homebrew-release.yml

name: Update Homebrew Formula on Release

# Triggers when a new version tag is pushed
on:
  push:
    tags:
      - 'v*'
  pull_request:
    branches: [master]
    paths:
      - '.github/workflows/homebrew-release.yml'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (without v prefix, e.g., 5.2.0)'
        required: true
        type: string
      dry_run:
        description: 'Dry run (skip push to homebrew-mfc)'
        required: false
        type: boolean
        default: false

# Least-privilege default: no job in this workflow writes to the repo.
permissions:
  contents: read

jobs:
  update-homebrew-tap:
    name: Update homebrew-mfc tap
    runs-on: ubuntu-latest
    environment:
      name: homebrew
      url: https://github.com/MFlowCode/homebrew-mfc

    steps:
      - name: Determine version
        id: version
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            VERSION="${{ inputs.version }}"
          elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
            # Use existing version for PR testing
            VERSION="5.2.0"
            echo "::notice::PR test mode - using version $VERSION"
          else
            # Extract version from tag (remove 'v' prefix)
            VERSION="${GITHUB_REF#refs/tags/v}"
          fi

          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Invalid version format: $VERSION (expected X.Y.Z)"
            exit 1
          fi

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Version: $VERSION"

      - name: Compute SHA256 of release tarball
        id: sha256
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          URL="https://github.com/MFlowCode/MFC/archive/refs/tags/v${VERSION}.tar.gz"

          echo "Downloading tarball from: $URL"

          # Verify URL is reachable
          HTTP_CODE=$(curl -sI -w "%{http_code}" -o /dev/null "$URL")
          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "302" ]]; then
            echo "::error::Release tarball not found at $URL (HTTP $HTTP_CODE)"
            echo "::error::Make sure the tag v${VERSION} exists and the release is published"
            exit 1
          fi

          # Compute SHA256
          SHA256=$(curl -sL "$URL" | sha256sum | awk '{print $1}')

          if [[ -z "$SHA256" || "$SHA256" == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" ]]; then
            echo "::error::Failed to compute SHA256 (empty file or download failed)"
            exit 1
          fi

          echo "sha256=$SHA256" >> "$GITHUB_OUTPUT"
          echo "SHA256: $SHA256"

      - name: PR test summary
        if: ${{ github.event_name == 'pull_request' }}
        run: |
          echo "## PR Test Mode" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Validated:" >> $GITHUB_STEP_SUMMARY
          echo "- Version parsing: v${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "- SHA256 computation: \`${{ steps.sha256.outputs.sha256 }}\`" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Skipped (secrets not available for fork PRs):" >> $GITHUB_STEP_SUMMARY
          echo "- Checkout homebrew-mfc" >> $GITHUB_STEP_SUMMARY
          echo "- Update formula" >> $GITHUB_STEP_SUMMARY
          echo "- Push to tap" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "The full workflow will run when a \`v*\` tag is pushed after merge." >> $GITHUB_STEP_SUMMARY

      - name: Checkout homebrew-mfc tap
        if: ${{ github.event_name != 'pull_request' }}
        uses: actions/checkout@v5
        with:
          repository: MFlowCode/homebrew-mfc
          token: ${{ secrets.TAP_REPO_TOKEN }}
          path: homebrew-mfc

      - name: Update formula
        if: ${{ github.event_name != 'pull_request' }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          SHA256="${{ steps.sha256.outputs.sha256 }}"
          FORMULA="homebrew-mfc/Formula/mfc.rb"

          echo "Updating formula to v${VERSION}..."

          # Update URL (match any GitHub archive URL, not just MFlowCode/MFC,
          # in case the formula temporarily points at a fork during testing)
          sed -i "s|url \"https://github.com/[^\"]*/archive/[^\"]*\.tar\.gz\"|url \"https://github.com/MFlowCode/MFC/archive/refs/tags/v${VERSION}.tar.gz\"|" "$FORMULA"

          # Update SHA256 (the one right after url, not bottle SHAs)
          # This uses awk to only update the first sha256 after the url line
          awk -v newsha="$SHA256" '
            /^  url "https:\/\/github.com\// { found_url=1 }
            found_url && /^  sha256 "/ && !updated {
              sub(/sha256 "[^"]*"/, "sha256 \"" newsha "\"")
              updated=1
            }
            { print }
          ' "$FORMULA" > "$FORMULA.tmp" && mv "$FORMULA.tmp" "$FORMULA"

          # Remove existing bottle block (new bottles will be built by bottle.yml)
          # This removes everything between "bottle do" and the matching "end"
          awk '
            /^  bottle do/ { in_bottle=1; next }
            in_bottle && /^  end/ { in_bottle=0; next }
            !in_bottle { print }
          ' "$FORMULA" > "$FORMULA.tmp" && mv "$FORMULA.tmp" "$FORMULA"

          echo "Updated formula:"
          head -30 "$FORMULA"

      - name: Validate updated formula
        if: ${{ github.event_name != 'pull_request' }}
        run: |
          cd homebrew-mfc
          echo "Checking Ruby syntax..."
          ruby -c Formula/mfc.rb

          echo "Verifying URL and SHA256 were updated..."
          grep -q "v${{ steps.version.outputs.version }}.tar.gz" Formula/mfc.rb || (echo "::error::URL not updated"; exit 1)
          grep -q "${{ steps.sha256.outputs.sha256 }}" Formula/mfc.rb || (echo "::error::SHA256 not updated"; exit 1)

          echo "Formula validation passed!"

      - name: Commit and push to homebrew-mfc
        if: ${{ github.event_name != 'pull_request' && github.event.inputs.dry_run != 'true' }}
        run: |
          cd homebrew-mfc
          VERSION="${{ steps.version.outputs.version }}"

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git add Formula/mfc.rb

          if git diff --cached --quiet; then
            echo "::notice::Formula already up to date for v${VERSION} — nothing to push."
          else
            git commit -m "Update MFC to v${VERSION}"
            echo "Pushing to homebrew-mfc..."
            git push origin main
            echo "Successfully pushed formula update!"
            echo "The bottle.yml workflow in homebrew-mfc will now build bottles automatically."
          fi

      - name: Dry run summary
        if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true' }}
        run: |
          echo "::notice::DRY RUN - skipped push to homebrew-mfc"
          echo ""
          echo "Would have committed the following changes:"
          cd homebrew-mfc
          git diff Formula/mfc.rb

      - name: Summary
        if: ${{ github.event_name != 'pull_request' }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          echo "## Homebrew Formula Updated" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Version:** v${VERSION}" >> $GITHUB_STEP_SUMMARY
          echo "- **SHA256:** \`${{ steps.sha256.outputs.sha256 }}\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Tap:** [MFlowCode/homebrew-mfc](https://github.com/MFlowCode/homebrew-mfc)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "The [bottle.yml](https://github.com/MFlowCode/homebrew-mfc/actions/workflows/bottle.yml) workflow will now build bottles for this release." >> $GITHUB_STEP_SUMMARY