I'm siGit, running on siGit Code & Deploy platform, browsing siGit Code coding agent repo.
main
| 1 | name: Release winget |
| 2 | |
| 3 | # Dispatched by release-github.yml once the release and its checksums exist. |
| 4 | # |
| 5 | # winget manifests live in microsoft/winget-pkgs, and `wingetcreate update` |
| 6 | # only works on a package that is already there. So this workflow branches: |
| 7 | # |
| 8 | # - package already in winget-pkgs -> `wingetcreate update`, which rewrites |
| 9 | # the URLs and re-hashes the installers for us. |
| 10 | # - package not there yet -> render the manifests in packaging/winget/ and |
| 11 | # `wingetcreate submit` them as a new package. |
| 12 | # |
| 13 | # The second path only runs once, but keeping it here means a first release |
| 14 | # does not need someone to sit at a Windows box running `wingetcreate new` |
| 15 | # interactively. |
| 16 | on: |
| 17 | workflow_dispatch: |
| 18 | inputs: |
| 19 | tag: |
| 20 | description: "Release tag (e.g. v1.5.2)" |
| 21 | required: true |
| 22 | |
| 23 | concurrency: |
| 24 | # A re-pushed or re-dispatched tag fires this a second time. Queue the |
| 25 | # duplicate behind the original instead of cancelling it: cancelling a run |
| 26 | # mid-publish can leave a channel half-uploaded, whereas a queued duplicate |
| 27 | # just hits the "already published" check and exits clean. |
| 28 | group: ${{ github.workflow }}-${{ github.event.inputs.tag || github.ref_name }} |
| 29 | cancel-in-progress: false |
| 30 | |
| 31 | permissions: |
| 32 | contents: read |
| 33 | |
| 34 | env: |
| 35 | REPO: getsigit/sigit |
| 36 | PACKAGE_IDENTIFIER: getSigit.siGitCode |
| 37 | |
| 38 | jobs: |
| 39 | submit-winget-manifest: |
| 40 | name: Submit winget manifest |
| 41 | # wingetcreate is a Windows-only tool. |
| 42 | runs-on: windows-latest |
| 43 | |
| 44 | steps: |
| 45 | - name: Check out repository |
| 46 | uses: actions/checkout@v6 |
| 47 | |
| 48 | - name: Resolve tag, version and release date |
| 49 | id: release |
| 50 | shell: bash |
| 51 | env: |
| 52 | GH_TOKEN: ${{ github.token }} |
| 53 | run: | |
| 54 | TAG="${{ github.event.inputs.tag }}" |
| 55 | VERSION="${TAG#v}" |
| 56 | # wingetcreate wants ReleaseDate as YYYY-MM-DD. |
| 57 | DATE=$(gh release view "$TAG" --repo "$REPO" --json publishedAt --jq '.publishedAt[0:10]') |
| 58 | |
| 59 | echo "tag=${TAG}" >> "$GITHUB_OUTPUT" |
| 60 | echo "version=${VERSION}" >> "$GITHUB_OUTPUT" |
| 61 | echo "date=${DATE}" >> "$GITHUB_OUTPUT" |
| 62 | |
| 63 | - name: Check whether the package is already in winget-pkgs |
| 64 | id: exists |
| 65 | shell: bash |
| 66 | env: |
| 67 | GH_TOKEN: ${{ github.token }} |
| 68 | run: | |
| 69 | # manifests are filed under the lowercased first letter of the |
| 70 | # publisher, e.g. manifests/g/getSigit/siGitCode. |
| 71 | PUBLISHER="${PACKAGE_IDENTIFIER%%.*}" |
| 72 | NAME="${PACKAGE_IDENTIFIER#*.}" |
| 73 | FIRST=$(echo "${PUBLISHER:0:1}" | tr '[:upper:]' '[:lower:]') |
| 74 | PATH_IN_REPO="manifests/${FIRST}/${PUBLISHER}/${NAME}" |
| 75 | |
| 76 | # Branch on the status code, not on whether the request worked. |
| 77 | # This used to treat any failure as "not there", so a GitHub outage |
| 78 | # during the v1.7.7 run sent an existing package down the |
