[RogerCecilpot]

Closes devlyft/devlyft#260.

Stacked on #4 (release pipeline), which is stacked on #2 (scaffold). Retarget as those merge.

What

• deb and rpm packages (goreleaser nfpms) for Linux amd64 and arm64:
  • Contents: binary in /usr/bin; LICENSE and README in /usr/share/doc/devlyft.
  • Metadata: Apache-2.0, homepage, maintainer, section devel, rpm group.
  • Timestamps come from the commit (mtime), so builds are reproducible.
  • The packages are attached to the release and listed in the cosign-signed checksum file. The release workflow's build-provenance attestation now includes *.deb and *.rpm.
• Scoop manifest (goreleaser scoops): pushed to devlyft/scoop-bucket (bucket/devlyft.json) for Windows amd64 and arm64. The upload is skipped when SCOOP_BUCKET_GITHUB_TOKEN is unset, so releases keep working before the bucket exists.
• CI: the release-snapshot job installs the .deb on the runner and the .rpm in a Fedora container, runs devlyft version after each, and checks that the Scoop manifest has hashes for both architectures.
• Docs: docs/releasing.md (bucket setup, Linux packages) and an Install section in the README.

Verified locally

• goreleaser check passes. A snapshot build produced 4 packages (deb and rpm × amd64 and arm64) and the Scoop manifest, and all of them are in the checksum file.
• dpkg-deb -I/-c: metadata and contents are correct.
• The deb installs and runs in debian:stable-slim. In fedora:latest, rpm -qip shows arch x86_64 and license Apache-2.0, rpm -qlp lists the files, and the rpm installs and runs.
• actionlint, make lint and make test pass.

Not included / not verified

• Completions and man pages are not in the packages yet. devlyft completion lands in feat: shell completion and Linux/macOS/Windows CI matrix #3 (#257) and man pages in #248. Add them to nfpms.contents once both are on main. Including them now would break the snapshot build on this base.
• Packages are not GPG-signed and there is no apt or yum repository. Verification goes through the signed checksum file. A hosted repository would be a follow-up if wanted.
• The bucket push is untested. It needs the bucket and token plus a tagged release, and scoop install hasn't been tried on Windows.
• README and docs will conflict with feat: Homebrew tap and verified install script #8 (#258). Both add an Install section to the README and edit docs/releasing.md, so whichever merges second needs a small rebase.

Needs creating before the first Scoop release

1. Bucket repository: a public repo devlyft/scoop-bucket with a bucket/ directory.
2. Bucket credential: a fine-grained PAT owned by a bot account, or a GitHub App, with Contents: read and write on devlyft/scoop-bucket only.
3. Secret: store that credential as SCOOP_BUCKET_GITHUB_TOKEN in devlyft/cli, ideally in a protected environment used only by release.yml.

🤖 Generated with Claude Code