Fix PR review comments: service flags, DATA_DIR, version pinning, upgrade safety

- Remove --setup flag from systemd service and CI (not valid in 0.9.x)
- Remove release triggers from debian/homebrew workflows (handled by release.yml)
- Fix brew post_install to set DATA_DIR so it initializes in var/archivebox
- Add PATH export to deb wrapper script for bundled console scripts
- Remove pip install fallback in install.sh (strict version pinning)
- Guard preremove.sh cleanup to only run on remove/purge, not upgrade
- Initialize SDIST_URL/SDIST_SHA256 in build_brew.sh (nounset safety)
- Pin awalsh128/cache-apt-pkgs-action to v1.6.0 (supply chain safety)

https://claude.ai/code/session_01Vx1EsNrNySgsc8Y67dGzCn

.github/workflows/debian.yml

@@ -11,8 +11,7 @@ on:
       - 'bin/release_deb.sh'
       - '.github/workflows/debian.yml'
       - 'pyproject.toml'
-  release:
-    types: [published]
+  # release trigger is handled by release.yml to avoid double-runs
 
 permissions:
   contents: write
@@ -90,7 +89,7 @@ jobs:
           enable-cache: true
 
       - name: Install build dependencies
-        uses: awalsh128/cache-apt-pkgs-action@latest
+        uses: awalsh128/cache-apt-pkgs-action@v1.6.0
         with:
           packages: build-essential python3-dev python3-setuptools libssl-dev libldap2-dev libsasl2-dev zlib1g-dev libatomic1
           version: 1.0
@@ -144,7 +143,7 @@ jobs:
           id archivebox
           sudo mkdir -p /tmp/archivebox-test
           sudo chown archivebox:archivebox /tmp/archivebox-test
-          sudo -u archivebox bash -c 'cd /tmp/archivebox-test && /opt/archivebox/venv/bin/archivebox init --setup'
+          sudo -u archivebox bash -c 'cd /tmp/archivebox-test && /opt/archivebox/venv/bin/archivebox init'
 
       - name: Test archivebox status
         run: |

.github/workflows/homebrew.yml

@@ -11,8 +11,7 @@ on:
       - 'bin/release_brew.sh'
       - '.github/workflows/homebrew.yml'
       - 'pyproject.toml'
-  release:
-    types: [published]
+  # release trigger is handled by release.yml to avoid double-runs
 
 permissions:
   contents: read
@@ -49,7 +48,7 @@ jobs:
 
       - name: Install build dependencies (Linux)
         if: runner.os == 'Linux'
-        uses: awalsh128/cache-apt-pkgs-action@latest
+        uses: awalsh128/cache-apt-pkgs-action@v1.6.0
         with:
           packages: build-essential python3-dev python3-setuptools libssl-dev libldap2-dev libsasl2-dev zlib1g-dev libatomic1
           version: 1.0
@@ -108,7 +107,8 @@ ${RESOURCES}
   end
 
   def post_install
-    system bin/"archivebox", "install", "--binproviders", "pip,npm"
+    (var/"archivebox").mkpath
+    system({ "DATA_DIR" => var/"archivebox" }, bin/"archivebox", "install", "--binproviders", "pip,npm")
   end
 
   service do
@@ -162,7 +162,7 @@ RUBY
       - name: Test archivebox init
         run: |
           mkdir -p /tmp/archivebox-test && cd /tmp/archivebox-test
-          archivebox init --install
+          archivebox init
 
       - name: Test archivebox status
         run: |
@@ -274,7 +274,8 @@ ${RESOURCES}
   end
 
   def post_install
-    system bin/"archivebox", "install", "--binproviders", "pip,npm"
+    (var/"archivebox").mkpath
+    system({ "DATA_DIR" => var/"archivebox" }, bin/"archivebox", "install", "--binproviders", "pip,npm")
   end
 
   service do

bin/build_brew.sh

@@ -31,6 +31,8 @@ echo "[+] Generating resource stanzas with homebrew-pypi-poet..."
 RESOURCES="$(poet archivebox)"
 
