fix: correct LuCLI release asset URLs in distribution drafts

[bpamiri]

Summary

Develop snapshot CI run 25636562099 failed at the Build Linux packages (.deb / .rpm) step with curl: (22) ... 404. Root cause: my draft URLs assumed arch-split asset names (lucli-0.3.7-linux-x64, lucli-0.3.7-macos-arm64, etc.) but cybersonic/LuCLI v0.3.7 ships single binaries per OS.

Verified against actual release:

$ gh release view v0.3.7 --repo cybersonic/LuCLI --json assets
  lucli-0.3.7-linux       (Linux x86_64)
  lucli-0.3.7-macos       (macOS universal)
  lucli-0.3.7.bat         (Windows wrapper)
  lucli-0.3.7.jar
  lucli.jar

Fixed

File	Change	Active?
build-linux-packages.sh	-linux-x64 → -linux	✅ runs in CI; this fix unblocks snapshot publishing
wheels-be.rb (homebrew draft)	Collapse on_arm/on_intel into single on_macos; drop -x64/-arm64 suffixes	❌ not pushed yet
wheels.json, wheels-be.json (scoop drafts)	-windows-x64.exe → .bat	❌ scoop bucket not created

Test plan

• CI green (commitlint expects bare fix: or fix(scope): — no scope here since the change spans drafts in multiple subsystems)
• After merge, develop snapshot run reaches Create Snapshot Pre-Release step (was previously skipped due to this failure)
• First release lands at https://github.com/wheels-dev/wheels-snapshots/releases

Note for Tuesday GA

Stable (main) runs the same nfpm step, so this fix is also required for v4.0.0 GA tag publishing. Without it, GA day's release would hit the same 404. Merging here, before Tuesday, addresses both.

Refs

#2545 (introduced the wrong URLs in draft state).
#2546 (last fix; this is the next failure surfaced post-merge).

[wheels-bot]

Wheels Bot — Reviewer A

TL;DR — This PR fixes a CI-blocking 404 in the Linux package build step by correcting the LuCLI download URL from the non-existent arch-suffixed form to the actual asset name, and applies the same correction to the Homebrew and Scoop distribution drafts. The primary fix is correct and targeted. One forward-looking concern with the Scoop manifests is flagged below, but since those are explicitly not-yet-deployed drafts the overall verdict is comment — no changes required to unblock the CI fix.

---

Correctness

build-linux-packages.sh line 25 — fix is accurate.

-LUCLI_LINUX_URL="${LUCLI_LINUX_URL:-https://github.com/cybersonic/LuCLI/releases/download/v${LUCLI_VERSION}/lucli-${LUCLI_VERSION}-linux-x64}"
+LUCLI_LINUX_URL="${LUCLI_LINUX_URL:-https://github.com/cybersonic/LuCLI/releases/download/v${LUCLI_VERSION}/lucli-${LUCLI_VERSION}-linux}"

Matches the actual v0.3.7 release asset name. Other CI workflows (snapshot.yml line 40, pr.yml line 49, release.yml line 582) already used the no-suffix form; this brings the build script into alignment.

wheels-be.rb — collapsing on_arm/on_intel into a single on_macos block is correct given LuCLI ships a universal binary. The added comment citing gh release view v0.3.7 as source-of-truth is good practice for future maintainers.

Scoop manifests — potential missing JAR dependency (not a blocker today, but flag before go-live)

Both wheels.json and wheels-be.json now download lucli-0.3.7.bat as the Windows launcher:

"https://github.com/cybersonic/LuCLI/releases/download/v0.3.7/lucli-0.3.7.bat"

and invoke it directly in post_install:

"$dir\\lucli-0.3.7.bat" %*

The .bat file is a Windows wrapper script. LuCLI's v0.3.7 release also ships lucli-0.3.7.jar and lucli.jar, which the bat launcher calls internally (standard pattern for Java CLI wrappers). The Scoop manifests download only the .bat — the JAR is absent. When the Scoop bucket is eventually created and a user runs scoop install wheels, the invocation of lucli-0.3.7.bat will fail with a missing JAR error.

The PR correctly marks these files as ❌ scoop bucket not created, so there is no user-facing breakage today. Before activating the Scoop bucket, the manifest should be updated to also download lucli-0.3.7.jar (or lucli.jar) into $dir. Suggest tracking this as a follow-up issue so it doesn't get lost before GA.

---

Commits

Single commit: fix: correct LuCLI release asset URLs in distribution drafts

• Type fix — valid per commitlint.config.js
• No scope — appropriate since the change spans three distribution subsystems
• Subject is non-empty, not ALL-CAPS, and well within 100 chars

Conforms to convention.

---

Tests

No automated test coverage for distribution artifact scripts — consistent with the rest of the tools/distribution-drafts/ directory. The CI pipeline itself (release.yml calling build-linux-packages.sh) is the effective integration test for the Linux path, which is the intended verification as stated in the PR test plan.

---

Security

SHA256 values remain 0000... placeholders in all draft files. This is a pre-existing condition explicitly acknowledged in comments and acceptable for draft assets. Worth noting that build-linux-packages.sh fetches the LuCLI binary with curl -fsSL without SHA verification — also pre-existing and not introduced by this PR, but worth a follow-up hardening ticket before GA.

[wheels-bot]

Wheels Bot -- Reviewer B (round 1)

A's review is solid. No sycophancy, no false positives I can identify, and the one forward-looking concern about the Scoop JAR dependency is substantive and correctly scoped as non-blocking. Verdict alignment is correct. Converging on approve.

Sycophancy

None detected. A used COMMENTED (not approve), raised real concerns, and avoided blanket praise despite the fix being narrow and straightforward.

False positives

None detected.

• A's claim that snapshot.yml, pr.yml, and release.yml already used the no-suffix URL form is verified: all three reference lucli-${LUCLI_VERSION}-linux at the lines cited.
• The Homebrew collapse from on_arm/on_intel to a single on_macos block is accurately described given a universal binary.
• The Scoop JAR concern (A's main flag) is at minimum plausible: lucli-0.3.7.bat is a Java wrapper script; if the JAR is not bundled inside wheels-cli-*.zip, a user running scoop install wheels would hit a missing-JAR error. A correctly marks this non-blocking because the Scoop bucket does not exist yet, and suggests a follow-up issue. That framing is right.

Missed issues

None detected. The diff is narrow -- four URL string substitutions across three distribution-draft files. A covered the only substantive forward-looking risk (Scoop JAR), noted the pre-existing SHA256 placeholder situation, and noted the pre-existing absence of SHA verification in the curl invocation. Nothing was glossed over.

Verdict alignment

A's COMMENTED (no changes required) verdict is consistent with the findings. The primary CI fix is correct and unblocks snapshot publishing; the Scoop concern is real but not a reason to hold the PR.

Convergence

Aligned. A and I agree: the Linux package build fix is correct, the Homebrew and Scoop draft corrections follow the same logic, and no changes are needed before merging. The Scoop JAR dependency should be tracked as a follow-up issue before the Scoop bucket is activated. Joint recommendation: approve and merge.