submit-packages.yml

name: Submit to Package Managers

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to submit (without v prefix)'
        required: true
        type: string
      dry_run:
        description: 'Dry run (generate manifests without submitting)'
        required: false
        type: boolean
        default: false
      package_managers:
        description: 'Package managers to submit to (comma-separated, or "all")'
        required: false
        type: string
        default: 'all'

jobs:
  submit-linux:
    runs-on: ubuntu-latest
    name: Submit (Linux)

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Setup AUR SSH key
        if: env.AUR_SSH_KEY != ''
        run: |
          mkdir -p ~/.ssh
          echo "$AUR_SSH_KEY" | base64 -d > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
          cat >> ~/.ssh/config << EOF
          Host aur.archlinux.org
            IdentityFile ~/.ssh/aur
            User aur
            StrictHostKeyChecking no
          EOF
          chmod 600 ~/.ssh/config
        env:
          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}

      - name: Import GPG key
        if: env.GPG_PRIVATE_KEY != ''
        run: |
          echo "$GPG_PRIVATE_KEY" | base64 -d | gpg --batch --import
          KEY_ID=$(gpg --list-keys --keyid-format LONG | grep -A1 "^pub" | tail -1 | awk '{print $1}')
          echo "${KEY_ID}:6:" | gpg --import-ownertrust
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

      - name: Determine version
        id: version
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          if [ -n "$INPUT_VERSION" ]; then
            VERSION="$INPUT_VERSION"
          elif [ -n "$RELEASE_TAG" ]; then
            VERSION="$RELEASE_TAG"
          else
            VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          fi
          VERSION="${VERSION#v}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Submitting version: $VERSION"

      - name: Determine package managers
        id: pms
        env:
          INPUT_PMS: ${{ github.event.inputs.package_managers }}
        run: |
          if [ -z "$INPUT_PMS" ]; then
            INPUT_PMS="all"
          fi

          if [ "$INPUT_PMS" = "all" ]; then
            PMS="homebrew,scoop,winget,aur,apt,rpm,gentoo,nix"
          else
            PMS=$(echo "$INPUT_PMS" | sed 's/chocolatey,//g' | sed 's/,chocolatey//g' | sed 's/^chocolatey$//g')
          fi
          echo "package_managers=$PMS" >> "$GITHUB_OUTPUT"

      - name: Submit to package managers
        if: steps.pms.outputs.package_managers != ''
        env:
          VERSION: ${{ steps.version.outputs.version }}
          PMS: ${{ steps.pms.outputs.package_managers }}
          DRY_RUN: ${{ github.event.inputs.dry_run }}
          GITHUB_TOKEN: ${{ secrets.PKG_SUBMIT_TOKEN || secrets.GITHUB_TOKEN }}
          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          ARGS="-v $VERSION"

          for PM in $(echo "$PMS" | tr ',' ' '); do
            ARGS="$ARGS -p $PM"
          done

          if [ "$DRY_RUN" = "true" ]; then
            ARGS="$ARGS --dry-run"
          fi

          echo "Running: npx tsx scripts/submit-packages.ts $ARGS"
          npx tsx scripts/submit-packages.ts $ARGS

      - name: Summary
        if: always()
        env:
          VERSION: ${{ steps.version.outputs.version }}
          PACKAGE_MANAGERS: ${{ steps.pms.outputs.package_managers }}
          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
        run: |
          {
            echo "## Package Submission Summary (Linux)"
            echo ""
            echo "- **Version**: ${VERSION}"
            echo "- **Package Managers**: ${PACKAGE_MANAGERS}"
            echo "- **Dry Run**: ${DRY_RUN}"
          } >> "$GITHUB_STEP_SUMMARY"

  submit-chocolatey:
    runs-on: windows-latest
    name: Submit (Chocolatey)
    if: >-
      github.event.inputs.package_managers == 'all' ||
      github.event.inputs.package_managers == '' ||
      contains(github.event.inputs.package_managers, 'chocolatey')

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Determine version
        id: version
        shell: bash
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          if [ -n "$INPUT_VERSION" ]; then
            VERSION="$INPUT_VERSION"
          elif [ -n "$RELEASE_TAG" ]; then
            VERSION="$RELEASE_TAG"
          else
            VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          fi
          VERSION="${VERSION#v}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Check Chocolatey API key
        id: check-key
        shell: bash
        run: |
          if [ -z "$CHOCOLATEY_API_KEY" ]; then
            echo "has_key=false" >> $GITHUB_OUTPUT
            echo "::warning::CHOCOLATEY_API_KEY secret not configured, skipping"
          else
            echo "has_key=true" >> $GITHUB_OUTPUT
          fi
        env:
          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}

      - name: Submit to Chocolatey
        if: steps.check-key.outputs.has_key == 'true'
        shell: bash
        env:
          VERSION: ${{ steps.version.outputs.version }}
          DRY_RUN: ${{ github.event.inputs.dry_run }}
          GITHUB_TOKEN: ${{ secrets.PKG_SUBMIT_TOKEN || secrets.GITHUB_TOKEN }}
          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
        run: |
          ARGS="-v $VERSION -p chocolatey"

          if [ "$DRY_RUN" = "true" ]; then
            ARGS="$ARGS --dry-run"
          fi

          npx tsx scripts/submit-packages.ts $ARGS

      - name: Summary
        if: always()
        shell: bash
        env:
          VERSION: ${{ steps.version.outputs.version }}
          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
        run: |
          {
            echo "## Package Submission Summary (Chocolatey)"
            echo ""
            echo "- **Version**: ${VERSION}"
            echo "- **Dry Run**: ${DRY_RUN}"
          } >> "$GITHUB_STEP_SUMMARY"