@@ -1,22 +1,26 @@
-name: Scoop manifest bump
+name: Packaging manifest bump
 
-# Keep the in-repo Scoop bucket manifest (bucket/clauster.json) in lockstep with
-# published releases. The manifest carries Scoop's own `checkver`/`autoupdate`
-# blocks, but nothing INVOKES them for a self-hosted bucket (the official Scoop
-# Excavator only services the ScoopInstaller org). Without this, `scoop install
-# clauster` keeps serving whatever version the committed manifest pins, frozen
-# until someone bumps it by hand.
+# Keep the in-repo package-manager manifests — the Scoop bucket (bucket/clauster.json),
+# the Homebrew formula (Formula/clauster.rb), and the Nix flake (flake.nix) — in
+# lockstep with published releases. Scoop's manifest carries `checkver`/`autoupdate`,
+# but nothing INVOKES them for a self-hosted bucket (the official Scoop Excavator only
+# services the ScoopInstaller org); Homebrew/Nix have no auto-update at all. Without
+# this, `scoop install` / `brew install` / `nix run` keep serving whatever version the
+# committed manifests pin, frozen until someone bumps them by hand.
 #
-# So on every published release we regenerate the manifest's version/url/hash from
-# the release's authoritative SHA256SUMS and open a PR. We DON'T push to main: main
-# is branch-protected, and the bump is reviewable like any other change. release-
-# please is deliberately NOT the mechanism — it runs at PR-prep time, before the
-# binaries (and therefore the hash) exist.
+# So on every published release we regenerate each manifest's version/url/hash from the
+# release's authoritative SHA256SUMS (via scripts/bump_packaging.py) and open a PR. We
+# DON'T push to main: main is branch-protected, and the bump is reviewable like any
+# other change. release-please is deliberately NOT the mechanism — it runs at PR-prep
+# time, before the binaries (and therefore the hashes) exist.
 #
-# Trust root: the SHA256SUMS asset, fetched over GitHub TLS from our own just-
-# published release — the same trust model the install.sh/install.ps1 one-liners
-# use. (Optional future hardening: `cosign verify-blob` against the shipped
-# SHA256SUMS.sigstore.json before trusting it.)
+# A manifest not yet on main is skipped (the helper no-ops on absent files), so this can
+# merge ahead of the Homebrew/Nix packaging and light them up once they land.
+#
+# Trust root: the SHA256SUMS asset, fetched over GitHub TLS from our own just-published
+# release — the same trust model the install.sh/install.ps1 one-liners use. (Optional
+# future hardening: `cosign verify-blob` against the shipped SHA256SUMS.sigstore.json
+# before trusting it.)
 on:
   release:
     types: [published]
@@ -25,7 +29,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag to sync the Scoop manifest to (e.g. v0.11.0). Empty = latest published."
+        description: "Release tag to sync the packaging manifests to (e.g. v0.11.0). Empty = latest."
         required: false
         default: ""
 
@@ -34,12 +38,12 @@ permissions:
   contents: read
 
 concurrency:
-  group: scoop-bump-${{ github.workflow }}
+  group: packaging-bump-${{ github.workflow }}
   cancel-in-progress: false
 
 jobs:
   bump:
-    name: Sync bucket/clauster.json to the release
+    name: Sync packaging manifests to the release
     # workflow_dispatch is restricted to the default branch so a dispatch from an
     # arbitrary ref can't run this write-capable job. (release events already use
     # the default branch's workflow file.)
@@ -96,85 +100,66 @@ jobs:
           echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
           echo "Target tag: $tag"
 
