fix(bot): review release distribution consistency

Author: hqhq1025

.github/prompts/codex-pr-review.md

@@ -126,6 +126,21 @@ Example finding:
   ```
 ````
 
+## Release And Distribution Validation
+
+When a PR touches `.github/workflows/release.yml`, `.github/workflows/packaging-smoke.yml`, `packaging/**`, release notes, or package-manager manifests, review it as a release-path change. Do not stop at YAML syntax or local manifest shape.
+
+Check these paths explicitly when relevant:
+
+- `packaging/update-shas.sh` must derive version, release URLs, checksums, and release dates from the actual published release or current workflow input. It must not depend on `github.ref_name` when the workflow can run from `workflow_dispatch` on `main`.
+- Post-release jobs must run both for stable tag pushes and for non-draft manual dispatches that publish or overwrite release assets. If a workflow can overwrite release files, the packaging/Homebrew/Scoop/winget sync jobs must also run on that path.
+- `packaging/homebrew/Casks/open-codesign.rb`, `packaging/scoop/bucket/open-codesign.json`, `packaging/winget/**`, and `packaging/flatpak/**` must match the current release assets and `SHA256SUMS.txt`. Hash drift in any public install channel is a **Blocker** because users will get checksum failures or install the wrong artifact.
+- Homebrew and Scoop downstream repos are separate public install sources. If the PR changes generated manifests or release assets, check whether the workflow or release process updates `OpenCoworkAI/homebrew-tap` and `OpenCoworkAI/scoop-bucket`; otherwise call out the gap.
+- winget manifests should match the schema version used by the published package series and include fields required by winget validation, especially `ReleaseDate` in installer manifests when previous published versions have it. Installer URLs and `InstallerSha256` must match the current GitHub Release assets, not stale assets from an earlier rerun.
+- For release PRs, compare `SHA256SUMS.txt`, attached assets, in-repo manifests, external channel manifests, and workflow triggers as one system. A fix that updates only one channel while leaving another channel stale is incomplete.
+
+If the validation context is unavailable in the public checkout, say exactly what could not be verified and treat the risk conservatively. Do not claim a release/distribution PR is safe unless the artifact/checksum/update path is internally consistent.
+
 ## Severity And Noise Control
 
 Use severity to reflect merge risk, not personal taste:

.github/scripts/deepseek-pr-review.mjs

@@ -57,6 +57,93 @@ function serializeExcerpts(excerpts) {
   return excerpts.map((entry) => `## ${entry.path}\n${entry.content}`).join('\n\n');
 }
 
+function touchesReleasePath(files) {
+  return files.some((file) => {
+    const name = file.filename;
+    return (
+      name === '.github/workflows/release.yml' ||
+      name === '.github/workflows/packaging-smoke.yml' ||
+      name.startsWith('packaging/') ||
+      name.startsWith('.github/releases/') ||
+      name === 'CHANGELOG.md'
+    );
+  });
+}
+
+function loadReleaseContext(files) {
+  if (!touchesReleasePath(files)) {
+    return 'No release or distribution files changed.';
+  }
+
+  const paths = [
+    '.github/workflows/release.yml',
+    '.github/workflows/packaging-smoke.yml',
+    'packaging/update-shas.sh',
+    'packaging/README.md',
+    'packaging/homebrew/Casks/open-codesign.rb',
+    'packaging/scoop/bucket/open-codesign.json',
+    'packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.2.0/OpenCoworkAI.OpenCoDesign.yaml',
+    'packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.2.0/OpenCoworkAI.OpenCoDesign.installer.yaml',
+    'packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.2.0/OpenCoworkAI.OpenCoDesign.locale.en-US.yaml',
+    'packaging/flatpak/ai.opencowork.codesign.yaml',
+  ];
+
+  const localContext = loadRepoDocs(paths, 9000);
+  let releaseChecksums = '';
+  try {
+    releaseChecksums = runGh([
+      'release',
+      'download',
+      'v0.2.0',
+      '-R',
+      'OpenCoworkAI/open-codesign',
+      '--pattern',
+      'SHA256SUMS.txt',
+      '--output',
+      '-',
+    ]);
+  } catch (error) {
+    releaseChecksums = `Could not load v0.2.0 SHA256SUMS.txt: ${error.message}`;
+  }
+
+  let homebrew = '';
+  try {
+    homebrew = runGh([
+      'api',
+      'repos/OpenCoworkAI/homebrew-tap/contents/Casks/open-codesign.rb',
+      '--jq',
+      '.content',
+    ]);
+    homebrew = Buffer.from(homebrew, 'base64').toString('utf8');
+  } catch (error) {
+    homebrew = `Could not load live Homebrew tap cask: ${error.message}`;
+  }
+
+  let scoop = '';
+  try {
+    scoop = runGh([
+      'api',
+      'repos/OpenCoworkAI/scoop-bucket/contents/bucket/open-codesign.json',
+      '--jq',
+      '.content',
+    ]);
+    scoop = Buffer.from(scoop, 'base64').toString('utf8');
+  } catch (error) {
+    scoop = `Could not load live Scoop bucket manifest: ${error.message}`;
+  }
+
+  return [
+    'Release/distribution validation context:',
+    serializeDocs(localContext),
+    '## GitHub Release v0.2.0 SHA256SUMS.txt',
+    releaseChecksums,
+    '## Live OpenCoworkAI/homebrew-tap Cask',
+    homebrew,
+    '## Live OpenCoworkAI/scoop-bucket manifest',
+    scoop,
+  ].join('\n\n');
+}
+
 function loadPullRequestDiff(prNumber, repo, prMeta) {
   try {
     return runGh(['pr', 'diff', prNumber, '-R', repo]);
@@ -128,6 +215,7 @@ async function main() {
     8,
     5000,
   );
+  const releaseContext = loadReleaseContext(files);
 
   let followUpContext = 'None.';
   if (isFollowUpReview && latestBotReviewId) {
@@ -176,6 +264,9 @@ async function main() {
     'PR head file excerpts:',
     serializeExcerpts(excerpts),
     '',
+    'Release/distribution context:',
+    truncate(releaseContext, 60000, 'release distribution context'),
+    '',
     'Unified diff:',
     truncate(diff, 140000, 'PR diff'),
     '',