publish-winget.yml

name: Publish to winget

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Strict SemVer release version without a v prefix (e.g., 3.0.12)'
        required: true
        type: string

permissions:
  contents: read

env:
  WINGETCREATE_VERSION: 1.12.8.0
  WINGETCREATE_URL: https://github.com/microsoft/winget-create/releases/download/v1.12.8.0/wingetcreate.exe
  WINGETCREATE_SHA256: 8BD738851B524885410112678E3771B341C5C716DE60FBBECB88AB0A363ED85D

jobs:
  publish-winget:
    name: Publish to winget
    runs-on: windows-2025
    steps:
      - name: Check out repository
        # actions/checkout v5.0.0
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8

      - name: Validate release version
        id: version
        shell: pwsh
        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          $ErrorActionPreference = 'Stop'
          Set-StrictMode -Version Latest

          # Strict SemVer 2.0.0. In particular, a leading "v", whitespace,
          # leading zeroes, and additional shell syntax are rejected.
          $semVerPattern = '^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?\z'
          $version = $env:INPUT_VERSION
          if ([string]::IsNullOrEmpty($version) -or $version -cnotmatch $semVerPattern) {
              throw "Version '$version' is not strict SemVer 2.0.0 without a leading v."
          }

          "version=$version" | Out-File -LiteralPath $env:GITHUB_OUTPUT -Encoding utf8 -Append
          "tag=v$version" | Out-File -LiteralPath $env:GITHUB_OUTPUT -Encoding utf8 -Append

      - name: Download release asset
        id: download
        shell: pwsh
        env:
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          $ErrorActionPreference = 'Stop'
          Set-StrictMode -Version Latest

          $asset = "a3s-box-$env:RELEASE_TAG-windows-x86_64.zip"
          $url = "https://github.com/$env:GITHUB_REPOSITORY/releases/download/$env:RELEASE_TAG/$asset"
          Write-Host "Downloading $url"
          Invoke-WebRequest -Uri $url -OutFile $asset

          $sha256 = (Get-FileHash -LiteralPath $asset -Algorithm SHA256).Hash
          Write-Host "Release asset SHA256: $sha256"
          "sha256=$sha256" | Out-File -LiteralPath $env:GITHUB_OUTPUT -Encoding utf8 -Append

      - name: Update manifest files
        shell: pwsh
        env:
          RELEASE_VERSION: ${{ steps.version.outputs.version }}
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
          RELEASE_SHA256: ${{ steps.download.outputs.sha256 }}
        run: |
          $ErrorActionPreference = 'Stop'
          Set-StrictMode -Version Latest

          function Set-SingleManifestValue {
              param(
                  [Parameter(Mandatory)] [string] $Path,
                  [Parameter(Mandatory)] [string] $Key,
                  [Parameter(Mandatory)] [string] $Value
              )

              $content = [System.IO.File]::ReadAllText($Path)
              $pattern = "(?m)^(?<indent>[ `t]*)$([regex]::Escape($Key)):[^`r`n]*(?=`r?$)"
              $matches = [regex]::Matches($content, $pattern)
              if ($matches.Count -ne 1) {
                  throw "Expected exactly one '$Key' entry in $Path; found $($matches.Count)."
              }

              $replacement = '${indent}' + "${Key}: $Value"
              $updated = [regex]::Replace($content, $pattern, $replacement)
              [System.IO.File]::WriteAllText(
                  $Path,
                  $updated,
                  [System.Text.UTF8Encoding]::new($false)
              )
          }

          $manifestDir = (Resolve-Path -LiteralPath '.winget').Path
          $versionManifest = Join-Path $manifestDir 'A3SLab.Box.yaml'
          $installerManifest = Join-Path $manifestDir 'A3SLab.Box.installer.yaml'
          $localeManifest = Join-Path $manifestDir 'A3SLab.Box.locale.en-US.yaml'

          foreach ($manifest in @($versionManifest, $installerManifest, $localeManifest)) {
              Set-SingleManifestValue -Path $manifest -Key 'PackageVersion' -Value $env:RELEASE_VERSION
          }

          $assetName = "a3s-box-$env:RELEASE_TAG-windows-x86_64.zip"
          $assetUrl = "https://github.com/$env:GITHUB_REPOSITORY/releases/download/$env:RELEASE_TAG/$assetName"
          Set-SingleManifestValue -Path $installerManifest -Key 'InstallerUrl' -Value $assetUrl
          Set-SingleManifestValue -Path $installerManifest -Key 'InstallerSha256' -Value $env:RELEASE_SHA256

          $installerContent = [System.IO.File]::ReadAllText($installerManifest)
          $nestedPathPattern = '(?m)^(?<prefix>[ \t]*-[ \t]*RelativeFilePath:[ \t]*)a3s-box-v[^\r\n\\]+-windows-x86_64(?=\\)'
          $nestedPathMatches = [regex]::Matches($installerContent, $nestedPathPattern)
          if ($nestedPathMatches.Count -ne 2) {
              throw "Expected exactly two nested installer paths; found $($nestedPathMatches.Count)."
          }
          $nestedPathReplacement = '${prefix}' + "a3s-box-$env:RELEASE_TAG-windows-x86_64"
          $installerContent = [regex]::Replace($installerContent, $nestedPathPattern, $nestedPathReplacement)
          [System.IO.File]::WriteAllText(
              $installerManifest,
              $installerContent,
              [System.Text.UTF8Encoding]::new($false)
          )

