From 25220bed8b1af2d4ae560be09928070d1908b3d9 Mon Sep 17 00:00:00 2001
From: casablanque-code <casablanque@proton.me>
Date: Sun, 2 Aug 2026 00:25:03 +0000
Subject: [PATCH] fix(ci): scoop bucket auto-update never actually ran
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

.github/workflows/scoop-update.yml (on: release: types: [published])
had zero runs ever, including for v0.7.1 — GitHub does not trigger
'release' events for releases created by a workflow using the default
GITHUB_TOKEN (here, softprops/action-gh-release with no explicit
token: input), specifically to prevent workflow recursion. This is
why 'scoop update zt' kept reporting 0.7.0 as latest after v0.7.1
shipped.

Folds the bucket bump into release.yml itself as a step right after
the release upload, in the same job — it already has the sha256 on
disk from the 'Generate checksums' step, so no second network
round-trip or risk of racing the upload. Removes the now-dead
scoop-update.yml.

Manually bumps bucket/zt.json to v0.7.1 (correct url + hash) since the
automated path never fired for it.
---
 .github/workflows/release.yml      | 31 +++++++++++++++++++++
 .github/workflows/scoop-update.yml | 44 ------------------------------
 bucket/zt.json                     |  6 ++--
 3 files changed, 34 insertions(+), 47 deletions(-)
 delete mode 100644 .github/workflows/scoop-update.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a2af68f..236bcd3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,3 +54,34 @@ jobs:
             dist/zt-darwin-arm64.sha256
             dist/zt-windows-amd64.exe.sha256
             dist/checksums.txt
+
+      - name: Update Scoop bucket
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          HASH=$(awk '{print $1}' dist/zt-windows-amd64.exe.sha256)
+
+          if [[ ! "$HASH" =~ ^[a-fA-F0-9]{64}$ ]]; then
+            echo "error: could not read a valid sha256 from dist/zt-windows-amd64.exe.sha256 (got: '$HASH')" >&2
+            exit 1
+          fi
+
+          # This job runs with the tag as a detached HEAD (that's what
+          # built the release binaries), but the bucket lives on main —
+          # switch there before editing it.
+          git fetch origin main
+          git checkout -B main origin/main
+
+          jq --arg version "$VERSION" --arg hash "$HASH" \
+            '.version = $version | .architecture["64bit"].hash = $hash' \
+            bucket/zt.json > bucket/zt.json.tmp
+          mv bucket/zt.json.tmp bucket/zt.json
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          if git diff --quiet -- bucket/zt.json; then
+            echo "bucket/zt.json already up to date, nothing to commit"
+          else
+            git add bucket/zt.json
+            git commit -m "chore(scoop): bump bucket to ${GITHUB_REF_NAME}"
+            git push origin main
+          fi
diff --git a/.github/workflows/scoop-update.yml b/.github/workflows/scoop-update.yml
deleted file mode 100644
index 204816e..0000000
--- a/.github/workflows/scoop-update.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-name: Update Scoop bucket
-
-on:
-  release:
-    types: [published]
-
-jobs:
-  update-manifest:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Bump bucket/zt.json
-        env:
-          TAG: ${{ github.event.release.tag_name }}
-        run: |
-          VERSION="${TAG#v}"
-          SHA_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/zt-windows-amd64.exe.sha256"
-          HASH=$(curl -fsSL "$SHA_URL" | awk '{print $1}')
-
-          if [[ ! "$HASH" =~ ^[a-fA-F0-9]{64}$ ]]; then
-            echo "error: could not resolve a valid sha256 from $SHA_URL (got: '$HASH')" >&2
-            exit 1
-          fi
-
-          jq --arg version "$VERSION" --arg hash "$HASH" \
-            '.version = $version | .architecture["64bit"].hash = $hash' \
-            bucket/zt.json > bucket/zt.json.tmp
-          mv bucket/zt.json.tmp bucket/zt.json
-
-      - name: Commit and push
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          if git diff --quiet -- bucket/zt.json; then
-            echo "bucket/zt.json already up to date, nothing to commit"
-            exit 0
-          fi
-          git add bucket/zt.json
-          git commit -m "chore(scoop): bump bucket to ${{ github.event.release.tag_name }}"
-          git push
diff --git a/bucket/zt.json b/bucket/zt.json
index ba10fe5..08e58d7 100644
--- a/bucket/zt.json
+++ b/bucket/zt.json
@@ -1,12 +1,12 @@
 {
-    "version": "0.7.0",
+    "version": "0.7.1",
     "description": "Zero Trust tunnel manager for Cloudflare — one command to expose a local service through Cloudflare Zero Trust.",
     "homepage": "https://github.com/casablanque-code/cfzt",
     "license": "MIT",
     "architecture": {
         "64bit": {
-            "url": "https://github.com/casablanque-code/cfzt/releases/download/v0.7.0/zt-windows-amd64.exe#/zt.exe",
-            "hash": "d6e70b93f56c13ff56073d1277cc14577dd4fc6829c76078e573064cfdd87374"
+            "url": "https://github.com/casablanque-code/cfzt/releases/download/v0.7.1/zt-windows-amd64.exe#/zt.exe",
+            "hash": "78ce364064c793da96ac9447442c1d51f07627be5dd198a8c4c538494b05c45b"
         }
     },
     "bin": "zt.exe",