feat: support reusing existing scoop install

[chawyehsu]

Caution

Notice risks (cache poisoning) of sharing caches between workflows involving different trust levels:
https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#cache-access-for-low-trust-workflow-triggers

In scenarios involving Scoop installations, the following items exist that could potentially lead to the leakage of sensitive data:

• Data stored in Scoop configuration file, such as fields like gh_token, virustotal_api_key, and private_hosts
• Application-level persistent data located in the persist directory, such as user data stored by any app
• Application-level temporary or persistent data located in the apps directory, such as data stored by any app
• Cached content within the cache directory, such as cached private application packages
• Other potential sources

Whether or not to enable caching for Scoop installations is entirely up to the caller, who must understand the security model and risks described above and review data boundaries.

Example combining with actions/cache

# .github/workflows/excavator.yml
name: Excavator
on:
  schedule:
  - cron: '20 */4 * * *' # Runs every 4 hours
permissions:
  contents: write
jobs:
  excavate:
    name: Excavate
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      # Invalidation every day
      - name: Cache Epoch
        id: cache_epoch
        shell: bash
        run: echo "day=$(date -u +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
      - name: Restore Cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ~/scoop
          key: Scoop-${{ runner.os }}-${{ steps.cache_epoch.outputs.day }}
      - name: Excavate
        uses: ScoopInstaller/GithubActions@main
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SKIP_UPDATED: 1

[coderabbitai]

Warning

Review limit reached

@chawyehsu, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 47 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 31e7a066-a8f1-495b-b42f-c1408111a462

📥 Commits

Reviewing files that changed from the base of the PR and between 1b5d7a2 and f4bc789.

📒 Files selected for processing (1)

• src/Scoop.psm1

Summary by CodeRabbit

• Bug Fixes
  • Improved Scoop installation detection and recovery.
  • Existing Scoop installations are now restored by ensuring the shims directory is available in PATH.
  • The installer runs only when no accessible Scoop installation is found.

Walkthrough

Install-Scoop now checks Scoop availability and existing shims. It restores an inaccessible Scoop installation by updating PATH; otherwise, it runs the remote installer. Repository and branch configuration handling remains unchanged.

Changes

Scoop installation recovery

Layer / File(s)	Summary
Detect and restore Scoop installation src/Scoop.psm1	Install-Scoop checks for an accessible scoop command and an existing Scoop shim. It adds the shims directory to PATH when a shim exists. It runs the remote installer when no shim exists.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes support for reusing an existing Scoop installation.
Description check	✅ Passed	The description explains Scoop installation caching and reuse, which directly relates to the changeset and objectives.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cf719328-f33e-46a9-a029-a01883073780

📥 Commits

Reviewing files that changed from the base of the PR and between 920bb26 and 1b5d7a2.

📒 Files selected for processing (1)

• src/Scoop.psm1

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

[chawyehsu]

@ScoopInstaller/maintainers This would be the last piece of improvements from me that are going to be part of the #84 release. If no one else plans to have further improvements into v3.0.0, I think it is time to freeze changes and move on #89.

Although I am inclined to have this change since it undoubtedly improves execution performance Excavator, I still have some reservations about it, primarily due to the security risks mentioned above. It ultimately depends on how it is used though.

[niheaven]

I'm fine with it. No other changes.

ed. Use develop as new branch name? Since we'll release new gitaction with release number.