chore(release): enrich chocolatey nuspec metadata per moderation guidelines

[Matovidlo]

Summary

Enriches the Chocolatey package nuspec (build/package/chocolatey/keboola-cli2.nuspec) to address the Guidelines flagged by chocolatey-ops on the keboola-cli2 0.66.1 moderation review.

• Add packageSourceUrl, projectSourceUrl, bugTrackerUrl
• Add releaseNotes as a URL to the releases page (moderator-endorsed form → never needs per-version edits)
• Add copyright
• Stage a commented-out iconUrl (jsDelivr CDN) ready to enable once an icon PNG is committed — left off deliberately to avoid a 404 link, which is worse than omitting it

Context — why the Chocolatey channel is currently stuck (not this PR)

The 403 Forbidden on choco push for 0.71.0 / 0.72.0 is not a pipeline or key bug. It's the documented Chocolatey behavior: a package with a version in moderation and no approved version rejects new-version pushes with 403. keboola-cli2 0.66.1 passed automated validation on 2026-07-15 with zero Requirements and is simply waiting in the human moderation queue. When a moderator approves 0.66.1, the block lifts and 0.71/0.72 can push (re-run the failed job, no new tag needed).

The reviewer's comments were all Guidelines / Suggestions / Notes — explicitly "fix for next time," approvable without them. This PR is that quality polish; it ships with the next published version.

Impact analysis

• build/package/chocolatey/keboola-cli2.nuspec: additive metadata only. XML validated well-formed.
• No workflow change, no secret change, no behavior change to the built binary.
• Fully backwards-compatible; affects only the metadata shown on the Chocolatey package page.

Test plan

• python3 -c "import xml.dom.minidom; xml.dom.minidom.parse(...)" → XML well-formed ✅
• iconUrl intentionally commented until build/package/chocolatey/keboola.png is committed; uncomment then.

Change type

Chore — Chocolatey packaging metadata quality (no functional change)

Related

• Chocolatey moderation review for keboola-cli2 0.66.1 (chocolatey-ops, 2026-07-15)
• Related infra: winget bootstrap blocked separately (winget: first-ever release run fails — package was never bootstrapped in microsoft/winget-pkgs #484)

Deployment

Merge & picked up by the next release's chocolatey packaging step. No migration.

Rollback plan

Revert of this PR.

Post release support plan

None.

[Matovidlo]

@claude review

[Copilot]

Pull request overview

Updates the Chocolatey nuspec metadata for keboola-cli2 to better align with Chocolatey moderation guidelines, improving the package’s listing quality without changing any runtime behavior.

Changes:

• Added repository/source metadata fields (packageSourceUrl, projectSourceUrl, bugTrackerUrl).
• Added URL-form releaseNotes and copyright.
• Staged (commented-out) iconUrl with guidance for enabling it once an icon asset exists.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[padak]

Review — chore(release): enrich chocolatey nuspec metadata

Verdict: no blockers. Additive metadata only; the release pipeline cannot break on this. A few accuracy notes below, plus one gap between what the PR title claims and what the diff does.

Verified safe (not just assumed)

Check	Result
XML well-formed	✅ parsed locally
packageSourceUrl / projectSourceUrl / bugTrackerUrl / docsUrl accepted by choco pack	✅ these are Chocolatey-only nuspec extensions — the official choco template states they "can ONLY be used by choco tools"; nuget.exe ignores them. Pipeline uses choco pack (.github/workflows/release-kbagent.yml:491), so fine.
Element ordering	✅ irrelevant — nuspec.xsd models metadata as xs:all, not xs:sequence
{VERSION} substitution unaffected	✅ workflow only does a string .Replace('{VERSION}', …); no new placeholder introduced
Merge state	✅ MERGEABLE, all checks green. Branch is behind main (fe662ed) but build/package/chocolatey/ has not changed on main since 2b7a6af → no conflict

---

🟡 1. The PR does less than the title claims — the one actual Guideline is unaddressed

Chocolatey's validator rules are tiered. Checked against the published rule list:

• CPMR0057 "Nuspec Enhancements Missing" (the packageSourceUrl / docsUrl / bugTrackerUrl / projectSourceUrl family this PR adds) → classified Suggestion
• CPMR0033 "IconUrl Missing" → classified Guideline — and this PR does not address it

So the title "per moderation guidelines" is inverted: the Suggestion is fixed, the Guideline is not. The first commit staged a commented-out iconUrl; the current diff has dropped it entirely, so nothing about the icon remains even as a marker.

