fix(ci): accept multi-arch Scoop manifests in validator

.github/workflows/validate-packages.yml

@@ -37,18 +37,64 @@ jobs:
           import glob
           import json
 
-          required = {"version", "description", "homepage", "license", "url", "hash"}
+          # Top-level keys every manifest must carry.
+          top_required = {"version", "description", "homepage", "license"}
+          # url + hash may live either at the root OR nested under
+          # architecture.{32bit,64bit,arm64}.* for multi-arch manifests
+          # (GoReleaser v2, modern Scoop). Either shape is valid.
+          arch_required = {"url", "hash"}
+          arch_keys = {"64bit", "32bit", "arm64"}
+
           files = glob.glob("bucket/*.json")
           if not files:
               print("No Scoop manifests found")
               raise SystemExit(0)
 
+          errors = []
           for path in files:
               with open(path, "r", encoding="utf-8") as f:
                   data = json.load(f)
-              missing = required - set(data)
-              if missing:
-                  raise SystemExit(f"{path}: missing required keys: {', '.join(sorted(missing))}")
+
+              missing_top = top_required - set(data)
+              if missing_top:
+                  errors.append(f"{path}: missing top-level keys: {', '.join(sorted(missing_top))}")
+                  continue
+
+              root_has_url_hash = arch_required.issubset(data.keys())
+              arch = data.get("architecture")
+
+              if root_has_url_hash:
+                  # Single-arch manifest — fine.
+                  continue
+
+              if not isinstance(arch, dict) or not arch:
+                  errors.append(
+                      f"{path}: must have top-level url+hash OR an architecture.{{64bit|32bit|arm64}} block"
+                  )
+                  continue
+
+              present_arches = [a for a in arch_keys if a in arch]
+              if not present_arches:
+                  errors.append(
+                      f"{path}: architecture block has no known arch key ({', '.join(sorted(arch_keys))})"
+                  )
+                  continue
+
+              for a in present_arches:
+                  block = arch.get(a)
+                  if not isinstance(block, dict):
+                      errors.append(f"{path}: architecture.{a} is not an object")
+                      continue
+                  missing = arch_required - set(block)
+                  if missing:
+                      errors.append(
+                          f"{path}: architecture.{a} missing: {', '.join(sorted(missing))}"
+                      )
+
+          if errors:
+              for e in errors:
+                  print(e)
+              raise SystemExit(1)
           print(f"Validated {len(files)} Scoop manifest(s)")
           PY
 

CLAUDE.md

@@ -9,7 +9,7 @@ domain: technical
 
 Unified package repository for every `jbcom/*` project. Ships Homebrew,
 Scoop, and Chocolatey packages from one git tree plus an auto-generated
-Astro static site at <https://jbcom.github.io/pkgs/>.
+Astro static site at <https://jonbogaty.com/pkgs/>.
 
 ## Critical rules
 
@@ -71,7 +71,7 @@ Upstream projects write manifests here on every tagged release:
   commit manifests here.
 
 The Astro site rebuilds automatically on every push to `main`, so
-new packages appear on <https://jbcom.github.io/pkgs/> within minutes
+new packages appear on <https://jonbogaty.com/pkgs/> within minutes
 of the upstream release landing here.
 
 ## What jbcom/pkgs is NOT

README.md

@@ -2,7 +2,7 @@
 
 Unified package repository for every `jbcom/*` project — Homebrew,
 Scoop, and Chocolatey from one git tree. Public package index at
-<https://jbcom.github.io/pkgs/>.
+<https://jonbogaty.com/pkgs/>.
 
 ## Install
 
@@ -142,7 +142,7 @@ PY
 
 `deploy.yml` runs on every push to `main` using `withastro/action@v6`.
 The built site is deployed to GitHub Pages at
-<https://jbcom.github.io/pkgs/>.
+<https://jonbogaty.com/pkgs/>.
 
