feat: 1 CI jobs to pack chocolatey package, 1 CI job to push it

Author: sevbch

.github/workflows/build_release_assets.yml

@@ -240,6 +240,19 @@ jobs:
           # automatically do it on Windows
           pdm run bash -c "scripts/build-os-packages/build-os-packages $args"
 
+      - name: Build Chocolatey package & test it
+        # About test part, cf https://docs.chocolatey.org/en-us/create/create-packages/#testing-your-package
+        if: startsWith(matrix.os, 'windows-')
+        shell: bash
+        run: |
+          windows_zip=$(find packages -maxdepth 1 -type f -name "*.zip" | grep "windows" | head -n 1)
+          scripts/chocolatey/pack $windows_zip packages
+          cd packages
+          choco install ggshield --debug --verbose --source . --noop
+        env:
+          # otherwise grep -P in pack chocolatey/pack script fails on Windows
+          LC_ALL: en_US.utf8
+
       - name: Override base Docker image used for functional tests on Windows
         if: matrix.os == 'windows-2022'
         # This is required because GitHub Windows runner is not configured to
@@ -261,7 +274,6 @@ jobs:
           TEST_GG_VALID_TOKEN: ${{ secrets.TEST_GG_VALID_TOKEN }}
           TEST_GG_VALID_TOKEN_IGNORE_SHA: ${{ secrets.TEST_GG_VALID_TOKEN_IGNORE_SHA }}
           TEST_UNKNOWN_SECRET: ${{ secrets.TEST_UNKNOWN_SECRET }}
-
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -272,6 +284,7 @@ jobs:
             packages/ggshield-*.zip
             packages/ggshield-*.rpm
             packages/ggshield_*.deb
+            packages/ggshield.*.nupkg
 
   # Run some basic tests, the goal is to verify the ggshield binary has all the
   # libraries it needs to run

.github/workflows/tag.yml

@@ -82,6 +82,7 @@ jobs:
             packages/ggshield_*.deb \
             packages/ggshield-*.rpm \
             packages/ggshield-*.zip \
+            packages/ggshield.*.nupkg \
             packages/ggshield-*.gz
 
   update_vscode_extension:
@@ -151,19 +152,22 @@ jobs:
   push_to_chocolatey:
     needs: build_release_assets
     name: Push to Chocolatey
-    runs-on: chocolatey/choco
+    runs-on: windows-latest
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Download packages
+      - name: Download nupkg
+        id: download-nupkg
         uses: actions/download-artifact@v4
         with:
-          pattern: os-packages-windows-2022
+          pattern: ggshield.*.nupkg
           path: packages
-          merge-multiple: true
 
       - name: Push to Chocolatey
         run: |
-          scripts/push-to-chocolatey/push-to-chocolatey
+          nupkg_path=$(find ${{ steps.download-nupkg.outputs.download-path }} -maxdepth 1 -type f -name "*.nupkg" | head -n 1)
+          scripts/chocolatey/push $nupkg_path
+        env:
+          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}

changelog.d/20250506_155224_severine.bonnechere_fix_choco_publication.md

@@ -0,0 +1,3 @@
+### Added
+
+- Added ggshield nukpg package (for installation with Chocolatey on Windows) to release assets.

scripts/push-to-chocolatey/README.md renamed to scripts/chocolatey/README.md

@@ -1,4 +1,4 @@
-# Push to Chocolatey
+# Chocolatey
 
 This folder contains everything necessary to build and publish the chocolatey package.
 

scripts/push-to-chocolatey/VERIFICATION.txt renamed to scripts/chocolatey/VERIFICATION.txt

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# parse command line arguments
+zip_name=$1
+output_dir=$2
+
+# unzip to folder
+if ! command -v unzip > /dev/null ; then
+    apt update
+    apt install unzip
+fi
+mkdir win_package
+unzip $zip_name -d win_package
+
+version=$(echo "$zip_name" | grep -oP '(?<=ggshield-)[0-9.]+')
+
+# choco-package will contain everything needed to build the nupkg
+mkdir choco-package
+mkdir choco-package/tools
+
+mv win_package/*/_internal choco-package/tools
+mv win_package/*/ggshield.exe choco-package/tools
+cp scripts/chocolatey/ggshield.nuspec choco-package
+cp scripts/chocolatey/VERIFICATION.txt choco-package/tools
+cp LICENSE choco-package/tools/LICENSE.txt
+sed -i "s/__VERSION__/$version/" choco-package/ggshield.nuspec
+
+choco pack choco-package/* --version $version --outdir $output_dir
+
+rm -rf win_package choco-package

scripts/push-to-chocolatey/ggshield.nuspec renamed to scripts/chocolatey/ggshield.nuspec

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+die() {
+    echo $* >&2
+    exit 1
+}
+
+if [ -z "${CHOCOLATEY_API_KEY:-}" ] ; then
+    die '$CHOCOLATEY_API_KEY is not set'
+fi
+
+# parse command line arguments
+choco_nupkg=$1
+
+# push to chocolatey
+choco push $choco_nupkg --source https://push.chocolatey.org/ --api-key $CHOCOLATEY_API_KEY