fix(release): correct v2.6.0 checksums and stop the job hiding its failure

.github/workflows/release.yml

@@ -345,6 +345,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      pull-requests: write
     steps:
       - name: Checkout main branch
         uses: actions/checkout@v4
@@ -385,6 +386,10 @@ jobs:
           sed -i "/arbor-linux-x86_64.tar.gz/!b;n;s|sha256 \".*\"|sha256 \"${LINUX_X64_SHA}\"|" "$FILE"
 
           sed -i "s|\"version\": \".*\"|\"version\": \"${VERSION}\"|" "$SCOOP"
+          # The Scoop download URL carries the version literally and was never
+          # rewritten, so the manifest advertised the new version while still
+          # pointing at the previous release's zip.
+          sed -i -E "s|(releases/download/)v[0-9]+[.][0-9]+[.][0-9]+(/arbor-windows-x86_64[.]zip)|\1v${VERSION}\2|" "$SCOOP"
           sed -i "s|REPLACE_WITH_WINDOWS_X86_64_SHA256|${WIN_X64_SHA}|g" "$SCOOP"
           sed -i "s|\"hash\": \".*\"|\"hash\": \"${WIN_X64_SHA}\"|" "$SCOOP"
 
@@ -401,6 +406,33 @@ jobs:
             exit 0
           fi
 
-          git commit -m "chore: update manifests for v${{ needs.prepare.outputs.version }} [skip ci]"
+          VERSION='${{ needs.prepare.outputs.version }}'
+          git commit -m "chore: update manifests for v${VERSION} [skip ci]"
           git pull --rebase origin main
-          git push origin main || echo "::warning::Could not push to main (possibly branch protection)."
+
+          # `main` requires a pull request, so a direct push always fails here.
+          # This step used to end in `|| echo "::warning::"`, which swallowed
+          # that failure: the job reported success while the Homebrew formula
+          # and Scoop manifest kept the *previous* release's checksums, so
+          # `brew install` broke for everyone on the new version and nothing in
+          # CI said so.
+          #
+          # Try the direct push in case protection is ever relaxed, otherwise
+          # open a PR. If neither works, fail — silently shipping stale
+          # checksums is the outcome this must never repeat.
+          if git push origin main 2>/dev/null; then
+            echo "Pushed manifest updates directly to main."
+            exit 0
+          fi
+
+          echo "Direct push rejected (branch protection); opening a pull request."
+          BRANCH="chore/manifest-checksums-v${VERSION}"
+          git push --force origin "HEAD:${BRANCH}"
+
+          gh pr create \
+            --base main \
+            --head "${BRANCH}" \
+            --title "chore: update package manifests for v${VERSION}" \
+            --body "Homebrew and Scoop checksums for the v${VERSION} release assets, generated by the release workflow. Merge to keep \`brew install\` and \`scoop install\` working on the new version."
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

packaging/homebrew/arbor.rb

@@ -9,20 +9,20 @@ class Arbor < Formula
   on_macos do
     if Hardware::CPU.arm?
       url "https://github.com/Anandb71/arbor/releases/download/v#{version}/arbor-macos-aarch64.tar.gz"
-      sha256 "faac85e2b922dbbd1ecdf0afccba10e32ed0a16a64c92383a419fd89e55ecda1"
+      sha256 "733d2b9e8871be2b0c757cefe5a2d7cefc7e4375a7f15f2796b6c9680d940634"
     else
       url "https://github.com/Anandb71/arbor/releases/download/v#{version}/arbor-macos-x86_64.tar.gz"
-      sha256 "d3cdfe9d3f998c0a9641eb9d6d93c8a54afdf0f8b71f85ba75b9befd3db606e4"
+      sha256 "9de570cf05d5cf7a50d1c6e9c9a0081dfa22a3fe5b8a05c3b9058aab9bfdc032"
     end
   end
 
   on_linux do
     if Hardware::CPU.arm?
       url "https://github.com/Anandb71/arbor/releases/download/v#{version}/arbor-linux-aarch64.tar.gz"
-      sha256 "895223f8930cd5571d3568b22db22c7ecec38e63b1e6fa4d5bb29b77cdfb7b51"
+      sha256 "7ef2123047198f6678d8ef714e477edd1cbd53846bba6ed2c09090950722d4f3"
     else
       url "https://github.com/Anandb71/arbor/releases/download/v#{version}/arbor-linux-x86_64.tar.gz"
-      sha256 "715dddb5a17fef4a04f2a2cbc7e449ad08164652d704ff034a86523eb68ab941"
+      sha256 "9a84fc6654c8569c0a2c954c1093bdcbf5afc942b704f24dc6408c115f8222f8"
     end
   end
 

packaging/scoop/arbor.json

@@ -5,8 +5,8 @@
   "license": "MIT",
   "architecture": {
     "64bit": {
-      "url": "https://github.com/Anandb71/arbor/releases/download/v2.5.0/arbor-windows-x86_64.zip",
-      "hash": "1cef8cf672f51a106166fb1214105b52ca45a51d4f6ce0f790599deea12f2e8a",
+      "url": "https://github.com/Anandb71/arbor/releases/download/v2.6.0/arbor-windows-x86_64.zip",
+      "hash": "72877177b0a1bed7a8f7830627e86ddc86f0f59aa0cbeef957d500b662344fba",
       "bin": "arbor.exe"
     }
   },