update-nuspec.yml

name: Update nuspec files

on:
  workflow_run:
    workflows: ["service::event_dispatcher::pull_request::closed::main"]
    types:
      - completed
  workflow_dispatch:
    inputs:
      force:
        description: 'Force update all nuspec files'
        required: false
        type: boolean
        default: false

concurrency:
  group: update-nuspec
  cancel-in-progress: true

jobs:
  validate:
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch'
    outputs:
      result: ${{ steps.validate.outputs.result }}
    steps:
      - uses: actions/checkout@v4

      - name: Initialize
        id: initialize
        env:
          GH_TOKEN: ${{ secrets.PAT }}
          WORKFLOW_EVENT: ${{ github.event.workflow_run.event }}
          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            echo "[workflow_dispatch] Skipping PR validation"
            echo "pull_request_merged=true" >> $GITHUB_OUTPUT
            echo "pull_request_head_ref=" >> $GITHUB_OUTPUT
            exit 0
          fi

          if [ "$WORKFLOW_EVENT" != "pull_request" ]; then
            echo "[skip] Not a pull_request event"
            echo "pull_request_merged=false" >> $GITHUB_OUTPUT
            echo "pull_request_head_ref=" >> $GITHUB_OUTPUT
            exit 0
          fi
          
          PR_JSON=$(gh pr list --repo ${{ github.repository }} --state all --json number,mergeCommit,headRefName,baseRefName,state --search "$HEAD_SHA" --limit 1 --jq '.[0]')
          if [ "$(echo "$PR_JSON" | jq '. | length')" -eq 0 ]; then
            echo "[skip] No PR found for commit $HEAD_SHA"
            echo "pull_request_merged=false" >> $GITHUB_OUTPUT
            echo "pull_request_head_ref=" >> $GITHUB_OUTPUT
            exit 0
          fi
          
          PR_STATE=$(echo "$PR_JSON" | jq -r '.state')
          PR_BASE_REF_NAME=$(echo "$PR_JSON" | jq -r '.baseRefName')
          PR_HEAD_REF=$(echo "$PR_JSON" | jq -r '.headRefName')
          PR_MERGED="$([[ "$PR_STATE" == "MERGED" ]] && echo true || echo false)"
          
          echo "pull_request_merged=$PR_MERGED" >> $GITHUB_OUTPUT
          echo "pull_request_head_ref=$PR_HEAD_REF" >> $GITHUB_OUTPUT
          echo "pull_request_base_ref_name=$PR_BASE_REF_NAME" >> $GITHUB_OUTPUT

      - name: Validate
        id: validate
        env:
          PULL_REQUEST_MERGED: ${{ steps.initialize.outputs.pull_request_merged }}
          GITHUB_HEAD_REF: ${{ steps.initialize.outputs.pull_request_head_ref }}
          GITHUB_BASE_REF: ${{ steps.initialize.outputs.pull_request_base_ref_name }}
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            echo "result=true" >> $GITHUB_OUTPUT
            exit 0
          fi

          merged="$([[ "$PULL_REQUEST_MERGED" == "true" ]] && echo true || echo false)"
          originated_from_feature="$([[ ! "$GITHUB_HEAD_REF" =~ ^bot\/[^\/]+\/update-nuspec$ ]] && echo true || echo false)"
          result="$([[ "$merged" == true && "$originated_from_feature" == true ]] && echo true || echo false)"
          echo "result=$result" >> $GITHUB_OUTPUT

  has-changes:
    needs: [validate]
    if: needs.validate.outputs.result == 'true'
    runs-on: ubuntu-latest
    outputs:
      module: ${{ steps.finalize.outputs.module }}
      aspnetcore: ${{ steps.finalize.outputs.aspnetcore }}
      cli: ${{ steps.finalize.outputs.cli }}
      
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/has-changes
        if: github.event.inputs.force != 'true'
        id: has-changes-module
        with:
          project: EncryptedConfigValue.Module

      - uses: ./.github/actions/has-changes
        if: github.event.inputs.force != 'true'
        id: has-changes-aspnetcore
        with:
          project: EncryptedConfigValue.AspNetCore

      - uses: ./.github/actions/has-changes
        if: github.event.inputs.force != 'true'
        id: has-changes-cli
        with:
          project: EncryptedConfigValue.Cli

