[zhangzhenghao]

Summary

• After GoReleaser successfully uploads binaries for a stable release, send release to gorse-io/scoop-bucket using the GitHub repository-dispatch API.
• Skip prereleases and keep notification independent of npm publishing. Existing binary and npm jobs are unchanged.
• Use the dedicated SCOOP_BUCKET_TOKEN secret rather than the repository-scoped built-in token.

Prerequisites / merge order

1. Merge the receiver first: ci: update Scoop manifests on CLI release dispatch scoop-bucket#4.
2. Configure SCOOP_BUCKET_TOKEN in gorse-io/cli as a fine-grained PAT restricted to gorse-io/scoop-bucket, with Contents: Read and write, plus any required organization approval.
3. Ensure bucket repository rules permit workflow-token pushes; then merge this sender.

No credentials were created or changed. The required secret was not present when inspected. Missing/expired credentials fail the notification job, not the independent npm publication job. The bucket receiver can also be run manually.

Verification

• actionlint and git diff --check passed.
• Parsed workflow assertions confirm unchanged binary/npm jobs, needs: binaries, prerelease filtering, and matching sender/receiver event type.
• Executed the sender shell with a mock gh and asserted the exact repository-dispatch arguments; no live event was sent.

The actual release-to-Windows-update path remains unverified until the receiver is merged and the secret is configured. No release was published for testing.

Prior-head remote CI

CI run https://github.com/gorse-io/cli/actions/runs/40174659019 passed on head f479abd3487b9778337e6b0c911f6215b51d7b37: Go tests and all five installer matrix jobs. These checks do not execute the new release notification job.

Event type update

Both senders and the receiver now use release. actionlint and mocked sender/receiver matching checks passed. Previous CI results above apply to the earlier heads; new-head CI is pending. No live dispatch was sent.