Chocolatey support

[fredvisser]

Added

• slcli.nuspec: Package metadata (MIT license, project URLs, tags).
• chocolateyinstall.ps1: Remote download install script (with SHA256 checksum token).
• chocolateyuninstall.ps1: Minimal uninstall script.
• build_chocolatey.py: Automates nuspec token replacement, checksum computation for dist/slcli.zip, injection into install script, and choco pack.

Modified

• release.yml: New choco-build job (build + pack + upload) and publish-chocolatey job (push on tagged release with API key). Included .nupkg in release assets.
• README.md: New Chocolatey installation section (install, upgrade, notes).
• .gitignore: Added *.nupkg.

Workflow Details

• Build sequence: Windows build produces dist/slcli.zip → checksum calculated → checksum injected → .nupkg packed → artifact uploaded → optional publish job pushes after release tag.
• Publish gating: Requires CHOCOLATEY_API_KEY secret; only runs on version tags (v*).

Security & Compliance

• Uses immutable GitHub release asset download.
• Enforces SHA256 integrity in install script (mandatory for moderation).
• No embedded binaries inside .nupkg (download model).

Testing Guidance

• Local dry run: poetry run python scripts/build_chocolatey.py then choco install slcli -s dist -y.
• Verify checksum injection: search for $checksum$ absence in packed .nupkg.

Risk

Low; isolated to packaging, docs, and CI additions—runtime CLI unaffected.

[Copilot]

Pull Request Overview

This PR adds comprehensive Chocolatey package support for slcli, enabling Windows users to install the CLI tool through the Chocolatey package manager. The implementation follows a remote download model where the package downloads the binary from GitHub releases rather than embedding it directly.

• Chocolatey packaging infrastructure with automated build and publish workflow
• Remote artifact download model with SHA256 integrity verification
• CI/CD integration for automated package publishing on tagged releases

Reviewed Changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
scripts/build_chocolatey.py	Automates Chocolatey package creation with checksum injection and token replacement
packaging/choco/slcli.nuspec	Package metadata specification for Chocolatey
packaging/choco/tools/chocolateyinstall.ps1	PowerShell script for downloading and installing slcli from GitHub releases
packaging/choco/tools/chocolateyuninstall.ps1	Minimal uninstall script for Chocolatey
README.md	Added Chocolatey installation instructions and usage notes
.github/workflows/release.yml	Extended CI workflow with Chocolatey build and publish jobs

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

[Copilot]

In PowerShell, the proper way to escape a dollar sign in a double-quoted string is with a backtick, not a backslash. The current usage of \$version\$ should be written as `$version`$ to correctly display the literal text "$version$" in the error message. While the current code may work, it doesn't follow PowerShell conventions and could be confusing.

Suggested change

	throw "The package version could not be determined. Ensure that the build-time token `\$version\$` is replaced or the ChocolateyPackageVersion environment variable is set."
	throw "The package version could not be determined. Ensure that the build-time token `$version$` is replaced or the ChocolateyPackageVersion environment variable is set."

[Copilot]

The checksum token is mandatory for Chocolatey package security (as mentioned in the PR description). If the $checksum$ token is not found in the install script, the function should exit with an error rather than just printing a warning and continuing. This would prevent accidentally packaging an install script without checksum verification, which would be a security issue.

Suggested change

	print("Warning: checksum token not found in install script", file=sys.stderr)
	return
	print("✗ Error: checksum token ($checksum$) not found in install script. Aborting build.", file=sys.stderr)
	sys.exit(1)

[Copilot]

The function should verify that the $version$ token exists in the nuspec file before performing the replacement. If the token is missing, the package would be created with an invalid version, which could cause issues during publication or installation. Consider adding a check similar to the one in inject_checksum (but as an error rather than a warning).

Suggested change

	content = NUSPEC.read_text(encoding="utf-8").replace("$version$", version)
	content = NUSPEC.read_text(encoding="utf-8")
	if "$version$" not in content:
	print("✗ Error: $version$ token not found in nuspec template.", file=sys.stderr)
	sys.exit(1)
	content = content.replace("$version$", version)