tod 0.11.2

name: Windows Build & Release
on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  CARGO_PROFILE_TEST_DEBUG: 0
  CARGO_PROFILE_RELEASE_LTO: true
  CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 1

jobs:
  build-windows:
    name: Build & Upload Windows x86_64
    runs-on: windows-latest

    steps:
      - name: App token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.TODD_APP_ID }}
          private-key: ${{ secrets.TODD_PRIVATE_KEY }}
          owner: tod-org
          repositories: tod

      - name: Checkout repository
        uses: actions/checkout@v6

      - uses: taiki-e/install-action@nextest

      - uses: Swatinem/rust-cache@v2
        with:
          cache-all-crates: true

      - name: Install Rust Toolchain
        run: rustup toolchain install

      - name: Run tests using cargo-nextest
        run: cargo nextest run --all-features
        continue-on-error: false

      - name: Install Rust target for Windows
        run: rustup target add x86_64-pc-windows-msvc

      - name: get VERSION and tag from Cargo.toml
        id: cargo-get
        uses: nicolaiunrein/cargo-get@master
        with:
          subcommand: package.version

      - name: Set version and tag variable
        id: version
        shell: bash
        run: |
          echo "VERSION=$(cargo get package.version)" >> $GITHUB_ENV
          echo "TAG=$(cargo get package.version --pretty)" >> $GITHUB_ENV

      - name: Build release binary
        run: cargo build --release --target x86_64-pc-windows-msvc

      - name: Zip the Windows binary
        run: |
          Compress-Archive -Path target\x86_64-pc-windows-msvc\release\tod.exe `
                            -DestinationPath target\release\tod-${env:VERSION}-windows-amd64.zip

      - name: Hash the ZIP
        run: |
          Get-FileHash target\release\tod-${env:VERSION}-windows-amd64.zip -Algorithm SHA256

      - name: Upload to GitHub Release
        run: |
          gh release upload "$env:TAG" `
            "target/release/tod-${env:VERSION}-windows-amd64.zip" `
            --repo "$env:GITHUB_REPOSITORY" `
            --clobber
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          VERSION: ${{ env.VERSION }}
          TAG: ${{ env.TAG }}

  update-scoop-manifest:
    name: Update Scoop Manifest
    needs: build-windows
    runs-on: ubuntu-latest

    steps:
      - name: App token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.TODD_APP_ID }}
          private-key: ${{ secrets.TODD_PRIVATE_KEY }}
          owner: tod-org

      - name: Checkout repository (App token authentication)
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false  # we'll push with the App token

      - name: Install jq
        run: sudo apt-get update && sudo apt-get install -y jq

      - name: Get VERSION from Cargo.toml
        id: cargo-get
        uses: nicolaiunrein/cargo-get@master
        with:
          subcommand: package.version

      - name: Set version variable
        id: set_version
        run: |
          VERSION=$(cargo get package.version)
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Compute SHA256 of release zip
        run: |
          ZIP_URL="https://github.com/tod-org/tod/releases/download/v$VERSION/tod-$VERSION-windows-amd64.zip"
          curl -L -o tod.zip "$ZIP_URL"
          HASH=$(sha256sum tod.zip | awk '{print $1}')
          echo "HASH=$HASH" >> $GITHUB_ENV

      - name: Update bucket/tod.json
        run: |
          jq --arg version "$VERSION" \
             --arg url "https://github.com/tod-org/tod/releases/download/v$VERSION/tod-$VERSION-windows-amd64.zip" \
             --arg hash "$HASH" \
             '
             .version = $version |
             .architecture."64bit".url = $url |
             .architecture."64bit".hash = $hash
             ' bucket/tod.json > bucket/tod.json.tmp && mv bucket/tod.json.tmp bucket/tod.json

      - name: Commit & push directly to main
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          # Ensure we're on main (not detached at the tag)
          git fetch origin main
          git checkout main
          git pull --ff-only origin main

          # Clean author/committer identity
          git config user.name "tod-deploy[bot]"
          git config user.email "tod-deploy[bot]@users.noreply.github.com"
          export GIT_AUTHOR_NAME="tod-deploy[bot]"
          export GIT_AUTHOR_EMAIL="tod-deploy[bot]@users.noreply.github.com"
          export GIT_COMMITTER_NAME="$GIT_AUTHOR_NAME"
          export GIT_COMMITTER_EMAIL="$GIT_AUTHOR_EMAIL"

          git add bucket/tod.json
          if git diff --cached --quiet; then
            echo "No changes to commit."
            exit 0
          fi

          git commit -m "chore(scoop): update tod.json to v${VERSION}"

          # Push with the GitHub App token (bypasses branch protection per your settings)
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git push origin main