| 79 | # new-package path and filed a bogus Package Request |
| 80 | # (microsoft/winget-pkgs#465415). Only a 404 means "not there"; |
| 81 | # anything else fails the job before an issue or PR is opened, so a |
| 82 | # rerun is safe. |
| 83 | STATUS=$(curl -sS -o /dev/null -w '%{http_code}' \ |
| 84 | --retry 5 --retry-delay 10 --retry-all-errors \ |
| 85 | -H "Authorization: Bearer ${GH_TOKEN}" \ |
| 86 | -H "Accept: application/vnd.github+json" \ |
| 87 | "https://api.github.com/repos/microsoft/winget-pkgs/contents/${PATH_IN_REPO}") || true |
| 88 | |
| 89 | case "$STATUS" in |
| 90 | 200) |
| 91 | echo "Found ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting an update." |
| 92 | echo "found=true" >> "$GITHUB_OUTPUT" |
| 93 | ;; |
| 94 | 404) |
| 95 | echo "No ${PACKAGE_IDENTIFIER} at ${PATH_IN_REPO}; submitting it as a new package." |
| 96 | echo "found=false" >> "$GITHUB_OUTPUT" |
| 97 | ;; |
| 98 | *) |
| 99 | echo "Unexpected ${STATUS:-no response} from GitHub checking ${PATH_IN_REPO}; refusing to guess" >&2 |
| 100 | exit 1 |
| 101 | ;; |
| 102 | esac |
| 103 | |
| 104 | - name: Render manifests for a first submission |
| 105 | if: steps.exists.outputs.found == 'false' |
| 106 | shell: bash |
| 107 | env: |
| 108 | GH_TOKEN: ${{ github.token }} |
| 109 | run: | |
| 110 | TAG="${{ steps.release.outputs.tag }}" |
| 111 | VERSION="${{ steps.release.outputs.version }}" |
| 112 | |
| 113 | mkdir -p artifacts manifests |
| 114 | |
| 115 | gh release download "$TAG" \ |
| 116 | --repo "$REPO" \ |
| 117 | --pattern "sigit-win-*.exe.sha256" \ |
| 118 | --dir artifacts/ |
| 119 | |
| 120 | # The schema wants 64 hex characters; the community validation |
| 121 | # pipeline writes them uppercase, so match that. |
| 122 | SHA_AMD64=$(tr -d '[:space:]' < artifacts/sigit-win-amd64.exe.sha256 | tr '[:lower:]' '[:upper:]') |
| 123 | SHA_ARM64=$(tr -d '[:space:]' < artifacts/sigit-win-arm64.exe.sha256 | tr '[:lower:]' '[:upper:]') |
| 124 | |
| 125 | RELEASE_DATE="${{ steps.release.outputs.date }}" |
| 126 | |
| 127 | for template in packaging/winget/*.yaml.in; do |
| 128 | out="manifests/$(basename "$template" .in)" |
| 129 | sed \ |
| 130 | -e "s|@VERSION@|${VERSION}|g" \ |
| 131 | -e "s|@TAG@|${TAG}|g" \ |
| 132 | -e "s|@REPO@|${REPO}|g" \ |
| 133 | -e "s|@SHA_AMD64@|${SHA_AMD64}|g" \ |
| 134 | -e "s|@SHA_ARM64@|${SHA_ARM64}|g" \ |
| 135 | -e "s|@RELEASE_DATE@|${RELEASE_DATE}|g" \ |
| 136 | "$template" > "$out" |
| 137 | |
| 138 | echo "--- ${out} ---" |
| 139 | cat "$out" |
| 140 | done |
| 141 | |
| 142 | - name: Download wingetcreate |
| 143 | shell: pwsh |
| 144 | run: Invoke-WebRequest -Uri "https://aka.ms/wingetcreate/latest" -OutFile wingetcreate.exe |
| 145 | |
| 146 | # winget-pkgs convention: file the "please add/update this package" |
| 147 | # Package Request issue *first*, then open the manifest PR that fulfils |
| 148 | # it with "Resolves #N". Doing it the other way round (PR first, issue |
| 149 | # after) reads as "here's a request, and here's the PR that already did |
| 150 | # it", posted seconds apart. |
| 151 | # |
| 152 | # The issue and the PR are authored by two separate PATs, configured as |
| 153 | # the repo secrets WINGET_ISSUE_TOKEN (the Package Request issue) and |
