sync-manifests.yml

name: Sync Package Manifests

on:
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag to render and sync
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: sync-manifests
  cancel-in-progress: false

jobs:
  render-and-sync:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: main
          # Use a PAT so the push step can bypass the branch protection rule
          # that blocks GITHUB_TOKEN from pushing directly to main.
          token: ${{ secrets.CI_PUSH_TOKEN }}

      - name: Resolve release tag
        id: release
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            tag="${{ inputs.tag }}"
          else
            tag="${{ github.event.release.tag_name }}"
          fi
          echo "tag=$tag" >> "$GITHUB_OUTPUT"

      - name: Download checksums
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p dist/render
          gh release download "${{ steps.release.outputs.tag }}" \
            --repo "$GITHUB_REPOSITORY" \
            --pattern checksums.txt \
            --dir dist/render

      - name: Render manifests
        env:
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail
          version="${TAG#v}"
          base_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}"
          cs="dist/render/checksums.txt"

          bash packaging/render.sh "$cs" "$version" "$base_url" \
            packaging/homebrew/dci.rb.tmpl dist/render/homebrew/dci.rb

          bash packaging/render.sh "$cs" "$version" "$base_url" \
            packaging/scoop/dci.json.tmpl dist/render/scoop/dci.json

          bash packaging/render.sh "$cs" "$version" "$base_url" \
            packaging/winget/dci.yaml.tmpl dist/render/winget/DoiT.dci.yaml

          bash packaging/render.sh "$cs" "$version" "$base_url" \
            packaging/winget/dci.installer.yaml.tmpl dist/render/winget/DoiT.dci.installer.yaml

          bash packaging/render.sh "$cs" "$version" "$base_url" \
            packaging/winget/dci.locale.en-US.yaml.tmpl dist/render/winget/DoiT.dci.locale.en-US.yaml

      - name: Upload rendered manifests
        uses: actions/upload-artifact@v4
        with:
          name: package-manifests-${{ steps.release.outputs.tag }}
          path: dist/render

      - name: Commit Homebrew formula and Scoop manifest
        env:
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail

          cp dist/render/homebrew/dci.rb Formula/dci.rb
          cp dist/render/scoop/dci.json bucket/dci.json

          git add Formula/dci.rb bucket/dci.json

          if git diff --cached --quiet -- Formula/dci.rb bucket/dci.json; then
            echo "Homebrew formula and Scoop manifest already up to date."
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git commit -m "Update Homebrew formula and Scoop manifest for ${TAG}"
          git push

      - name: Submit WinGet manifests to winget-pkgs
        env:
          TAG: ${{ steps.release.outputs.tag }}
          WINGET_GH_PAT: ${{ secrets.WINGET_GH_PAT }}
        run: |
          set -euo pipefail
          version="${TAG#v}"

          if [ -z "${WINGET_GH_PAT}" ]; then
            echo "::warning::WINGET_GH_PAT secret not set — skipping WinGet submission."
            echo "### WinGet" >> "$GITHUB_STEP_SUMMARY"
            echo "Skipped: \`WINGET_GH_PAT\` secret is not configured." >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          # Clone the fork (created once via: gh repo fork microsoft/winget-pkgs)
          WINGET_FORK="${WINGET_FORK:-apgiorgi/winget-pkgs}"

          # Sync the fork with upstream before branching: the release branch is
          # based on upstream/master, and pushing upstream's workflow-file
          # changes to a stale fork is rejected when the PAT lacks the
          # `workflow` scope. The merge-upstream API (what `gh repo sync`
          # calls) is server-side and exempt from that scope check. --force
          # keeps the fork's master a mirror; release branches are unaffected.
          GH_TOKEN="${WINGET_GH_PAT}" gh repo sync "${WINGET_FORK}" \
            --source microsoft/winget-pkgs --force

          git clone --depth 1 \
            "https://x-access-token:${WINGET_GH_PAT}@github.com/${WINGET_FORK}.git" \
            /tmp/winget-pkgs

          cd /tmp/winget-pkgs
          git remote add upstream https://github.com/microsoft/winget-pkgs.git
          git fetch upstream master --depth 1
          git checkout -b "DoiT.dci-${version}" upstream/master

          # Copy rendered manifests
          manifest_dir="manifests/d/DoiT/dci/${version}"
          mkdir -p "${manifest_dir}"
          cp "${GITHUB_WORKSPACE}/dist/render/winget/"* "${manifest_dir}/"

          git add "${manifest_dir}"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git commit -m "New version: DoiT.dci version ${version}"
          git push -u origin "DoiT.dci-${version}" --force

          # Create PR to microsoft/winget-pkgs
          fork_owner="${WINGET_FORK%%/*}"
          pr_url=$(GH_TOKEN="${WINGET_GH_PAT}" gh pr create \
            --repo microsoft/winget-pkgs \
            --head "${fork_owner}:DoiT.dci-${version}" \
            --title "New version: DoiT.dci version ${version}" \
            --body "## New version: DoiT.dci version ${version}

          - **PackageIdentifier:** DoiT.dci
          - **PackageVersion:** ${version}
          - **InstallerUrl:** https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/dci_${version}_windows_amd64.zip

          Auto-submitted by [dci-cli CI](https://github.com/${GITHUB_REPOSITORY}/actions).")

          {
            echo "### WinGet"
            echo
            echo "Submitted PR to microsoft/winget-pkgs: ${pr_url}"
          } >> "$GITHUB_STEP_SUMMARY"