fix: verify native Arch package integrity

.github/workflows/arch-package.yml

@@ -0,0 +1,92 @@
+name: Arch package
+
+on:
+  pull_request:
+    paths:
+      - .goreleaser.yaml
+      - .github/workflows/arch-package.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    runs-on: macos-15
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - package: google
+            binary: gro
+            config: .goreleaser.yaml
+            go-mod: go.mod
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: ${{ matrix.go-mod }}
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: v2.18.2
+          args: release --snapshot --clean --skip=before --config ${{ matrix.config }}
+      - name: Verify both Arch architectures were rendered
+        shell: bash
+        run: |
+          set -euo pipefail
+          for arch in amd64 arm64; do
+            packages=(dist/*"${arch}.pkg.tar.zst")
+            test "${#packages[@]}" -eq 2
+            test -f "${packages[0]}"
+          done
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: arch-${{ matrix.package }}
+          path: dist/*.pkg.tar.zst
+          if-no-files-found: error
+
+  install:
+    needs: package
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - package: google
+            binary: gro
+            config: .goreleaser.yaml
+            go-mod: go.mod
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: arch-${{ matrix.package }}
+          path: packages
+      - name: Install, verify and remove in Arch Linux
+        env:
+          PACKAGE: ${{ matrix.package }}
+          BINARY: ${{ matrix.binary }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm -e PACKAGE -e BINARY -v "$PWD/packages:/packages:ro" archlinux:base bash -c '
+            set -euo pipefail
+            for PACKAGE in google-readonly google-readwrite; do
+              case "$PACKAGE" in google-readonly) BINARY=gro ;; google-readwrite) BINARY=grw ;; esac
+              package=(/packages/"${PACKAGE}"_*amd64.pkg.tar.zst)
+              test "${#package[@]}" -eq 1
+              pacman -U --noconfirm "${package[0]}"
+              "$BINARY" --version
+              "$BINARY" --help > /tmp/cli-help
+              test -s /tmp/cli-help
+              pacman -Qo "/usr/bin/$BINARY"
+              pacman -Qkk "$PACKAGE"
+              pacman -R --noconfirm "$PACKAGE"
+              test ! -e "/usr/bin/$BINARY"
+              pacman -U --noconfirm "${package[0]}"
+              "$BINARY" --version
+            done
+          '

.goreleaser.yaml

@@ -117,6 +117,8 @@ nfpms:
     description: Read-only command-line interface for Google services
     license: MIT
     formats: [deb, rpm, archlinux]
+    # Keep tar entry timestamps aligned with pacman integrity metadata.
+    mtime: "{{ .CommitDate }}"
     bindir: /usr/bin
     contents:
       - src: LICENSE
@@ -130,6 +132,8 @@ nfpms:
     description: Read-write command-line interface for Google services
     license: MIT
     formats: [deb, rpm, archlinux]
+    # Keep tar entry timestamps aligned with pacman integrity metadata.
+    mtime: "{{ .CommitDate }}"
     bindir: /usr/bin
     contents:
       - src: LICENSE