Sync upstream main while preserving Slovenian and fork features

.github/workflows/chocolatey-release.yml

@@ -37,42 +37,82 @@ jobs:
           (Get-Content $nuspec)  -replace 'REPLACE_VERSION', $version | Set-Content $nuspec
           (Get-Content $install) -replace 'REPLACE_HASH',    $hash    | Set-Content $install
 
+          # Chocolatey moderation rejects links it cannot use, so check them before submitting.
+          # A 403 or 429 from this runner is not a broken link: Cloudflare in front of our own sites
+          # and jsDelivr refuse many GitHub runner addresses while the same page loads for people and
+          # for moderators. Only a missing page, an unreachable host or a raw.githubusercontent.com
+          # link stops the push.
+          [xml]$spec = Get-Content $nuspec -Raw
+          $meta = $spec.package.metadata
+          $problems = @()
+          foreach ($field in 'packageSourceUrl','projectUrl','iconUrl','licenseUrl','projectSourceUrl','docsUrl','bugTrackerUrl','releaseNotes') {
+              $url = [string]$meta.$field
+              if ($url -notmatch '^https?://') { continue }
+              if (([uri]$url).Host -eq 'raw.githubusercontent.com') { $problems += "$field uses raw.githubusercontent.com, which Chocolatey does not accept: $url"; continue }
+              try { $null = Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 60 }
+              catch {
+                  $status = 0
+                  if ($_.Exception.Response) { $status = [int]$_.Exception.Response.StatusCode }
+                  if ($status -eq 403 -or $status -eq 429) {
+                      Write-Host "::warning::$field answered $status to this runner, which is bot protection refusing GitHub's addresses, not a missing page: $url"
+                      continue
+                  }
+                  $problems += "$field did not load: $url ($($_.Exception.Message))"
+              }
+          }
+          if ($problems) { $problems | ForEach-Object { Write-Host "::error::$_" }; throw "The nuspec has links Chocolatey moderation will reject." }
+
           # Pack and push
           choco pack choco\killerscan.nuspec --out "$env:RUNNER_TEMP"
           if ($LASTEXITCODE -ne 0) { throw "choco pack failed." }
           $package = "$env:RUNNER_TEMP\killerscan.$version.nupkg"
           choco push $package --source https://push.chocolatey.org --api-key $env:CHOCO_API_KEY
-          if ($LASTEXITCODE -ne 0) { throw "choco push failed." }
+          if ($LASTEXITCODE -ne 0) {
+              # Chocolatey answers most rejections with a bare 403, so report what the package page shows.
+              $page = "https://community.chocolatey.org/packages/killerscan"
+              try {
+                  $html = (Invoke-WebRequest $page -UseBasicParsing -TimeoutSec 60).Content
+                  foreach ($row in [regex]::Matches($html, '<td class="version"\s*>[\s\S]*?<span>([^<]+)</span>[\s\S]*?</tr>')) {
+                      $held = $row.Groups[1].Value.Trim()
+                      $badge = [regex]::Match($row.Value, 'class="badge[^"]*">([^<]+)<').Groups[1].Value.Trim()
+                      if ($badge -and $badge -notmatch 'Approved|Exempted') { Write-Host "::error::Version $held is in moderation: $badge. See $page/$held" }
+                  }
+              } catch { Write-Host "Could not read $page : $($_.Exception.Message)" }
+              throw "choco push was rejected. An earlier version in moderation with none approved blocks new pushes. Other causes are an API key that does not own the package or a version that already exists."
+          }
           "CHOCO_VERSION=$version" >> $env:GITHUB_ENV
           "CHOCO_PACKAGE=$package" >> $env:GITHUB_ENV
 