If the intent is to actually clear the Guideline, commit an icon and enable iconUrl. Two rules constrain the choice, worth capturing now so the follow-up doesn't bounce:

• CPMR0076 "Raw GitHub Icon URL Is Used" → Requirement — raw.githubusercontent.com is rejected; the jsDelivr CDN form from the original PR description was the correct instinct
• CPMR0058 "Use PNG or SVG for package icons" → Suggestion

Either land the icon here or open a follow-up issue so it isn't lost.

🟡 2. <owners>Matovidlo</owners> — correct value, undocumented coupling

The value is factually right: owners means package maintainer (not software author — that's authors, correctly Keboola), and the live package page at community.chocolatey.org/packages/keboola-cli2 does link profiles/Matovidlo as maintainer. No moderation problem.

The concern is operational: this ties a repo-level, org-owned file to one person's Chocolatey account, and the binding is invisible. The account it must match is whoever owns the CHOCOLATEY_KEY secret. If that secret is ever rotated to another account, or Martin stops maintaining the package, nothing in the repo signals that this line went stale.

Cheapest fix — a one-line comment next to it:

<!-- owners = package maintainer on community.chocolatey.org; must match the
     account behind the CHOCOLATEY_KEY secret. Update both together. -->
<owners>Matovidlo</owners>

Adding the org alongside (Keboola, Matovidlo) is also valid, if the org has a Chocolatey account.

🟡 3. PR description no longer matches the diff

The body describes a commented-out iconUrl (absent from the file) and doesn't mention owners or docsUrl, both added 8 days later in 27d5be1e. The Copilot review above reviewed the earlier state. Worth refreshing the body before merge — the description is what a future reader hits first when asking why these fields exist.

---

🟢 Nits

packageSourceUrl points at the repo root. By convention it points at the packaging source (where the nuspec lives), while projectSourceUrl points at the software. The reference template published packages follow does exactly that split. As written, packageSourceUrl == projectSourceUrl == projectUrl, so two of the three new URL fields carry no information a moderator or user doesn't already have:

<packageSourceUrl>https://github.com/keboola/cli/tree/main/build/package/chocolatey</packageSourceUrl>

docsUrl → https://help.keboola.com/ is platform documentation, not CLI documentation. Someone clicking "Documentation" on the package page gets Keboola Connection docs, not kbagent usage. https://github.com/keboola/cli/tree/main/docs (or the README) is what the field is asking for.

copyright → Keboola clears CPMR0001 (Requirement: ≥4 characters), so this is purely cosmetic. Convention is year + vendor (2025-2026 Keboola); a range avoids an annual edit.

---

On the 403 push block

Agreed, and worth stating explicitly for anyone reading this later: the 403 on choco push for 0.71.0 / 0.72.0 is not caused by anything in this PR, and this PR does not unblock it either. Merging this is quality polish that ships with the next published version — the moderation queue still has to clear 0.66.1 first.

[Matovidlo]

Thanks for the thorough pass — all four addressed in 1acb7d6:

1. Icon added (https://components.keboola.com/assets/default-app-icon-DGCyIYB1.png, PNG, not raw.githubusercontent → CPMR0033/CPMR0076 clear).
2. owners now has the CHOCOLATEY_KEY-coupling comment you suggested.
3. packageSourceUrl now points at build/package/chocolatey instead of duplicating projectSourceUrl.
4. docsUrl → github.com/keboola/cli/tree/main/docs instead of help.keboola.com; copyright → 2025-2026 Keboola.

Re-requesting your review.

[padak]

Approving — no blockers. Additive metadata only, choco pack compatibility verified, checks green.

The nits in my earlier review (packageSourceUrl scope, docsUrl target, copyright year, the owners coupling comment) are all non-binding — take them or leave them.

One ask before merging, though: please refresh the PR description first. It still describes a commented-out iconUrl that is no longer in the diff, and doesn't mention owners / docsUrl added in 27d5be1. This repo squash-merges, and GitHub pre-fills the squash commit message from the PR body — so the stale description would land in main's history as the permanent record of why these fields exist. Either update the body, or override --body at merge time.

The iconUrl gap (CPMR0033, the one actual Guideline) is fine to defer — just worth a follow-up issue so it isn't lost.