winget.yml

name: Submit to WinGet

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Released version to submit to winget-pkgs (e.g. 0.27.0)"
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: winget-submit-${{ inputs.version }}
  cancel-in-progress: false

jobs:
  submit:
    # WinGet manifests can only be submitted from Windows (wingetcreate is a
    # Windows tool). Manual-only by design: a human runs this after a release is
    # promoted, so it never gates promote and never auto-fires on a tag.
    runs-on: windows-latest
    steps:
      - name: Verify the release is published and non-prerelease
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          is_pre=$(gh release view "v${VERSION}" --repo "${GITHUB_REPOSITORY}" --json isPrerelease -q '.isPrerelease')
          if [ "$is_pre" != "false" ]; then
            echo "::error::Release v${VERSION} is not a promoted (non-prerelease) release; refusing to submit to WinGet." >&2
            exit 1
          fi

      - name: Submit manifest to WinGet (new or update)
        shell: pwsh
        env:
          WINGET_TOKEN: ${{ secrets.WINGET_SUBMIT_TOKEN }}
          VERSION: ${{ inputs.version }}
        run: |
          $ErrorActionPreference = "Stop"
          if (-not $env:WINGET_TOKEN) {
            throw "WINGET_SUBMIT_TOKEN is not configured"
          }
          $installerUrl = "https://github.com/PyModel/pythinker-cli/releases/download/v$env:VERSION/PythinkerSetup-$env:VERSION.exe"
          $wingetCreateUrl = "https://github.com/microsoft/winget-create/releases/download/v1.12.8.0/wingetcreate.exe"
          $wingetCreateSha256 = "8BD738851B524885410112678E3771B341C5C716DE60FBBECB88AB0A363ED85D"
          Invoke-WebRequest -Uri $wingetCreateUrl -OutFile wingetcreate.exe
          $actualHash = (Get-FileHash -Algorithm SHA256 wingetcreate.exe).Hash
          if ($actualHash -ne $wingetCreateSha256) {
            throw "wingetcreate.exe SHA-256 mismatch: expected $wingetCreateSha256, got $actualHash"
          }

          # Detect whether the package already exists in winget-pkgs.
          $manifestPath = "manifests/p/PythoughtsLabs/PythinkerCode"
          $headers = @{
            Authorization = "token $env:WINGET_TOKEN"
            Accept = "application/vnd.github+json"
            "X-GitHub-Api-Version" = "2022-11-28"
          }
          $packageExists = $false
          try {
            $null = Invoke-WebRequest -Uri "https://api.github.com/repos/microsoft/winget-pkgs/contents/$manifestPath" `
              -Headers $headers -ErrorAction Stop
            $packageExists = $true
          } catch {
            # Only treat 404 as "package not yet submitted". Any other status
            # (401, 403, 5xx) or network failure means something is wrong — fail loudly.
            $response = $_.Exception.Response
            if ($null -ne $response -and [int]$response.StatusCode -eq 404) {
              $packageExists = $false
            } else {
              throw
            }
          }

          if ($packageExists) {
            Write-Host "Package exists in winget-pkgs — running wingetcreate update"
            .\wingetcreate.exe update PythoughtsLabs.PythinkerCode `
              --version $env:VERSION `
              --urls "$installerUrl" `
              --submit `
              --token $env:WINGET_TOKEN
          } else {
            # wingetcreate new is interactive and not safe to run in CI.
            # The initial submission must be done once manually:
            #   wingetcreate new <installerUrl> --token <PAT>
            # After that PR is merged into winget-pkgs, this workflow handles
            # all subsequent updates automatically via wingetcreate update.
            throw "Package 'PythoughtsLabs.PythinkerCode' not found in winget-pkgs. " + `
                  "Submit the initial manifest manually: " + `
                  "wingetcreate new $installerUrl --token <WINGET_SUBMIT_TOKEN>"
          }