-      # Regenerate version/url/hash from the release's SHA256SUMS. Fails closed if
-      # the Windows asset (or its checksum) is missing — we never push a half-baked
-      # manifest. jq --indent 4 preserves the file's existing formatting.
-      - name: Regenerate Scoop manifest
+      # Regenerate version/url/hash for every present manifest from the release's
+      # SHA256SUMS. The helper fails closed (non-zero exit) if a present manifest's
+      # asset is missing or a stale version would survive — we never push a
+      # half-baked manifest. Absent manifests are skipped.
+      - name: Regenerate packaging manifests
         id: regen
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ steps.tag.outputs.tag }}
           VERSION: ${{ steps.tag.outputs.version }}
         run: |
           set -euo pipefail
-          manifest="bucket/clauster.json"
-          if [ ! -f "$manifest" ]; then
-            echo "::error::$manifest not found on the default branch"
-            exit 1
-          fi
-
           tmp="$(mktemp -d)"
           gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern SHA256SUMS --dir "$tmp"
+          python3 scripts/bump_packaging.py "$VERSION" "$GITHUB_REPOSITORY" "$tmp/SHA256SUMS"
 
-          asset="clauster-${VERSION}-windows-x86_64.exe"
-          hash="$(awk -v f="$asset" '$2 == f { print $1 }' "$tmp/SHA256SUMS")"
-          if ! printf '%s' "$hash" | grep -Eq '^[0-9a-f]{64}$'; then
-            echo "::error::no valid sha256 for $asset in the $TAG SHA256SUMS (got '${hash:-<empty>}')"
-            exit 1
-          fi
-
-          url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/${asset}#/clauster.exe"
-          jq --indent 4 \
-            --arg v "$VERSION" --arg u "$url" --arg h "$hash" \
-            '.version = $v
-             | .architecture."64bit".url = $u
-             | .architecture."64bit".hash = $h' \
-            "$manifest" > "$manifest.new"
-          mv "$manifest.new" "$manifest"
-
-          if git diff --quiet -- "$manifest"; then
-            echo "Manifest already at $VERSION — nothing to do."
+          if git diff --quiet; then
+            echo "Manifests already at $VERSION — nothing to do."
             echo "changed=false" >> "$GITHUB_OUTPUT"
           else
             echo "changed=true" >> "$GITHUB_OUTPUT"
-            git --no-pager diff -- "$manifest"
+            git --no-pager diff --stat
           fi
 
       # Push to a per-version branch and open (or update) a PR. Never main.
-      - name: Open Scoop bump PR
+      - name: Open packaging bump PR
         if: ${{ steps.regen.outputs.changed == 'true' }}
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           TAG: ${{ steps.tag.outputs.tag }}
           VERSION: ${{ steps.tag.outputs.version }}
         run: |
           set -euo pipefail
-          branch="scoop-bump/${TAG}"
+          branch="packaging-bump/${TAG}"
           case "$branch" in
-            scoop-bump/v[0-9]*) ;;
+            packaging-bump/v[0-9]*) ;;
             *) echo "::error::refusing to push to unexpected branch '$branch'"; exit 1 ;;
           esac
 
           git config user.name "clauster-ci[bot]"
           git config user.email "clauster-ci[bot]@users.noreply.github.com"
           git checkout -B "$branch"
-          git add bucket/clauster.json
-          git commit -m "chore(scoop): bump bucket manifest to ${VERSION}"
+          git add bucket/clauster.json Formula/clauster.rb flake.nix
+          git commit -m "chore(packaging): bump manifests to ${VERSION}"
           git push --force-with-lease \
             "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${branch}"
 
