amd64'
    $checksum = $checksumAmd64
} else {
    throw "32-bit Windows is not supported."
}

3. .github/workflows/release.yml - Inject checksums at build time

After downloading checksums.txt, replace the placeholders in the install script before packing:

$x64Hash = ...  # extract from checksums.txt
$arm64Hash = ...

$script = Get-Content 'packaging/chocolatey/tools/chocolateyInstall.ps1' -Raw
$script = $script -replace 'CHECKSUM_AMD64_PLACEHOLDER', $x64Hash
$script = $script -replace 'CHECKSUM_ARM64_PLACEHOLDER', $arm64Hash
Set-Content 'packaging/chocolatey/tools/chocolateyInstall.ps1' $script

Same update needed for chocolatey-publish.yml.

Benefits

• No runtime downloads except the actual binary
• Checksums are baked into the package at build time
• Satisfies CPMR0055 (no custom downloaders) and CPMR0073 (checksums required)