ci(release): support Lix GitHub asset URLs

Author: fullofcaffeine

README.md

@@ -50,9 +50,11 @@ The body is text, not XML or HXX. Haxe generics such as `Assigns<T>`, comparison
 Install the immutable, versioned GitHub Release asset with [Lix](https://github.com/lix-pm/lix.client):
 
 ```bash
-lix install https://github.com/fullofcaffeine/herex/releases/download/v1.0.1/herex-1.0.1.zip
+lix install https://www.github.com/fullofcaffeine/herex/releases/download/v1.0.1/herex-1.0.1.zip
 ```
 
+Keep the `www` in this command. Lix 17 currently mistakes bare `github.com` Release URLs for repository sources; GitHub's `www` endpoint reaches the same immutable asset through Lix's HTTPS installer. Every release verifies this exact path by compiling a clean consumer.
+
 Then add one line to the project HXML:
 
 ```hxml

RELEASING.md

@@ -12,4 +12,6 @@ The release workflow:
 
 Herex is not submitted to the Haxelib registry. The supported installation source is the immutable GitHub Release asset.
 
+The public Lix smoke test rewrites GitHub API asset URLs from `github.com` to `www.github.com`. This is intentional: Lix 17 intercepts the bare host as a repository source and rejects Release asset paths before its generic HTTPS installer can handle them. Both hosts serve the same immutable GitHub asset.
+
 Published `v*` tags and release assets are immutable. The reviewer-protected `release-repair` workflow may finish an incomplete draft for an existing protected tag; it must never move a tag, derive a new version, or replace a published asset.

scripts/ci/validate-policy.mjs

@@ -29,11 +29,18 @@ requireCondition(read("extraParams.hxml").trim() === "--macro herex.HeredocSynta
 requireIncludes(read("haxe_libraries/formatter.hxml"), "formatter#1.18.0", "The formatter lock must remain exact");
 
 const readme = read("README.md");
-requireIncludes(readme, "releases/download/v1.0.1/herex-1.0.1.zip", "README must lead with the first installable versioned GitHub Release asset");
+requireIncludes(
+	readme,
+	"https://www.github.com/fullofcaffeine/herex/releases/download/v1.0.1/herex-1.0.1.zip",
+	"README must lead with the Lix-compatible versioned GitHub Release asset",
+);
 requireIncludes(readme, "-lib herex", "README must document one-line project activation");
 requireIncludes(readme, "<hd", "README must document the compact built-in alias");
 requireIncludes(read("AGENTS.example.md"), "Do not mechanically convert", "Agent guidance must preserve the heredoc/concatenation balance");
 
+const lixSmoke = read("scripts/release/lix-consumer-smoke.mjs");
+requireIncludes(lixSmoke, 'parsed.hostname = "www.github.com"', "Public Lix verification must avoid Lix 17's bare GitHub host interceptor");
+
 const releaseConfiguration = read("release.config.mjs");
 requireIncludes(releaseConfiguration, 'path: "artifacts/herex-*.zip"', "GitHub release assets must use glob paths supported by the publisher");
 requireCondition(!releaseConfiguration.includes('path: "artifacts/herex-${'), "GitHub release asset paths must not contain uninterpreted templates");

scripts/release/lix-consumer-smoke.mjs

@@ -85,17 +85,29 @@ http.get = function patchedGet(options, ...rest) {
 			NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ""} --require=${localPortPatch}`.trim(),
 		};
 	}
-	await run(process.execPath, [lixEntry, "install", url], temporaryDirectory, installEnvironment);
+	const installUrl = lixInstallUrl(url);
+	await run(process.execPath, [lixEntry, "install", installUrl], temporaryDirectory, installEnvironment);
 	await run(process.execPath, [lixEntry, "download"], temporaryDirectory);
 	await run(process.execPath, [haxeEntry, "build.hxml"], temporaryDirectory);
-	process.stdout.write(`Lix installed and compiled ${archivePath == null ? url : path.basename(archivePath)} using only -lib herex\n`);
+	process.stdout.write(`Lix installed and compiled ${archivePath == null ? installUrl : path.basename(archivePath)} using only -lib herex\n`);
 } finally {
 	if (server.listening) {
 		await new Promise((resolve) => server.close(resolve));
 	}
 	rmSync(temporaryDirectory, {recursive: true, force: true});
 }
 
+function lixInstallUrl(url) {
+	const parsed = new URL(url);
+	// Lix 17 case-sensitively intercepts bare github.com URLs as repository
+	// sources before its generic HTTPS resolver. Release asset paths then fail
+	// that repository parser. GitHub's www host serves the same immutable asset.
+	if (parsed.protocol === "https:" && parsed.hostname === "github.com") {
+		parsed.hostname = "www.github.com";
+	}
+	return parsed.toString();
+}
+
 function run(command, args, cwd, env = process.env) {
 	return new Promise((resolve, reject) => {
 		const child = spawn(command, args, {cwd, env, stdio: "inherit"});