orca/.github/workflows/homebrew-bump.yml

name: Homebrew Cask Bump

# Update desktop stable/RC casks in stablyai/homebrew-orca with release DMG hashes through release-cut workflow_call or manual backfill. Avoid release.published because mobile/non-desktop releases lack those DMGs and must never rewrite casks.

on:
  workflow_call:
    inputs:
      tag:
        description: Release tag to sync (e.g. v1.3.25)
        required: true
        type: string
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag to sync (e.g. v1.3.25)
        required: true
        type: string

jobs:
  bump-cask:
    runs-on: ubuntu-latest
    # Why: only desktop tags have the macOS DMGs this workflow downloads.
    # A mobile tag such as `mobile-v0.0.1` must never rewrite either cask.
    if: >
      inputs.tag != '' &&
      startsWith(inputs.tag, 'v')
    permissions:
      contents: read
    steps:
      - name: Checkout orca
        uses: actions/checkout@v6

      - name: Resolve tag and version
        id: tag
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          INPUT_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          if [[ -n "$INPUT_TAG" ]]; then
            tag="$INPUT_TAG"
          else
            tag="$RELEASE_TAG"
          fi
          version="${tag#v}"
          echo "tag=$tag" >>"$GITHUB_OUTPUT"
          echo "version=$version" >>"$GITHUB_OUTPUT"

      - name: Resolve cask target
        id: cask
        env:
          TAG: ${{ steps.tag.outputs.tag }}
          VERSION: ${{ steps.tag.outputs.version }}
        run: |
          set -euo pipefail
          if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then
            token="orca@rc"
            branch_token="orca-rc"
          elif [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            token="orca"
            branch_token="orca"
          else
            echo "::error::Unsupported desktop tag shape: $TAG" >&2
            exit 1
          fi

          path="Casks/${token}.rb"
          if [[ ! -f "$path" ]]; then
            echo "::error::Missing cask template: $path" >&2
            exit 1
          fi

          echo "token=$token" >>"$GITHUB_OUTPUT"
          echo "path=$path" >>"$GITHUB_OUTPUT"
          echo "branch=bump/${branch_token}-${VERSION}" >>"$GITHUB_OUTPUT"
          echo "title=${token} ${VERSION}" >>"$GITHUB_OUTPUT"

      - name: Download DMGs and compute sha256
        id: hash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.tag.outputs.tag }}
        run: |
          set -euo pipefail
          mkdir -p dmgs
          gh release download "$TAG" \
            --repo "${{ github.repository }}" \
            --pattern 'orca-macos-arm64.dmg' \
            --pattern 'orca-macos-x64.dmg' \
            --dir dmgs
          arm=$(sha256sum dmgs/orca-macos-arm64.dmg | awk '{print $1}')
          intel=$(sha256sum dmgs/orca-macos-x64.dmg  | awk '{print $1}')
          echo "arm=$arm"     >>"$GITHUB_OUTPUT"
          echo "intel=$intel" >>"$GITHUB_OUTPUT"

      - name: Render updated cask file
        env:
          VERSION: ${{ steps.tag.outputs.version }}
          ARM_SHA: ${{ steps.hash.outputs.arm }}
          INTEL_SHA: ${{ steps.hash.outputs.intel }}
          CASK_PATH: ${{ steps.cask.outputs.path }}
        run: |
          set -euo pipefail
          python3 - <<'PY'
          import os, re, pathlib
          p = pathlib.Path(os.environ["CASK_PATH"])
          src = p.read_text()
          src = re.sub(r'version "[^"]+"',
                       f'version "{os.environ["VERSION"]}"', src, count=1)
          src = re.sub(r'sha256 arm:\s*"[0-9a-f]+",\s*\n\s*intel:\s*"[0-9a-f]+"',
                       'sha256 arm:   "{arm}",\n         intel: "{intel}"'.format(
                           arm=os.environ["ARM_SHA"],
                           intel=os.environ["INTEL_SHA"]),
                       src, count=1)
          p.write_text(src)
          print(src)
          PY

      # Use org-installed buf0-bot’s short-lived App token for cross-repo pushes; GITHUB_TOKEN is repo-scoped.
      - name: Generate buf0-bot token
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          app-id: 2590194
          private-key: ${{ secrets.BUFO_BOT_PRIVATE_KEY }}
          owner: stablyai
          repositories: homebrew-orca

      - name: Checkout tap
        uses: actions/checkout@v6
        with:
          repository: stablyai/homebrew-orca
          path: tap
          token: ${{ steps.app-token.outputs.token }}

      - name: Copy cask into tap and open PR
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          VERSION: ${{ steps.tag.outputs.version }}
          TAG: ${{ steps.tag.outputs.tag }}
          CASK_PATH: ${{ steps.cask.outputs.path }}
          BRANCH: ${{ steps.cask.outputs.branch }}
          TITLE: ${{ steps.cask.outputs.title }}
        run: |
          set -euo pipefail
          mkdir -p "tap/$(dirname "$CASK_PATH")"
          cp "$CASK_PATH" "tap/$CASK_PATH"

          cd tap
          # Match the buf0-bot App’s commit author for tap history/PR attribution.
          git config user.name  "buf0-bot[bot]"
          git config user.email "252831055+buf0-bot[bot]@users.noreply.github.com"

          if git diff --quiet; then
            echo "Cask already up-to-date for $TAG; nothing to do."
            exit 0
          fi

          branch="$BRANCH"
          git checkout -b "$branch"
          git add "$CASK_PATH"
          git commit -m "$TITLE"
          git push -u origin "$branch" --force

          # Backfills can race an existing branch; update its PR title when creation finds one.
          gh pr create \
            --title "$TITLE" \
            --body "Automated bump of $CASK_PATH from stablyai/orca release $TAG." \
            --base main \
            --head "$branch" \
            || gh pr edit "$branch" --title "$TITLE"

          # Squash immediately: this tap has no gates, so gh pr merge --auto silently no-ops.
          gh pr merge "$branch" --squash --delete-branch