      - name: Finalize
        id: finalize
        run: |
          if [[ "${{ github.event.inputs.force }}" == "true" ]]; then
            echo "module=true" >> $GITHUB_OUTPUT
            echo "aspnetcore=true" >> $GITHUB_OUTPUT
            echo "cli=true" >> $GITHUB_OUTPUT
          else
            echo "module=${{ steps.has-changes-module.outputs.result }}" >> $GITHUB_OUTPUT
            echo "aspnetcore=${{ steps.has-changes-aspnetcore.outputs.result }}" >> $GITHUB_OUTPUT
            echo "cli=${{ steps.has-changes-cli.outputs.result }}" >> $GITHUB_OUTPUT
          fi

  module:
    needs: [has-changes]
    if: github.event.inputs.force == 'true' || needs.has-changes.outputs.module == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      project: ${{ steps.set-project-name.outputs.value }}
      branch: ${{ steps.set-branch-name.outputs.value }}
    steps:
      - uses: actions/checkout@v4
      - name: Set project name
        id: set-project-name
        run: |
          echo "value=EncryptedConfigValue.Module" >> $GITHUB_OUTPUT
      - name: Set branch name
        id: set-branch-name
        run: |
          echo "value=bot/${{ steps.set-project-name.outputs.value }}/update-nuspec" >> $GITHUB_OUTPUT
      - uses: ./.github/actions/setup-git
        with:
          branch: ${{ steps.set-branch-name.outputs.value }}
          hard-reset: true
      - name: IsVersionBumpEnabled
        id: is-version-bump-enabled
        shell: pwsh
        run: |
          $lastVersionTag = (git tag -l "EncryptedConfigValue.Module/*" | Sort-Object { [version]($_ -split '/' | Select-Object -Last 1) } | Select-Object -Last 1) -split '/' | Select-Object -Last 1
          $nuspecVersion = (Select-String -Path .\EncryptedConfigValue.Module\EncryptedConfigValue.Module.nuspec -Pattern '<version>(.*?)</version>' | ForEach-Object { $_.Matches.Groups[1].Value })
          $newestVersion = @($lastVersionTag, $nuspecVersion) | Sort-Object { [version]($_ -replace "net", "") } -Descending | Select-Object -First 1
          "value=$("$($newestVersion -eq $nuspecVersion)".ToLowerInvariant())" >> $env:GITHUB_OUTPUT
      - uses: ./.github/actions/update-nuspec-file
        with:
          GITHUB_TOKEN: ${{ secrets.PAT }}
          project: ${{ steps.set-project-name.outputs.value }}
          is-version-bump-enabled: ${{ steps.is-version-bump-enabled.outputs.value }}
          external-dependencies-sources: |
            EncryptedConfigValue
          additional-files: |
            ./Readme.md
      - uses: ./.github/actions/commit-changes
        with:
          message: Update ${{ steps.set-project-name.outputs.value }}.nuspec
      - uses: ./.github/actions/push-changes
        with:
          branch: ${{ steps.set-branch-name.outputs.value }}
          force: true
      - uses: ./.github/actions/put-pull-request
        with:
          GITHUB_TOKEN: ${{ secrets.PAT }}
          title: Update ${{ steps.set-project-name.outputs.value }}.nuspec
          body: This PR updates the  ${{ steps.set-project-name.outputs.value }}.nuspec file to ensure correct project dependencies, metadata, or versioning. Please review the changes for accuracy and compliance.
          from: ${{ steps.set-branch-name.outputs.value }}
          into: main

