chocolatey: push of 0.71.0 rejected with 403 Forbidden (0.66.1 still in moderation queue)

[padak]

Summary

The v0.71.0 release run (release-kbagent #29752342509) failed in the chocolatey job: choco push of keboola-cli2.0.71.0.nupkg to https://push.chocolatey.org returns 403 Forbidden. A re-run of the failed job (different Windows runner) hit the identical 403, so it is not a one-off runner hiccup.

Attempting to push keboola-cli2.0.71.0.nupkg to https://push.chocolatey.org
Response status code does not indicate success: 403 (Forbidden).

Everything before the push works: checksum fetch, nuspec templating, choco pack, and choco apikey all succeed. The same job with the same CHOCOLATEY_KEY secret succeeded 5 days earlier on the v0.66.1 run (2026-07-15).

Context that may or may not be the cause

• keboola-cli2 0.66.1 is still sitting in the Chocolatey moderation queue (submitted 2026-07-15 by Matovidlo, not yet approved). The package page shows "versions of this package awaiting moderation" plus reviewer Guideline/Suggestion comments (e.g. missing iconUrl, nuspec enhancement suggestions). The v2 API returns an empty feed for the package id, i.e. no approved version exists yet.
• Chocolatey's public docs do not document "new-version push blocked while another version is in moderation"; their troubleshooting page attributes 403s against the community repo primarily to Cloudflare/IP blocking or access control. Two different GitHub-hosted runner IPs both got 403, which weakens (but does not exclude — Azure ranges) the IP-block theory.

So the realistic candidates are: (a) the pending-moderation state of 0.66.1 blocking new-version pushes for this package, (b) something on the account/API-key side, (c) Cloudflare blocking GitHub runner ranges. Only the maintainer account can distinguish these.

What is needed (maintainer action — @Matovidlo)

1. Check the moderation status of 0.66.1 in your chocolatey.org account — if a Requirement was flagged, the docs say the same version must be re-pushed to fix it; that state may also explain the 403 on 0.71.0.
2. Verify the API key tied to CHOCOLATEY_KEY is still valid for the keboola-cli2 package.
3. Optionally try the push locally (same steps as the workflow's Pack & push) — a local 403 vs 200 immediately splits "account/package state" from "runner IP block".
4. Once the cause is fixed, re-run the failed chocolatey job on run 29752342509 (no new tag needed).

Impact

v0.71.0 is fully published everywhere else (PyPI, S3 apt/rpm, Homebrew, GitHub Release incl. wheel + command-reference.md). Only the Chocolatey channel is missing 0.71.0 — and since no version was ever approved there, Chocolatey users were never able to install the package anyway. winget remains blocked separately by #484 (never bootstrapped; also needs: chocolatey).

[padak]

Fresh data point: the v0.72.0 run (2026-07-20, ~4h after the v0.71.0 attempt) hit the identical choco push 403 Forbidden — same key, pack and apikey steps green. Two same-day failures after the 2026-07-15 success strengthens the moderation-queue hypothesis (keboola-cli2 0.66.1 still pending approval; pushes of new versions while a version sits in moderation are commonly rejected). Next actionable step remains on the Chocolatey side: respond to the reviewer comments on the 0.66.1 moderation thread (iconUrl + nuspec suggestions) to get it approved, then re-push 0.72.0 (choco push of the already-built nupkg, or re-run the job on the next release).