feat(install): add curl-able install script for release binaries

[reubeno]

Adds scripts/install/install.sh, which installs brush from official GitHub releases: picks the target (glibc >= 2.34 or the static musl build on Linux), resolves "latest" to a tag once, verifies the SHA-256 checksum and, when gh >= 2.68 is available, the build attestation (--require-attestation makes that mandatory). The script never touches gh's auth state; if gh reports it has no credentials (exit status 4), verification is skipped with a note pointing out the stronger check an authenticated gh would provide. Installs to $XDG_BIN_HOME if set, else ~/.local/bin. Stages to a mktemp name next to the destination, checks the binary runs, then renames atomically. Notes when the install dir isn't on PATH or is shadowed.

Includes a pytest suite exercising real releases with tool shims, run in CI (via uvx, pytest pinned to 8.x) across Linux/macOS plus Alpine and AlmaLinux 8 containers and weekly, plus README instructions. The CD workflow gains a comment listing everything the installer depends on, including the glibc floor.

Assisted-By: Claude Fable 5.1

[github-actions]

Performance Benchmark Report

Code Coverage Report: Only Changed Files listed

Package	Base Coverage	New Coverage	Difference
Overall Coverage	🟢 76.71%	🟢 76.71%	⚪ 0%

Minimum allowed coverage is 70%, this run produced 76.71%
Maximum allowed coverage difference is -5%, this run produced 0%

Test Summary: bash-completion test suite

Outcome	Count	Percentage
✅ Pass	1587	75.25
❗️ Error	17	0.81
❌ Fail	151	7.16
⏩ Skip	339	16.07
❎ Expected Fail	13	0.62
✔️ Unexpected Pass	2	0.09
📊 Total	2109	100.00

[github-actions]

Test Results

    5 files     49 suites   22m 58s ⏱️
2 949 tests 2 949 ✅ 0 💤 0 ❌
9 145 runs  9 145 ✅ 0 💤 0 ❌

Results for commit 7008210.

♻️ This comment has been updated with latest results.

[Copilot]

🟡 Changes recommended

The documented curl pipelines can mask download failures, and glibc target selection lacks positive-path coverage.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds a release-binary installer with checksum and optional attestation verification.

Changes:

• Adds portable target detection and atomic installation.
• Adds cross-platform pytest coverage and CI.
• Documents curl-based installation and release dependencies.

File summaries

File	Description
scripts/install/install.sh	Implements secure release installation.
scripts/install/tests/test_install.py	Tests installation and failure paths.
.github/workflows/install-script.yaml	Runs installer tests across platforms.
.github/workflows/cd.yaml	Documents installer/release coupling.
README.md	Adds installation instructions.

Review details

Suppressed comments (2)

README.md:147

• As written, a failed curl can still make the overall pipeline succeed because POSIX pipelines report the final sh process's status; empty input exits successfully. Please replace this with an invocation that propagates download failures so scripted installs cannot silently do nothing.

curl --proto '=https' --tlsv1.2 -fsSL https://raw.githubusercontent.com/reubeno/brush/main/scripts/install/install.sh | sh

scripts/install/install.sh:134

• The suite only asserts the old-glibc fallback; the normal Linux install tests do not assert which archive was selected. A regression that sends glibc 2.34+ systems to the musl build would still pass because that binary also runs there. Add a getconf shim returning 2.34 or newer and assert that the GNU asset is downloaded.

            if printf '2.34\n%s\n' "${glibc_version}" | sort -CV 2>/dev/null; then
                target="${arch}-unknown-linux-gnu"
            else
                target="${arch}-unknown-linux-musl"

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.