           # Open the PR only if one isn't already open for this branch (re-run safe).
           existing="$(gh pr list --repo "$GITHUB_REPOSITORY" --state open --head "$branch" --json number --jq 'length')"
           if [ "$existing" = "0" ]; then
             body="$(printf '%s\n' \
-              "Auto-generated by \`scoop-bump.yml\` on release **${TAG}**." \
+              "Auto-generated by \`packaging-bump.yml\` on release **${TAG}**." \
               "" \
-              "Updates \`bucket/clauster.json\` version/url/hash from the release's" \
-              "signed \`SHA256SUMS\` (Windows x86_64). Review + merge to publish the" \
-              "new version to Scoop users.")"
+              "Regenerates the Scoop / Homebrew / Nix manifests' version, URLs, and" \
+              "checksums from the release's signed \`SHA256SUMS\` (only manifests present" \
+              "on main are touched). Review + merge to publish the new version to those" \
+              "package managers.")"
             gh pr create --repo "$GITHUB_REPOSITORY" --base main --head "$branch" \
-              --title "chore(scoop): bump bucket manifest to ${VERSION}" \
+              --title "chore(packaging): bump manifests to ${VERSION}" \
               --body "$body"
           else
-            echo "PR already open for $branch — pushed the updated manifest to it."
+            echo "PR already open for $branch — pushed the updated manifests to it."
           fi
@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+"""Regenerate the packaging manifests to a released version from its SHA256SUMS.
+
+After a release publishes, the Scoop bucket manifest, the Homebrew formula, and
+the Nix flake must point at the new version's binaries and checksums. This helper
+rewrites whichever of those manifests exist in the working tree, in place, keying
+every checksum off the release's authoritative ``SHA256SUMS`` (the list of what
+was actually built and signed).
+
+Driven by ``.github/workflows/packaging-bump.yml``. A manifest that is not present
+is skipped (it simply is not on ``main`` yet). It fails closed rather than write a
+half-baked manifest: the Scoop manifest's Windows asset must be in ``SHA256SUMS``,
+and after rewriting, no manifest may still reference a non-target version. Standard
+library only. Usage::
+
+    python scripts/bump_packaging.py <version> <owner/repo> <path-to-SHA256SUMS>
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+from pathlib import Path
+
+_SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
+_VERSION_RE = re.compile(r"^\d+\.\d+\.\d+$")
+# Any ``clauster-<x.y.z>-`` asset token left in a rewritten manifest: a missed arch.
+_ASSET_VERSION_RE = re.compile(r"clauster-(\d+\.\d+\.\d+)-")
+
+
+def parse_sums(text: str) -> dict[str, str]:
+    """Parse ``SHA256SUMS`` text into an ``{asset_filename: sha256}`` mapping."""
+    sums: dict[str, str] = {}
+    for raw in text.splitlines():
+        line = raw.strip()
+        if not line:
+            continue
+        parts = line.split()
+        if len(parts) != 2 or not _SHA256_RE.match(parts[0]):
+            continue
+        digest, name = parts
+        sums[name.lstrip("*")] = digest  # coreutils marks binary mode with a leading '*'
+    return sums
+
+
+def asset_url(repo: str, version: str, asset: str) -> str:
+    """Build the release download URL for one asset filename."""
+    return f"https://github.com/{repo}/releases/download/v{version}/{asset}"
+
+
+def arch_assets(version: str, sums: dict[str, str]) -> dict[str, str]:
+    """Map each ``clauster-<version>-<arch>`` asset to its arch token and digest."""
+    prefix = f"clauster-{version}-"
+    return {
+        asset[len(prefix) :]: digest for asset, digest in sums.items() if asset.startswith(prefix)
+    }
+
+
+def stale_versions(text: str, version: str) -> set[str]:
+    """Return any asset-token versions in ``text`` other than the target version."""
+    return set(_ASSET_VERSION_RE.findall(text)) - {version}
+
+
+def bump_scoop(text: str, version: str, repo: str, sums: dict[str, str]) -> str:
+    """Rewrite the Scoop bucket manifest's version, URL, and hash (Windows x86_64)."""