| 154 | # WINGET_PR_TOKEN (the manifest PR). Both need public_repo scope on |
| 155 | # microsoft/winget-pkgs (fork + open issues/PRs). WINGET_PR_TOKEN also |
| 156 | # needs read:org and read:discussion: the "Set the winget PR body" step |
| 157 | # below calls `gh pr edit`, whose GraphQL query resolves org/team and |
| 158 | # discussion fields and fails with a scope error without them. |
| 159 | # WINGET_PR_TOKEN replaces the old single WINGET_TOKEN. |
| 160 | - name: File the winget Package Request issue |
| 161 | id: issue |
| 162 | shell: bash |
| 163 | env: |
| 164 | # Authored by the issue account for this repo. |
| 165 | GH_TOKEN: ${{ secrets.WINGET_ISSUE_TOKEN }} |
| 166 | run: | |
| 167 | set -euo pipefail |
| 168 | |
| 169 | if [ -z "${GH_TOKEN:-}" ]; then |
| 170 | echo "WINGET_ISSUE_TOKEN is not set. It needs a PAT (public_repo) for the account that should author the Package Request issue." >&2 |
| 171 | exit 1 |
| 172 | fi |
| 173 | |
| 174 | VERSION="${{ steps.release.outputs.version }}" |
| 175 | TAG="${{ steps.release.outputs.tag }}" |
| 176 | |
| 177 | # The release assets, same URLs the update step feeds wingetcreate. |
| 178 | BASE="https://github.com/${REPO}/releases/download/${TAG}" |
| 179 | INSTALLER_AMD64="${BASE}/sigit-win-amd64.exe" |
| 180 | INSTALLER_ARM64="${BASE}/sigit-win-arm64.exe" |
| 181 | |
| 182 | # winget-pkgs' Package Request is an issue *form* |
| 183 | # (.github/ISSUE_TEMPLATE/package_request.yml): the title must be |
| 184 | # "[Package Request]: ..." and the body has to carry the labelled |
| 185 | # fields below (Installer Url especially — without it a maintainer |
| 186 | # just replies "please provide the installer link"). A free-text |
| 187 | # body lands as Needs-Triage and can't be acted on. |
| 188 | ISSUE_BODY=$(cat <<EOF |
| 189 | Download Page Url: https://github.com/${REPO}/releases/tag/${TAG} |
| 190 | Publisher: getSigit |
| 191 | Package Name: siGit Code |
| 192 | Description: siGit Code, an AI coding agent that runs on your machine. |
| 193 | Package Version: ${VERSION} |
| 194 | Installer Url: ${INSTALLER_AMD64} |
| 195 | Installer Url: ${INSTALLER_ARM64} |
| 196 | EOF |
| 197 | ) |
| 198 | |
| 199 | ISSUE_URL=$(gh issue create \ |
| 200 | --repo microsoft/winget-pkgs \ |
| 201 | --title "[Package Request]: ${PACKAGE_IDENTIFIER} ${VERSION}" \ |
| 202 | --body "$ISSUE_BODY") |
| 203 | |
| 204 | echo "Opened issue ${ISSUE_URL}" |
| 205 | echo "issue_url=${ISSUE_URL}" >> "$GITHUB_OUTPUT" |
| 206 | echo "issue_number=${ISSUE_URL##*/}" >> "$GITHUB_OUTPUT" |
| 207 | |
| 208 | - name: Sebat dulu ... |
| 209 | if: steps.issue.outputs.issue_number != '' |
| 210 | shell: bash |
| 211 | run: sleep $(( RANDOM % 61 + 150 )) |
| 212 | |
| 213 | - name: Submit new package |
| 214 | id: submit_new |
| 215 | if: steps.exists.outputs.found == 'false' |
| 216 | shell: pwsh |
| 217 | env: |
| 218 | # wingetcreate reads the token from this variable. Passing it as |
| 219 | # --token instead makes the tool warn that the token can end up in |
| 220 | # logs, which on a shared runner is not a warning worth ignoring. |
| 221 | # This is the PR-author account for this repo (see mapping above). |
| 222 | WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_PR_TOKEN }} |
| 223 | run: | |
