update-windows-info.yml

name: Updates verify-installers.md after desktop release

on:
  repository_dispatch:
    types: [desktop-release]

defaults:
  run:
    shell: bash


jobs:
  create-pr:
    name: Create PR to update windows signing cert
    runs-on: windows-latest
    permissions:
      contents: write
    env:
      DESKTOP_VERSION: ${{ github.event.client_payload.version }}
    steps:
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Create new branch
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          if [[ ! "$DESKTOP_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z]+)*$ ]]; then
            echo "Invalid version in payload: $DESKTOP_VERSION" >&2
            exit 1;
          fi
          git checkout -b "feature/desktop-${DESKTOP_VERSION}"
      - name: Download MSI
        run: |
          MSI_URL=$(jq -r '[.[] | select(.name | endswith(".msi"))][0].browser_download_url // "null"' <<< "$ASSETS_JSON")
          if [[ "$MSI_URL" == "null" || -z "$MSI_URL" ]]; then
            echo "No MSI asset found in repository_dispatch payload." >&2
            exit 1
          fi
          curl --silent --fail-with-body --proto "=https" -L -H "Accept: application/vnd.github+json" $MSI_URL --output cryptomator.msi
        env:
          ASSETS_JSON: ${{ toJson(github.event.client_payload.release.assets ) }}
      - name: Update verify-installers.md
        shell: pwsh
        run: |
          $Thumbprint = (Get-AuthenticodeSignature -FilePath 'cryptomator.msi' -ErrorAction Stop).SignerCertificate.Thumbprint

          $DocPath = 'docs/security/verify-installers.md'
          $Content = Get-Content -Path $DocPath -Raw

          $CurrentThumbprintRegex = [regex] ([regex]::Escape($env:AUTOMATION_MARKER) + '`[A-F0-9]+`')
          $UpdatedContent = $CurrentThumbprintRegex.Replace($Content, ($env:AUTOMATION_MARKER + '`' + $Thumbprint + '`'), 1)
          if ($UpdatedContent -eq $Content) {
            throw 'Failed to update the current Windows thumbprint in verify-installers.md.'
          }
          $Content = $UpdatedContent

          $MarkedRow = (Get-Content -Path $DocPath | Where-Object { $_.TrimStart().StartsWith('|') -and $_.Contains($env:AUTOMATION_MARKER) } | Select-Object -First 1)
          if ($null -eq $MarkedRow) {
            throw 'Failed to find the marked Windows certificate table row in verify-installers.md.'
          }

          $PreviousRow = $MarkedRow.Substring(0, $MarkedRow.IndexOf($env:AUTOMATION_MARKER)).TrimEnd() + " |"
          $NewRow = "|  $env:DESKTOP_VERSION  |" + '`' + $Thumbprint + '`' + "$env:AUTOMATION_MARKER |"
          $Content = $Content.Replace($MarkedRow, $NewRow + "`r`n" + $PreviousRow)

          Set-Content -Path $DocPath -Value $Content
        env:
          AUTOMATION_MARKER: '<!-- AUTOMATION MARKER FOR WORKFLOW -->'
      - name: Commit and push
        id: commit-and-push
        run: |
          git config user.name "cryptobot"
          git config user.email "cryptobot@users.noreply.github.com"
          git config push.autoSetupRemote true
          git stage docs/security/verify-installers.md
          if git diff --cached --quiet; then
            echo "No changes to commit"
            echo "changed=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git commit -m "Update Windows section for verifying installers for release ${DESKTOP_VERSION}"
          git push
          echo "changed=true" >> "$GITHUB_OUTPUT"
      - name: Create pull request
        id: create-pr
        if: steps.commit-and-push.outputs.changed == 'true'
        run: |
          printf "Created by $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > pr_body.md
          PR_URL=$(gh pr create --title "Desktop release ${DESKTOP_VERSION}" --body-file pr_body.md)
          echo "url=$PR_URL" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
      - name: Slack Notification
        if: steps.commit-and-push.outputs.changed == 'true'
        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
        env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_CRYPTOMATOR_DESKTOP }}
          SLACK_USERNAME: 'Cryptobot'
          SLACK_ICON: false
          SLACK_ICON_EMOJI: ':bot:'
          SLACK_CHANNEL: 'cryptomator-desktop'
          SLACK_TITLE: "Docs update PR created for release ${{ github.event.client_payload.version }} ."
          SLACK_MESSAGE: "See <${{ steps.create-pr.outputs.url }}|PR> on how to proceed."
          SLACK_FOOTER: false
          MSG_MINIMAL: true