       # A successful push is not an accepted package. Chocolatey validates it later, and its
       # validator sometimes fails with "We were unable to find a package" while its own service
       # is degraded; its instruction is to upload the package again. Watch the result, re-push
       # once on a failure, and fail this job if validation still fails so it never goes unnoticed.
+      # The package page is cached and can show Pending for hours after validation passes, so the
+      # result is read from the package feed instead.
       - name: Wait for Chocolatey validation
         shell: pwsh
         timeout-minutes: 170
         env:
           CHOCO_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
         run: |
           $page = "https://community.chocolatey.org/packages/killerscan/$env:CHOCO_VERSION"
+          $feed = "https://community.chocolatey.org/api/v2/Packages(Id='killerscan',Version='$env:CHOCO_VERSION')"
           $repushed = $false
           $pendingSinceRepush = $false
           $deadline = (Get-Date).AddMinutes(160)
           while ((Get-Date) -lt $deadline) {
               Start-Sleep -Seconds 300
               try {
-                  $html = (Invoke-WebRequest $page -UseBasicParsing -TimeoutSec 90).Content
+                  $entry = (Invoke-WebRequest $feed -UseBasicParsing -TimeoutSec 90).Content
               } catch {
-                  Write-Host "Package page unavailable: $($_.Exception.Message). Retrying."
+                  Write-Host "Package feed unavailable: $($_.Exception.Message). Retrying."
                   continue
               }
-              $state = [regex]::Match($html, 'Validation Testing (Passed|Failed|Pending)').Groups[1].Value
+              $state = [regex]::Match($entry, '<d:PackageValidationResultStatus>(\w+)</d:PackageValidationResultStatus>').Groups[1].Value
               Write-Host "$(Get-Date -Format HH:mm:ss) validation: $(if ($state) { $state } else { 'not shown' })"
-              if ($state -eq 'Passed') { exit 0 }
-              if ($state -eq 'Pending' -and $repushed) { $pendingSinceRepush = $true }
-              if ($state -ne 'Failed') { continue }
+              if ($state -like 'Pass*') { exit 0 }
+              if ($repushed -and $state -and $state -notlike 'Fail*') { $pendingSinceRepush = $true }
+              if ($state -notlike 'Fail*') { continue }
               if (-not $repushed) {
                   Write-Host "Validation failed. Pushing the same package again as Chocolatey instructs."
                   choco push $env:CHOCO_PACKAGE --source https://push.chocolatey.org --api-key $env:CHOCO_API_KEY
@@ -82,4 +122,7 @@ jobs:
                   throw "Chocolatey validation failed twice. See $page"
               }
           }
-          throw "Chocolatey validation did not pass within 160 minutes. See $page"
+          # Chocolatey's queue often takes longer than this. The package is already pushed, so a
+          # validation that is still pending is a warning, not a failed release.
+          Write-Host "::warning::Chocolatey validation was still pending after 160 minutes. The package was pushed. See $page"
+          exit 0

.github/workflows/winget-release.yml

@@ -36,6 +36,11 @@ jobs:
   submit:
     runs-on: windows-latest
     steps:
+      # The WinGet description comes from the Chocolatey nuspec at the released tag.
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name || github.event.inputs.tag }}
+
       # Prints what WINGET_TOKEN actually is, so a failure downstream is never guesswork again.
       # An empty x-oauth-scopes means a FINE-GRAINED token, which authenticates fine, reads fine,
       # and cannot create the branch komac needs. That failure is reported as
@@ -157,6 +162,23 @@ jobs:
           Set-Content $installer $text -NoNewline -Encoding utf8
           Select-String -Path $installer -Pattern 'InstallerType|DisplayVersion'
 
+          # komac also copies the previous locale manifest, which carried a Description cut off
+          # mid-word and the old website. Fill both description fields with the nuspec's one-line
+          # summary. The full feature list sent 1.8.2 and 1.8.3 to manual policy review
+          # (Policy-Test-2.7); the short text is what passed automatically before.
+          [xml]$spec = Get-Content (Join-Path $env:GITHUB_WORKSPACE 'choco\killerscan.nuspec') -Raw
+          $meta = $spec.package.metadata
+          $summary = $meta.summary.Trim()
+          if ($summary.Length -gt 256) { Write-Error "The nuspec summary is longer than WinGet's 256-character ShortDescription"; exit 1 }
+          $locale = Join-Path $dir 'SteveTheKiller.KillerScan.locale.en-US.yaml'
+          if (-not (Test-Path $locale)) { Write-Error "komac did not write $locale"; exit 1 }
+          $loc = (Get-Content $locale -Raw) -replace '\r\n', "`n"
+          $loc = [regex]::Replace($loc, '(?m)^PackageUrl:[^\n]*', { param($m) 'PackageUrl: ' + $meta.projectUrl.Trim() })
+          $loc = [regex]::Replace($loc, '(?m)^ShortDescription:[^\n]*', { param($m) "ShortDescription: '" + $summary.Replace("'", "''") + "'" })
+          $loc = [regex]::Replace($loc, '(?m)^Description:[^\n]*\n(?:(?:[ \t]+[^\n]*)?\n)*?(?=[A-Za-z])', { param($m) "Description: '" + $summary.Replace("'", "''") + "'`n" })
+          Set-Content $locale $loc -NoNewline -Encoding utf8
+          Select-String -Path $locale -Pattern '^(PackageUrl|ShortDescription|Description):'
+
           # komac picks a fresh GUID for its branch name every run, so a retry never collides
           # with a half-finished attempt.
           $delays = @(60, 150, 300)