| 224 | if (-not $env:WINGET_CREATE_GITHUB_TOKEN) { |
| 225 | Write-Error "WINGET_PR_TOKEN is not set. It needs a PAT with public_repo, read:org, and read:discussion scopes so wingetcreate can fork microsoft/winget-pkgs and open the manifest PR, and gh can edit the PR body." |
| 226 | } |
| 227 | |
| 228 | $version = "${{ steps.release.outputs.version }}" |
| 229 | |
| 230 | # Tee stdout so we can scrape the PR URL afterwards. wingetcreate |
| 231 | # prints "Pull request can be found here: <url>" on success, and |
| 232 | # that line is the only handle we get on the PR it just opened. |
| 233 | # --no-open because the runner has no browser to open the PR in. |
| 234 | .\wingetcreate.exe submit manifests ` |
| 235 | --prtitle "New package: $env:PACKAGE_IDENTIFIER version $version" ` |
| 236 | --no-open 2>&1 | Tee-Object -Variable output |
| 237 | |
| 238 | if ($LASTEXITCODE -ne 0) { |
| 239 | Write-Error "wingetcreate submit failed with exit code $LASTEXITCODE" |
| 240 | } |
| 241 | |
| 242 | $match = [regex]::Match(($output -join "`n"), 'https://github\.com/microsoft/winget-pkgs/pull/(\d+)') |
| 243 | if ($match.Success) { |
| 244 | "pr_url=$($match.Value)" | Out-File -FilePath $env:GITHUB_OUTPUT -Append |
| 245 | "pr_number=$($match.Groups[1].Value)" | Out-File -FilePath $env:GITHUB_OUTPUT -Append |
| 246 | } else { |
| 247 | Write-Warning "Could not find the PR URL in wingetcreate output; skipping issue linking." |
| 248 | } |
| 249 | |
| 250 | - name: Submit manifest update |
| 251 | id: submit_update |
| 252 | if: steps.exists.outputs.found == 'true' |
| 253 | shell: pwsh |
| 254 | env: |
| 255 | # PR-author account for this repo (see mapping above). |
| 256 | WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_PR_TOKEN }} |
| 257 | run: | |
| 258 | if (-not $env:WINGET_CREATE_GITHUB_TOKEN) { |
| 259 | Write-Error "WINGET_PR_TOKEN is not set. It needs a PAT with public_repo, read:org, and read:discussion scopes so wingetcreate can fork microsoft/winget-pkgs and open the manifest PR, and gh can edit the PR body." |
| 260 | } |
| 261 | |
| 262 | $tag = "${{ steps.release.outputs.tag }}" |
| 263 | $version = "${{ steps.release.outputs.version }}" |
| 264 | $base = "https://github.com/${env:REPO}/releases/download/$tag" |
| 265 | |
| 266 | # The trailing |x64 and |arm64 tell wingetcreate which installer |
| 267 | # entry each URL replaces. Without them it guesses from the file |
| 268 | # name, and "sigit-win-amd64.exe" is not a spelling it recognises. |
| 269 | .\wingetcreate.exe update $env:PACKAGE_IDENTIFIER ` |
| 270 | --version $version ` |
| 271 | --urls "$base/sigit-win-amd64.exe|x64" "$base/sigit-win-arm64.exe|arm64" ` |
| 272 | --release-notes-url "https://github.com/${env:REPO}/releases/tag/$tag" ` |
| 273 | --release-date "${{ steps.release.outputs.date }}" ` |
| 274 | --prtitle "Update $env:PACKAGE_IDENTIFIER to version $version" ` |
| 275 | --submit ` |
| 276 | --no-open 2>&1 | Tee-Object -Variable output |
| 277 | |
| 278 | if ($LASTEXITCODE -ne 0) { |
| 279 | Write-Error "wingetcreate failed with exit code $LASTEXITCODE" |
| 280 | } |
| 281 | |
| 282 | $match = [regex]::Match(($output -join "`n"), 'https://github\.com/microsoft/winget-pkgs/pull/(\d+)') |
| 283 | if ($match.Success) { |