  aspnetcore:
    needs: [has-changes]
    if: github.event.inputs.force == 'true' || needs.has-changes.outputs.aspnetcore == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      project: ${{ steps.set-project-name.outputs.value }}
      branch: ${{ steps.set-branch-name.outputs.value }}
    steps:
      - uses: actions/checkout@v4
      - name: Set project name
        id: set-project-name
        run: |
          echo "value=EncryptedConfigValue.AspNetCore" >> $GITHUB_OUTPUT
      - name: Set branch name
        id: set-branch-name
        run: |
          echo "value=bot/${{ steps.set-project-name.outputs.value }}/update-nuspec" >> $GITHUB_OUTPUT
      - uses: ./.github/actions/setup-git
        with:
          branch: ${{ steps.set-branch-name.outputs.value }}
          hard-reset: true
      - name: IsVersionBumpEnabled
        id: is-version-bump-enabled
        shell: pwsh
        run: |
          $lastVersionTag = (git tag -l "EncryptedConfigValue.AspNetCore/*" | Sort-Object { [version]($_ -split '/' | Select-Object -Last 1) } | Select-Object -Last 1) -split '/' | Select-Object -Last 1
          $nuspecVersion = (Select-String -Path .\EncryptedConfigValue.AspNetCore\EncryptedConfigValue.AspNetCore.nuspec -Pattern '<version>(.*?)</version>' | ForEach-Object { $_.Matches.Groups[1].Value })
          $newestVersion = @($lastVersionTag, $nuspecVersion) | Sort-Object { [version]($_ -replace "net", "") } -Descending | Select-Object -First 1
          "value=$("$($newestVersion -eq $nuspecVersion)".ToLowerInvariant())" >> $env:GITHUB_OUTPUT
      - uses: ./.github/actions/update-nuspec-file
        with:
          GITHUB_TOKEN: ${{ secrets.PAT }}
          project: ${{ steps.set-project-name.outputs.value }}
          is-version-bump-enabled: ${{ steps.is-version-bump-enabled.outputs.value }}
          additional-files: |
            ./Readme.md
      - uses: ./.github/actions/commit-changes
        with:
          message: Update ${{ steps.set-project-name.outputs.value }}.nuspec
      - uses: ./.github/actions/push-changes
        with:
          branch: ${{ steps.set-branch-name.outputs.value }}
          force: true
      - uses: ./.github/actions/put-pull-request
        with:
          GITHUB_TOKEN: ${{ secrets.PAT }}
          title: Update ${{ steps.set-project-name.outputs.value }}.nuspec
          body: This PR updates the  ${{ steps.set-project-name.outputs.value }}.nuspec file to ensure correct project dependencies, metadata, or versioning. Please review the changes for accuracy and compliance.
          from: ${{ steps.set-branch-name.outputs.value }}
          into: main

  cli:
    needs: [has-changes]
    if: github.event.inputs.force == 'true' || needs.has-changes.outputs.cli == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      project: ${{ steps.set-project-name.outputs.value }}
      branch: ${{ steps.set-branch-name.outputs.value }}
    steps:
      - uses: actions/checkout@v4
      - name: Set project name
        id: set-project-name
        run: |
          echo "value=EncryptedConfigValue.Cli" >> $GITHUB_OUTPUT
      - name: Set branch name
        id: set-branch-name
        run: |
          echo "value=bot/${{ steps.set-project-name.outputs.value }}/update-nuspec" >> $GITHUB_OUTPUT
      - uses: ./.github/actions/setup-git
        with:
          branch: ${{ steps.set-branch-name.outputs.value }}
          hard-reset: true
      - name: IsVersionBumpEnabled
        id: is-version-bump-enabled
        shell: pwsh
        run: |
          $lastVersionTag = (git tag -l "EncryptedConfigValue.Cli/*" | Sort-Object { [version]($_ -split '/' | Select-Object -Last 1) } | Select-Object -Last 1) -split '/' | Select-Object -Last 1
          $nuspecVersion = (Select-String -Path .\EncryptedConfigValue.Cli\EncryptedConfigValue.Cli.nuspec -Pattern '<version>(.*?)</version>' | ForEach-Object { $_.Matches.Groups[1].Value })
          $newestVersion = @($lastVersionTag, $nuspecVersion) | Sort-Object { [version]($_ -replace "net", "") } -Descending | Select-Object -First 1
          "value=$("$($newestVersion -eq $nuspecVersion)".ToLowerInvariant())" >> $env:GITHUB_OUTPUT
      - uses: ./.github/actions/update-nuspec-file
        with:
          GITHUB_TOKEN: ${{ secrets.PAT }}
          project:  ${{ steps.set-project-name.outputs.value }}
          is-version-bump-enabled: ${{ steps.is-version-bump-enabled.outputs.value }}
          external-dependencies-sources: |
            EncryptedConfigValue
          additional-files: |
            ./Readme.md
      - uses: ./.github/actions/commit-changes
        with:
          message: Update ${{ steps.set-project-name.outputs.value }}.nuspec
      - uses: ./.github/actions/push-changes
        with:
          branch: ${{ steps.set-branch-name.outputs.value }}
          force: true
      - uses: ./.github/actions/put-pull-request
        with:
          GITHUB_TOKEN: ${{ secrets.PAT }}
          title: Update ${{ steps.set-project-name.outputs.value }}.nuspec
          body: This PR updates the  ${{ steps.set-project-name.outputs.value }}.nuspec file to ensure correct project dependencies, metadata, or versioning. Please review the changes for accuracy and compliance.
          from: ${{ steps.set-branch-name.outputs.value }}
          into: main