winget-submit.yml

name: Submit RepoDNA to WinGet

# Runs once after this workflow is merged and may also be started for later tags.
# This creates two separate upstream PRs, not a combined manifest submission.
on:
  push:
    branches: [main]
    paths:
      - .github/workflows/winget-submit.yml
  pull_request:
    paths:
      - .github/workflows/winget-submit.yml
      - packaging/winget/**
  workflow_dispatch:
    inputs:
      tag:
        description: Published stable RepoDNA release tag
        required: true
        type: string
        default: v1.4.1

permissions:
  contents: read

concurrency:
  group: repodna-winget-submission
  cancel-in-progress: false

jobs:
  prepare:
    name: Verify published installers and prepare community manifests
    runs-on: ubuntu-latest
    outputs:
      authorized: ${{ steps.auth.outputs.authorized }}
    env:
      GH_TOKEN: ${{ github.token }}
      TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || 'v1.4.1' }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 22
      - name: Check external GitHub submission authorization
        id: auth
        if: github.event_name != 'pull_request'
        shell: bash
        env:
          WINGET_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
        run: |
          if [ -z "$WINGET_TOKEN" ]; then
            echo "authorized=false" >> "$GITHUB_OUTPUT"
            echo '::warning::WinGet files can be validated, but Microsoft PR submission is SKIPPED: configure the WINGET_CREATE_GITHUB_TOKEN repository secret to enable it.'
          else
            echo "authorized=true" >> "$GITHUB_OUTPUT"
            echo "::notice::A WinGet submission credential is configured; upstream PR creation will be attempted after validation."
          fi
      - name: Validate scripts and package generator tests
        run: |
          set -euo pipefail
          bash -n packaging/winget/submit.sh
          node --test packaging/winget/test/*.test.mjs
      - name: Download exact published Windows installers
        shell: bash
        run: |
          set -euo pipefail
          [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || exit 1
          version="${TAG#v}"
          mkdir -p release-files
          for name in \
            "repodna-$version-x86_64-pc-windows-msvc.zip" \
            "repodna-$version-aarch64-pc-windows-msvc.zip" \
            "RepoDNA_${version}_x64_en-US.msi" \
            "RepoDNA_${version}_arm64_en-US.msi" \
            SHA256SUMS.txt; do
            gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern "$name" --dir release-files
          done
          (cd release-files && sha256sum --check --ignore-missing SHA256SUMS.txt)
          node packaging/winget/check-release-checksums.mjs release-files "$version"
          echo "VERSION=$version" >> "$GITHUB_ENV"
      - name: Generate and cross-check WinGet manifests
        shell: bash
        run: |
          set -euo pipefail
          node packaging/winget/generate.mjs --version "$VERSION" --archives release-files --out out
          test "$(find out/manifests -type f -name '*.yaml' | wc -l)" -eq 6
          if [ "$VERSION" = 1.4.1 ]; then
            diff -ru packaging/winget/submissions/manifests out/manifests
          fi
      - uses: actions/upload-artifact@v7
        with:
          name: validated-winget-manifests
          path: out/manifests
          if-no-files-found: error
          retention-days: 30

  validate:
    name: Validate WinGet files on Windows where available
    needs: prepare
    runs-on: windows-latest
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: validated-winget-manifests
          path: manifests
      - name: Run official WinGet local manifest validation
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $client = Get-Command winget -ErrorAction SilentlyContinue
          if (-not $client) {
            Write-Warning 'winget CLI is not available on this Windows hosted runner; Microsoft upstream PR validation remains required.'
            exit 0
          }
          $folders = Get-ChildItem manifests -Recurse -Filter '*.installer.yaml' -File | ForEach-Object { $_.DirectoryName }
          Write-Host ("Installed WinGet client: " + (& winget --version))
          foreach ($folder in $folders) {
            $result = (& winget validate --manifest $folder --disable-interactivity 2>&1 | Out-String)
            $status = $LASTEXITCODE
            Write-Host $result
            if ($status -eq 0) { continue }
            # Some hosted clients accept schema 1.12 but exit nonzero on the new
            # header URL warning. Accept ONLY that known warning, not other errors.
            if ($result -notmatch 'Manifest validation succeeded with warnings\.') {
              throw "WinGet manifest validation failed for $folder (exit $status)"
            }
            $warnings = @($result -split "[\r\n]+" | Where-Object { $_ -like 'Manifest Warning:*' })
            if (-not $warnings.Count) { throw "Validation warned without details: $folder" }
            foreach ($warning in $warnings) {
              if ($warning -notmatch 'schema header URL does not match the expected pattern') {
                throw "Unexpected manifest warning for $folder - $warning"
              }
            }
            Write-Warning "Only schema URL header warnings from the runner client; official upstream schema 1.12 validation still required."
          }
          # The older WinGet client returned a warning exit code, not a manifest error.
          # Do not leave that native exit code as the PowerShell step result.
          $global:LASTEXITCODE = 0

  submit:
    name: Open independent Microsoft WinGet pull requests
    needs: [prepare, validate]
    if: github.event_name != 'pull_request' && needs.prepare.outputs.authorized == 'true'
    runs-on: ubuntu-latest
    env:
      GH_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
      TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || 'v1.4.1' }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 22
      - uses: actions/download-artifact@v8
        with:
          name: validated-winget-manifests
          path: manifests
      - name: Submit each package using an authorized GitHub account
        shell: bash
        run: |
          set -euo pipefail
          if [ -z "$GH_TOKEN" ]; then
            echo '::error::Cannot create upstream WinGet pull requests without a user-authorized token.'
            exit 1
          fi
          git config --global user.name sanskarIN
          git config --global user.email sanskarin@outlook.in
          bash packaging/winget/submit.sh manifests "$TAG"