+    asset = f"clauster-{version}-windows-x86_64.exe"
+    digest = sums.get(asset)
+    if digest is None:
+        raise ValueError(f"Scoop manifest: release asset {asset!r} missing from SHA256SUMS")
+    data = json.loads(text)
+    data["version"] = version
+    arch = data["architecture"]["64bit"]
+    arch["url"] = f"{asset_url(repo, version, asset)}#/clauster.exe"
+    arch["hash"] = digest
+    return json.dumps(data, indent=4) + "\n"
+
+
+def bump_formula(text: str, version: str, repo: str, sums: dict[str, str]) -> str:
+    """Rewrite the Homebrew formula's version and each present arch's URL + sha256."""
+    text = re.sub(r'version "[^"]+"', f'version "{version}"', text, count=1)
+    for arch, digest in arch_assets(version, sums).items():
+        url = asset_url(repo, version, f"clauster-{version}-{arch}")
+        block = re.compile(
+            r'(?P<head>url ")[^"]*-'
+            + re.escape(arch)
+            + r'(?P<mid>"\s*\n\s*sha256 ")[0-9a-f]{64}(?P<tail>")'
+        )
+        text = block.sub(
+            lambda m, url=url, digest=digest: f"{m['head']}{url}{m['mid']}{digest}{m['tail']}",
+            text,
+        )
+    return text
+
+
+def bump_flake(text: str, version: str, sums: dict[str, str]) -> str:
+    """Rewrite the Nix flake's version and each present system's sha256.
+
+    The flake's ``file`` field interpolates ``${version}``, so only the top-level
+    version string and the per-system checksums need rewriting.
+    """
+    text = re.sub(r'(version = ")[^"]+(";)', rf"\g<1>{version}\g<2>", text, count=1)
+    for arch, digest in arch_assets(version, sums).items():
+        block = re.compile(
+            r'(?P<head>file = "clauster-\$\{version\}-'
+            + re.escape(arch)
+            + r'";\s*\n\s*sha256 = ")[0-9a-f]{64}(?P<tail>";)'
+        )
+        text = block.sub(lambda m, digest=digest: f"{m['head']}{digest}{m['tail']}", text)
+    return text
+
+
+def main(argv: list[str]) -> int:
+    """Bump every present packaging manifest to ``version`` from ``SHA256SUMS``."""
+    if len(argv) != 4:
+        print("usage: bump_packaging.py <version> <owner/repo> <SHA256SUMS>", file=sys.stderr)
+        return 2
+    version, repo, sums_path = argv[1], argv[2], argv[3]
+    if not _VERSION_RE.match(version):
+        print(f"error: version {version!r} is not MAJOR.MINOR.PATCH", file=sys.stderr)
+        return 2
+
+    sums = parse_sums(Path(sums_path).read_text())
+    if not arch_assets(version, sums):
+        print(f"error: SHA256SUMS has no clauster-{version}-* assets", file=sys.stderr)
+        return 1
+
+    manifests = {
+        Path("bucket/clauster.json"): lambda t: bump_scoop(t, version, repo, sums),
+        Path("Formula/clauster.rb"): lambda t: bump_formula(t, version, repo, sums),
+        Path("flake.nix"): lambda t: bump_flake(t, version, sums),
+    }
+
+    # First pass: compute + validate every present manifest. Fail closed BEFORE any
+    # write so a mid-sequence abort never leaves a half-rewritten tree.
+    planned: list[tuple[Path, str]] = []
+    try:
+        for path, rewrite in manifests.items():
+            if not path.exists():
+                print(f"skip {path} (not present)")
+                continue
+            new_text = rewrite(path.read_text())
+            leftover = stale_versions(new_text, version)
+            if leftover:
+                raise ValueError(
+                    f"{path}: still references version(s) {sorted(leftover)} after bump"
+                )
+            planned.append((path, new_text))
+    except ValueError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+
+    # Second pass: write only the manifests that actually changed.
+    changed: list[str] = []
+    for path, new_text in planned:
+        if new_text == path.read_text():
+            print(f"unchanged {path}")
+            continue
+        path.write_text(new_text)
+        changed.append(str(path))
+        print(f"bumped {path}")
+
+    print(f"changed={','.join(changed)}" if changed else "changed=")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))