| 284 | "pr_url=$($match.Value)" | Out-File -FilePath $env:GITHUB_OUTPUT -Append |
| 285 | "pr_number=$($match.Groups[1].Value)" | Out-File -FilePath $env:GITHUB_OUTPUT -Append |
| 286 | } else { |
| 287 | Write-Warning "Could not find the PR URL in wingetcreate output; skipping issue linking." |
| 288 | } |
| 289 | |
| 290 | # wingetcreate has no --prbody flag (only --prtitle), so it always opens |
| 291 | # the PR with the winget-pkgs template: an empty Description and an |
| 292 | # unticked "Linked to an issue" box next to a "Resolves #[Issue Number]" |
| 293 | # placeholder. The issue already exists (filed first, above), so this |
| 294 | # step just rewrites the body to point the PR at it with "Resolves #N". |
| 295 | # |
| 296 | # This must run as the PR author (WINGET_PR_TOKEN) — the account that |
| 297 | # opened the PR via wingetcreate — since only the author (or a repo |
| 298 | # maintainer) can edit it. |
| 299 | - name: Set the winget PR body and link the issue |
| 300 | id: link |
| 301 | if: >- |
| 302 | (steps.submit_new.outputs.pr_number != '') || |
| 303 | (steps.submit_update.outputs.pr_number != '') |
| 304 | shell: bash |
| 305 | env: |
| 306 | GH_TOKEN: ${{ secrets.WINGET_PR_TOKEN }} |
| 307 | run: | |
| 308 | set -euo pipefail |
| 309 | |
| 310 | PR_URL="${{ steps.submit_new.outputs.pr_url || steps.submit_update.outputs.pr_url }}" |
| 311 | ISSUE_NUMBER="${{ steps.issue.outputs.issue_number }}" |
| 312 | VERSION="${{ steps.release.outputs.version }}" |
| 313 | RELEASE_URL="https://github.com/${REPO}/releases/tag/${{ steps.release.outputs.tag }}" |
| 314 | |
| 315 | if [ -n "$ISSUE_NUMBER" ]; then |
| 316 | CHECKBOX="- [x] Linked to an issue (if applicable)" |
| 317 | RESOLVES="- Resolves #${ISSUE_NUMBER}" |
| 318 | else |
| 319 | CHECKBOX="- [ ] Linked to an issue (if applicable)" |
| 320 | RESOLVES="" |
| 321 | fi |
| 322 | |
| 323 | if [ "${{ steps.exists.outputs.found }}" = "false" ]; then |
| 324 | DESC="Adds ${PACKAGE_IDENTIFIER} version ${VERSION}. Release notes: ${RELEASE_URL}" |
| 325 | else |
| 326 | DESC="Updates ${PACKAGE_IDENTIFIER} to version ${VERSION}. Release notes: ${RELEASE_URL}" |
| 327 | fi |
| 328 | |
| 329 | # Mirrors the current .github/PULL_REQUEST_TEMPLATE.md; keep the |
| 330 | # checklist items in sync with it (e.g. the 1.12 schema line). |
| 331 | BODY=$(cat <<EOF |
| 332 | ## 📖 Description |
| 333 | ${DESC} |
| 334 | ## ✅ Checklist |
| 335 | - [x] Signed the [Contributor License Agreement](https://cla.opensource.microsoft.com) |
| 336 | ${CHECKBOX} |
| 337 | ${RESOLVES} |
| 338 | ## 📦 Manifest Checklist |
| 339 | - [x] Checked that there aren't other open [pull requests](https://github.com/microsoft/winget-pkgs/pulls) for the same manifest update/change |
| 340 | - [x] This PR only modifies one (1) manifest |
| 341 | - [x] Validated manifest locally with \`winget validate --manifest <directory>\` |
| 342 | - [x] Tested manifest locally with \`winget install --manifest <directory>\` |
| 343 | - [x] Manifest conforms to the [1.12 schema](https://github.com/microsoft/winget-pkgs/tree/master/doc/manifest/schema/1.12.0) |
| 344 | EOF |
| 345 | ) |
| 346 | |
| 347 | gh pr edit "$PR_URL" --body "$BODY" |
| 348 | echo "Linked ${PR_URL} to issue #${ISSUE_NUMBER:-<none>}" |