 # Get the sdist URL and SHA256 from PyPI JSON API (works on macOS and Linux)
+SDIST_URL=""
+SDIST_SHA256=""
 PYPI_JSON="$(curl -fsSL "https://pypi.org/pypi/archivebox/${VERSION}/json" 2>/dev/null || echo '')"
 if [ -n "$PYPI_JSON" ]; then
     SDIST_URL="$(echo "$PYPI_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((u['url'] for u in d['urls'] if u['packagetype']=='sdist'), ''))" 2>/dev/null || echo '')"
@@ -94,7 +96,8 @@ ${RESOURCES}
 
   def post_install
     # Install runtime dependencies (plugins, JS extractors, etc.)
-    system bin/"archivebox", "install", "--binproviders", "pip,npm"
+    (var/"archivebox").mkpath
+    system({ "DATA_DIR" => var/"archivebox" }, bin/"archivebox", "install", "--binproviders", "pip,npm")
   end
 
   service do

brew_dist/archivebox.rb

@@ -40,7 +40,8 @@ class Archivebox < Formula
 
   def post_install
     # Install runtime dependencies (plugins, JS extractors, etc.)
-    system bin/"archivebox", "install", "--binproviders", "pip,npm"
+    (var/"archivebox").mkpath
+    system({ "DATA_DIR" => var/"archivebox" }, bin/"archivebox", "install", "--binproviders", "pip,npm")
   end
 
   service do

pkg/debian/archivebox

@@ -10,4 +10,6 @@ if [ ! -f "$ARCHIVEBOX_VENV/bin/archivebox" ]; then
     exit 1
 fi
 
+# Export venv bin to PATH so bundled console scripts (yt-dlp, etc.) are discoverable
+export PATH="$ARCHIVEBOX_VENV/bin:$PATH"
 exec "$ARCHIVEBOX_VENV/bin/archivebox" "$@"

pkg/debian/archivebox.service

@@ -7,7 +7,7 @@ Type=simple
 User=archivebox
 Group=archivebox
 WorkingDirectory=/var/lib/archivebox
-ExecStartPre=/opt/archivebox/venv/bin/archivebox init --setup
+ExecStartPre=/opt/archivebox/venv/bin/archivebox init
 ExecStart=/opt/archivebox/venv/bin/archivebox server 0.0.0.0:8000
 Restart=on-failure
 RestartSec=5

pkg/debian/install.sh

@@ -17,20 +17,14 @@ fi
 # Upgrade pip inside the virtualenv
 "$ARCHIVEBOX_VENV/bin/python3" -m pip install --quiet --upgrade pip setuptools
 
-# Install or upgrade archivebox
+# Install or upgrade archivebox (pinned to .deb version if set)
 if [ -n "$ARCHIVEBOX_VERSION" ]; then
     echo "[+] Installing archivebox==$ARCHIVEBOX_VERSION..."
-    "$ARCHIVEBOX_VENV/bin/pip" install --quiet --upgrade "archivebox==$ARCHIVEBOX_VERSION" || {
-        echo "[!] archivebox==$ARCHIVEBOX_VERSION not found on PyPI, installing latest..."
-        "$ARCHIVEBOX_VENV/bin/pip" install --quiet --upgrade archivebox
-    }
+    "$ARCHIVEBOX_VENV/bin/pip" install --quiet --upgrade "archivebox==$ARCHIVEBOX_VERSION"
 else
     echo "[+] Installing latest archivebox..."
     "$ARCHIVEBOX_VENV/bin/pip" install --quiet --upgrade archivebox
 fi
 
-echo "[+] Installing archivebox runtime dependencies..."
-"$ARCHIVEBOX_VENV/bin/archivebox" install --binproviders pip,npm 2>/dev/null || true
-
 echo "[√] ArchiveBox installed successfully."
 echo "    Run 'archivebox version' to verify."

pkg/debian/scripts/preremove.sh

@@ -2,17 +2,20 @@
 # preremove script for archivebox .deb package
 set -e
 
-# Stop the service if running
-if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
-    systemctl stop archivebox 2>/dev/null || true
-    systemctl disable archivebox 2>/dev/null || true
+# Only clean up on full removal, not during upgrade
+if [ "$1" = "remove" ] || [ "$1" = "purge" ]; then
+    # Stop the service if running
+    if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
+        systemctl stop archivebox 2>/dev/null || true
+        systemctl disable archivebox 2>/dev/null || true
+    fi
+
+    echo "[+] Removing ArchiveBox virtualenv..."
+    rm -rf /opt/archivebox/venv
+
+    echo "[i] Your ArchiveBox data in /var/lib/archivebox has NOT been removed."
+    echo "    The 'archivebox' system user has NOT been removed."
+    echo "    Remove them manually if you no longer need them:"
+    echo "      sudo rm -rf /var/lib/archivebox"
+    echo "      sudo userdel archivebox"
 fi
-
-echo "[+] Removing ArchiveBox virtualenv..."
-rm -rf /opt/archivebox/venv
-
-echo "[i] Your ArchiveBox data in /var/lib/archivebox has NOT been removed."
-echo "    The 'archivebox' system user has NOT been removed."
-echo "    Remove them manually if you no longer need them:"
-echo "      sudo rm -rf /var/lib/archivebox"
-echo "      sudo userdel archivebox"