 ## License
 

astro.config.mjs

@@ -8,10 +8,11 @@ import { ViteToml } from "vite-plugin-toml";
 import tailwindcss from "@tailwindcss/vite";
 
 // jbcom/pkgs — package index site
-// Served at https://jbcom.github.io/pkgs per Astro's GitHub Pages guide.
+// Served at https://jonbogaty.com/pkgs/ via GitHub Pages custom-domain
+// routing. jbcom.github.io/pkgs/ 301-redirects here automatically.
 
 export default defineConfig({
-  site: "https://jbcom.github.io",
+  site: "https://jonbogaty.com",
   base: "/pkgs",
   integrations: [
     vue(),

docs/ARCHITECTURE.md

@@ -82,17 +82,21 @@ tap git tree directly.
 - **Deployed** via `withastro/action@v6` (auto-detects pnpm) to GitHub
   Pages with base path `/pkgs`
 
-## Why not subpath under custom domain (jonbogaty.com/pkgs)?
+## Site serves at jonbogaty.com/pkgs/
 
-Astro's official GitHub Pages guide only supports either:
+The operator's apex domain `jonbogaty.com` already CNAMEs to
+`jbcom.github.io`, so GitHub Pages transparently serves `/pkgs/` at
+`https://jonbogaty.com/pkgs/`. `jbcom.github.io/pkgs/` 301-redirects
+to the canonical URL.
 
-- Project page (`jbcom.github.io/pkgs`) with `base: '/pkgs'`
-- Custom domain with `site: 'https://custom.tld'` and **no base**
+Astro's `astro.config.mjs` uses `site: 'https://jonbogaty.com'` +
+`base: '/pkgs'` — this feeds correct absolute URLs into sitemap and OG
+metadata while internal routing stays subpath-relative.
 
-Serving `jonbogaty.com/pkgs` requires an external reverse proxy
-(Cloudflare Worker, Netlify rewrite, Caddy) that maps that path to
-`jbcom.github.io/pkgs/`. That's a future-operator decision; the repo
-itself is deployed at `jbcom.github.io/pkgs` today.
+No CNAME file is needed in `public/` because the apex-domain CNAME is
+configured repo-wide (pages settings), not per-repo via file. Adding a
+`public/CNAME` would *break* the `/pkgs` base path by treating the
+repo as apex-mode.
 
 ## Dependencies
 

docs/DEPLOYMENT.md

@@ -11,7 +11,7 @@ domain: ops
 
 | Env | URL | Trigger |
 |-----|-----|---------|
-| Production | <https://jbcom.github.io/pkgs/> | Push to `main` |
+| Production | <https://jonbogaty.com/pkgs/> | Push to `main` |
 | Preview | Local (`pnpm dev`) | `localhost:4321/pkgs/` |
 
 There is no staging environment. Previews happen locally.
@@ -53,20 +53,23 @@ Or:
 
 - GitHub Pages build status: <https://github.com/jbcom/pkgs/deployments>
 - Workflow runs: <https://github.com/jbcom/pkgs/actions>
-- Site health: manual check at <https://jbcom.github.io/pkgs/>
+- Site health: manual check at <https://jonbogaty.com/pkgs/>
 
 No uptime SLA. If the site is down for more than an hour during a
 release window, escalate via the upstream project's issue tracker.
 
 ## DNS / custom domain
 
-Currently served on the GitHub-issued subdomain
-(`jbcom.github.io/pkgs`). To serve `jonbogaty.com/pkgs` in the future:
+The operator's apex `jonbogaty.com` already CNAMEs to
+`jbcom.github.io`. GitHub Pages transparently serves every `jbcom/*`
+repo's pages subpath at the matching URL on the apex, so this repo
+is live at `https://jonbogaty.com/pkgs/` with no additional config.
 
-1. Configure Cloudflare (or equivalent CDN) to proxy
-   `jonbogaty.com/pkgs/*` → `jbcom.github.io/pkgs/*`
-2. Do NOT add a `public/CNAME` file — per Astro docs, that converts
-   the site to apex-domain mode and breaks the `/pkgs` base path
+`jbcom.github.io/pkgs/` 301-redirects to the apex, so operators
+following the GitHub URL end up in the right place.
+
+Do NOT add a `public/CNAME` file. That converts this repo to
+apex-domain mode and would break the `/pkgs` base path.
 
 ## Broken-build triage
 

docs/STATE.md

@@ -29,8 +29,6 @@ publish from `jbcom/radioactive-ralph`.
   the seeded manifests
 - A non-Go publishing workflow template for `jbcom/paranoid-passwd`
   and other CMake/C projects (no GoReleaser equivalent)
-- Reverse-proxy setup for `jonbogaty.com/pkgs` → `jbcom.github.io/pkgs`
-  (optional; current deploy works at the GitHub-issued subdomain)
 
 ## Active owners