Add support for checksums in Chocolatey

Author: hamzaremmal

.github/workflows/build-chocolatey.yml

@@ -15,10 +15,13 @@ on:
     inputs:
       version:
         required: true
-        type: string
+        type    : string
       url:
         required: true
-        type: string
+        type    : string
+      digest:
+        required: true
+        type    : string
 
 jobs:
   build:
@@ -37,6 +40,12 @@ jobs:
           files: ./pkgs/chocolatey/tools/chocolateyInstall.ps1
           search-text: '@LAUNCHER_URL@'
           replacement-text: ${{ inputs.url }}
+      - name: Replace the CHECKSUM placeholder
+        uses: richardrigutins/replace-in-files@v2
+        with:
+          files: ./pkgs/chocolatey/tools/chocolateyInstall.ps1
+          search-text: '@LAUNCHER_SHA256@'
+          replacement-text: ${{ inputs.digest }}
       - name: Build the Chocolatey package (.nupkg)
         run: choco pack ./pkgs/chocolatey/scala.nuspec --out ./pkgs/chocolatey
       - name: Upload the Chocolatey package to GitHub

.github/workflows/build-sdk.yml

@@ -36,18 +36,22 @@ on:
       win-x86_64-id:
         description: ID of the `win x86-64` package from GitHub Artifacts (Authentication Required)
         value      : ${{ jobs.build.outputs.win-x86_64-id }}
+      win-x86_64-digest:
+        description: The SHA256 of the uploaded artifact (`win x86-64`)
+        value      : ${{ jobs.build.outputs.win-x86_64-digest }}
 
 
 jobs:
   build:
     runs-on: ubuntu-latest
     outputs:
-      universal-id    : ${{ steps.universal.outputs.artifact-id }}
-      linux-x86_64-id : ${{ steps.linux-x86_64.outputs.artifact-id }}
-      linux-aarch64-id: ${{ steps.linux-aarch64.outputs.artifact-id }}
-      mac-x86_64-id   : ${{ steps.mac-x86_64.outputs.artifact-id }}
-      mac-aarch64-id  : ${{ steps.mac-aarch64.outputs.artifact-id }}
-      win-x86_64-id   : ${{ steps.win-x86_64.outputs.artifact-id }}
+      universal-id     : ${{ steps.universal.outputs.artifact-id }}
+      linux-x86_64-id  : ${{ steps.linux-x86_64.outputs.artifact-id }}
+      linux-aarch64-id : ${{ steps.linux-aarch64.outputs.artifact-id }}
+      mac-x86_64-id    : ${{ steps.mac-x86_64.outputs.artifact-id }}
+      mac-aarch64-id   : ${{ steps.mac-aarch64.outputs.artifact-id }}
+      win-x86_64-id    : ${{ steps.win-x86_64.outputs.artifact-id }}
+      win-x86_64-digest: ${{ steps.win-x86_64-digest.outputs.digest }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-java@v4
@@ -103,4 +107,10 @@ jobs:
         with:
           path: ./dist/win-x86_64/target/universal/stage
           name: scala3-x86_64-pc-win32
+      - name: Compute SHA256 of the uploaded artifact (win x86-64)
+        id  : win-x86_64-digest
+        run : |
+          curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -o artifact.zip -L https://api.github.com/repos/scala/scala3/actions/artifacts/${{ steps.win-x86_64.outputs.artifact-id }}/zip
+          echo "digest=$(sha256sum artifact.zip | cut -d " " -f 1)" >> "$GITHUB_OUTPUT"
+
           

.github/workflows/ci.yaml

@@ -1025,6 +1025,7 @@ jobs:
     with:
       version: 3.6.0-local # TODO: FIX THIS
       url    : https://api.github.com/repos/scala/scala3/actions/artifacts/${{ needs.build-sdk-package.outputs.win-x86_64-id }}/zip
+      digest : ${{ needs.build-sdk-package.outputs.win-x86_64-digest }}
 
   test-chocolatey-package:
     uses: ./.github/workflows/test-chocolatey.yml

.github/workflows/releases.yml

@@ -37,11 +37,24 @@ jobs:
     secrets:
       DOTTYBOT-TOKEN: ${{ secrets.DOTTYBOT_WINGET_TOKEN }}
 
+  compute-digest:
+    runs-on: ubuntu-latest
+    outputs:
+      digest: ${{ steps.digest.outputs.digest }}
+    steps:
+      - name: Compute the SHA256 of scala3-${{ inputs.version }}-x86_64-pc-win32.zip in GitHub Release
+        id: digest
+        run: |
+          curl -o artifact.zip -L https://github.com/scala/scala3/releases/download/${{ inputs.version }}/scala3-${{ inputs.version }}-x86_64-pc-win32.zip
+          echo "digest=$(sha256sum artifact.zip | cut -d " " -f 1)" >> "$GITHUB_OUTPUT"
+
   build-chocolatey:
     uses: ./.github/workflows/build-chocolatey.yml
+    needs: compute-digest
     with:
       version: ${{ inputs.version }}
       url    : 'https://github.com/scala/scala3/releases/download/${{ inputs.version }}/scala3-${{ inputs.version }}-x86_64-pc-win32.zip'
+      digest : ${{ needs.compute-digest.outputs.digest }}
   test-chocolatey:
     uses: ./.github/workflows/test-chocolatey.yml
     needs: build-chocolatey

pkgs/chocolatey/tools/chocolateyInstall.ps1

@@ -6,9 +6,11 @@ $unzipLocation = Join-Path $unzipLocation "$($env:chocolateyPackageVersion)"  #
 
 # Configure the installation arguments
 $packageArgs = @{
-  packageName   = 'scala'
-  Url64         = '@LAUNCHER_URL@'
-  UnzipLocation = $unzipLocation
+  packageName    = 'scala'
+  Url64          = '@LAUNCHER_URL@'
+  UnzipLocation  = $unzipLocation
+  Checksum64     = '@LAUNCHER_SHA256@'
+  ChecksumType64 = 'SHA256'
 }
 
 ## In case we are running in the CI, add the authorisation header to fetch the zip