          Set-SingleManifestValue -Path $localeManifest -Key 'PublisherUrl' -Value 'https://github.com/A3S-Lab'
          Set-SingleManifestValue -Path $localeManifest -Key 'PublisherSupportUrl' -Value "https://github.com/$env:GITHUB_REPOSITORY/issues"
          Set-SingleManifestValue -Path $localeManifest -Key 'PackageUrl' -Value "https://github.com/$env:GITHUB_REPOSITORY"
          Set-SingleManifestValue -Path $localeManifest -Key 'LicenseUrl' -Value "https://github.com/$env:GITHUB_REPOSITORY/blob/main/LICENSE"
          Set-SingleManifestValue -Path $localeManifest -Key 'ReleaseNotesUrl' -Value "https://github.com/$env:GITHUB_REPOSITORY/releases/tag/$env:RELEASE_TAG"

      - name: Download and verify WinGetCreate
        id: wingetcreate
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Set-StrictMode -Version Latest

          $toolDir = Join-Path $env:RUNNER_TEMP "wingetcreate-$env:WINGETCREATE_VERSION"
          New-Item -ItemType Directory -Path $toolDir -Force | Out-Null
          $toolPath = Join-Path $toolDir 'wingetcreate.exe'
          Invoke-WebRequest -Uri $env:WINGETCREATE_URL -OutFile $toolPath

          $actualSha256 = (Get-FileHash -LiteralPath $toolPath -Algorithm SHA256).Hash
          if (-not [string]::Equals(
              $actualSha256,
              $env:WINGETCREATE_SHA256,
              [System.StringComparison]::OrdinalIgnoreCase
          )) {
              Remove-Item -LiteralPath $toolPath -Force
              throw "WinGetCreate SHA256 mismatch: expected $env:WINGETCREATE_SHA256, got $actualSha256."
          }

          Write-Host "Verified WinGetCreate $env:WINGETCREATE_VERSION ($actualSha256)."
          & $toolPath info
          if ($LASTEXITCODE -ne 0) {
              throw "The verified WinGetCreate executable failed with exit code $LASTEXITCODE."
          }
          "path=$toolPath" | Out-File -LiteralPath $env:GITHUB_OUTPUT -Encoding utf8 -Append

      - name: Validate manifests with WinGet
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $winget = Get-Command winget -CommandType Application -ErrorAction SilentlyContinue
          if (-not $winget) {
              throw 'WinGet is unavailable on the runner; manifest validation cannot be skipped.'
          }

          $manifestDir = (Resolve-Path -LiteralPath '.winget').Path
          & $winget.Source validate --manifest $manifestDir --disable-interactivity
          if ($LASTEXITCODE -ne 0) {
              throw "WinGet manifest validation failed with exit code $LASTEXITCODE."
          }

      - name: Upload validated manifests
        # actions/upload-artifact v6.0.0
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
        with:
          name: winget-manifests
          path: .winget/*.yaml
          if-no-files-found: error

      - name: Submit to winget-pkgs
        id: submit_winget
        continue-on-error: true
        shell: pwsh
        env:
          WINGETCREATE_PATH: ${{ steps.wingetcreate.outputs.path }}
          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
        run: |
          $ErrorActionPreference = 'Stop'
          if ([string]::IsNullOrWhiteSpace($env:WINGET_TOKEN)) {
              throw 'WINGET_TOKEN is not configured; use the validated manifest artifact for manual submission.'
          }

          $manifestDir = (Resolve-Path -LiteralPath '.winget').Path
          & $env:WINGETCREATE_PATH submit --no-open --token $env:WINGET_TOKEN $manifestDir
          if ($LASTEXITCODE -ne 0) {
              throw "WinGetCreate submission failed with exit code $LASTEXITCODE."
          }

      - name: Report manual winget-pkgs submission steps
        if: steps.submit_winget.outcome == 'failure'
        shell: pwsh
        env:
          RELEASE_VERSION: ${{ steps.version.outputs.version }}
        run: |
          Write-Warning 'Automatic WinGet submission did not complete. Use the validated winget-manifests artifact.'
          @"
          ## Manual WinGet submission required

          Automatic submission did not complete for version ``$env:RELEASE_VERSION``.

          1. Download the ``winget-manifests`` artifact from this workflow run.
          2. Fork [microsoft/winget-pkgs](https://github.com/microsoft/winget-pkgs).
          3. Create ``manifests/a/A3SLab/Box/$env:RELEASE_VERSION/`` in the fork.
          4. Copy the three validated YAML files into that directory.
          5. Open a pull request against ``microsoft/winget-pkgs``.
          "@ | Out-File -LiteralPath $env:GITHUB_STEP_SUMMARY -Encoding utf8 -Append