bump-homebrew.yml

name: Bump Homebrew Formula

# Trigger: called as a reusable workflow by release.yml after a release (tag push), via workflow_call.
#   — Not triggered by release:published: a Release created with the default GITHUB_TOKEN does not
#     fire other workflows (GitHub anti-recursion guard). Chaining within the same run bypasses this
#     limitation without needing a PAT.
# Backup: manual trigger, with an explicit version parameter (for recovery / dry-run).
on:
  workflow_call:
    inputs:
      version:
        description: 'Version to bump (e.g. 1.6.278)'
        required: true
        type: string
    # Minimal permissions: only accept HOMEBREW_TAP_TOKEN (the cross-repo write token needed by
    # the tap repo) explicitly; avoid secrets: inherit which would dump all caller secrets
    # (CSC_*/APPLE_* etc.) into this workflow. GITHUB_TOKEN is provided automatically by the platform.
    secrets:
      HOMEBREW_TAP_TOKEN:
        required: true
  workflow_dispatch:
    inputs:
      version:
        # required:true forces the UI to prompt for input before dispatching (this workflow has no
        # latest-tag fallback; an empty value would error out directly).
        description: 'Version to bump (e.g., 1.6.225)'
        required: true
        type: string

permissions:
  contents: read

jobs:
  bump:
    runs-on: ubuntu-latest
    steps:
      - name: Resolve version
        id: ver
        # SECURITY: ${{ inputs.version }} must be injected via env: and never directly interpolated
        # into the run: script — the latter would allow malicious input (collaborator-only trigger,
        # but still a standard anti-pattern) to be interpreted by the shell before semver validation.
        # Version source is unified as inputs.version (workflow_call and workflow_dispatch share the
        # inputs context).
        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          if [[ -z "$INPUT_VERSION" ]]; then
            echo "Cannot resolve version: inputs.version is empty" >&2
            exit 1
          fi
          VER="${INPUT_VERSION#v}"   # strip leading 'v' when caller passes github.ref_name=vX.Y.Z
          # Validate strict semver patch format (defense-in-depth: ensures VER is clean for all downstream steps)
          if ! [[ "$VER" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid version: $VER" >&2
            exit 1
          fi
          echo "version=$VER" >> "$GITHUB_OUTPUT"
          echo "Resolved version: $VER"

      - name: Wait for npm registry to publish
        env:
          VER: ${{ steps.ver.outputs.version }}
        run: |
          set -euo pipefail
          # CDN propagation takes up to ~5min; retry every 30s, 10 attempts = 5min
          for i in $(seq 1 10); do
            if curl -fsSL "https://registry.npmjs.org/cc-viewer/${VER}" >/dev/null 2>&1; then
              echo "✓ npm has cc-viewer@${VER}"
              exit 0
            fi
            echo "[$i/10] npm not yet showing cc-viewer@${VER}, sleeping 30s..."
            sleep 30
          done
          echo "✗ Timed out waiting for npm to publish cc-viewer@${VER}" >&2
          exit 1

      - name: Compute tarball sha256
        id: hash
        env:
          VER: ${{ steps.ver.outputs.version }}
        run: |
          set -euo pipefail
          URL="https://registry.npmjs.org/cc-viewer/-/cc-viewer-${VER}.tgz"
          curl -fsSL "$URL" -o /tmp/pkg.tgz
          SHA=$(sha256sum /tmp/pkg.tgz | cut -d' ' -f1)
          echo "sha256=$SHA" >> "$GITHUB_OUTPUT"
          echo "url=$URL" >> "$GITHUB_OUTPUT"
          echo "✓ sha256=$SHA"

      - name: Checkout tap repo
        uses: actions/checkout@v4
        with:
          repository: weiesky/homebrew-cc-viewer
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: tap

      - name: Update formula
        env:
          URL: ${{ steps.hash.outputs.url }}
          SHA: ${{ steps.hash.outputs.sha256 }}
        run: |
          set -euo pipefail
          FORMULA=tap/Formula/cc-viewer.rb
          if [[ ! -f "$FORMULA" ]]; then
            echo "$FORMULA not found in tap repo" >&2
            exit 1
          fi
          # Only replace url and sha256 lines; other content (depends_on / install / test blocks)
          # is managed by the maintainer. Python receives URL/SHA via sys.argv from env injection,
          # keeping Action expressions out of the shell command line.
          python3 - "$FORMULA" "$URL" "$SHA" <<'PY'
          import re, sys
          path, url, sha = sys.argv[1], sys.argv[2], sys.argv[3]
          with open(path, 'r', encoding='utf-8') as f:
              src = f.read()
          src = re.sub(r'url\s+"[^"]+"', f'url "{url}"', src, count=1)
          src = re.sub(r'sha256\s+"[^"]+"', f'sha256 "{sha}"', src, count=1)
          with open(path, 'w', encoding='utf-8') as f:
              f.write(src)
          PY
          echo "--- Updated formula ---"
          grep -E '(url|sha256) ' "$FORMULA"

      - name: Create PR
        id: cpr
        uses: peter-evans/create-pull-request@v6
        with:
          path: tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          commit-message: "cc-viewer ${{ steps.ver.outputs.version }}"
          title: "cc-viewer ${{ steps.ver.outputs.version }}"
          body: |
            Automated bump from [cc-viewer release `v${{ steps.ver.outputs.version }}`](https://github.com/weiesky/cc-viewer/releases/tag/v${{ steps.ver.outputs.version }}).

            - npm tarball: <${{ steps.hash.outputs.url }}>
            - sha256: `${{ steps.hash.outputs.sha256 }}`

            Generated by `.github/workflows/bump-homebrew.yml` in `weiesky/cc-viewer`.
          branch: bump-${{ steps.ver.outputs.version }}
          delete-branch: true

      - name: Auto-merge PR
        # Only run on created/updated actions (skip on none/closed to avoid operating on an
        # invalid PR number). Cross-repo token uses HOMEBREW_TAP_TOKEN (same source as Create PR);
        # the tap repo must have Allow merge commits enabled under Settings → General → Pull
        # Requests (it's the default).
        if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated'
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          PR_NUM: ${{ steps.cpr.outputs.pull-request-number }}
        run: |
          set -euo pipefail
          # Numeric validation for injection defense (peter-evans action output is trusted,
          # but consistent with this repo's hardening style)
          if ! [[ "$PR_NUM" =~ ^[0-9]+$ ]]; then
            echo "Invalid PR number: $PR_NUM" >&2
            exit 1
          fi
          gh pr merge "$PR_NUM" \
            --repo weiesky/homebrew-cc-viewer \
            --merge \
            --delete-branch
          echo "✓ Merged PR #$PR_NUM into tap main"