orca/.github/workflows/dev-channel-win-publish.yml

name: Dev Channel Windows Publish

on:
  workflow_call:
    inputs:
      channel:
        description: Dev channel whose live release receives the staged artifacts
        required: true
        type: string
      tag:
        description: Release tag used when staging the Windows artifacts
        required: true
        type: string

permissions:
  contents: read
  actions: read

concurrency:
  group: dev-channel-win-publish-${{ inputs.tag }}
  cancel-in-progress: false

jobs:
  publish-win:
    if: github.repository == 'stablyai/orca'
    environment: adhoc-mac-build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      CHANNEL: ${{ inputs.channel }}
      TAG: ${{ inputs.tag }}
    steps:
      - name: Vet the requested inputs
        shell: bash
        run: |
          set -euo pipefail
          case "$CHANNEL" in
            hourly|daily|adhoc) ;;
            *) echo "::error::Unknown dev channel '$CHANNEL'."; exit 1 ;;
          esac
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-${CHANNEL}\.[0-9]+$ ]]; then
            echo "::error::Tag '$TAG' is not a $CHANNEL release tag."
            exit 1
          fi

      # No run-id: artifacts must belong to this run, never another dispatch.
      - name: Download the staged Windows artifacts
        uses: actions/download-artifact@v8
        with:
          name: dev-channel-windows-${{ inputs.tag }}
          path: staged-windows

      - name: Validate staged Windows artifacts
        shell: bash
        run: |
          set -euo pipefail
          for required in orca-windows-setup.exe orca-windows-setup.exe.blockmap latest.yml; do
            if [[ ! -s "staged-windows/$required" ]]; then
              echo "::error::Missing or empty staged Windows artifact: $required"
              exit 1
            fi
          done

      - name: Mint dev channel repo token
        id: app_token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.HOURLY_RELEASE_APP_ID }}
          private-key: ${{ secrets.HOURLY_RELEASE_APP_PRIVATE_KEY }}
          owner: stablyai
          repositories: orca-${{ inputs.channel }}

      - name: Confirm the target release is live
        shell: bash
        env:
          GH_TOKEN: ${{ steps.app_token.outputs.token }}
        run: |
          set -euo pipefail
          draft="$(gh release view "$TAG" --repo "stablyai/orca-$CHANNEL" --json isDraft --jq '.isDraft')"
          if [[ "$draft" != false ]]; then
            echo "::error::Release $TAG is not live; refusing to publish Windows artifacts."
            exit 1
          fi

      - name: Publish Windows artifacts
        uses: nick-fields/retry@v4
        with:
          timeout_minutes: 5
          max_attempts: 2
          retry_wait_seconds: 10
          command: gh release upload "$TAG" staged-windows/orca-windows-setup.exe staged-windows/orca-windows-setup.exe.blockmap staged-windows/latest.yml --clobber --repo "stablyai/orca-$CHANNEL"
        env:
          GH_TOKEN: ${{ steps.app_token.outputs.token }}

      - name: Verify Windows update manifest published
        shell: bash
        env:
          GH_TOKEN: ${{ steps.app_token.outputs.token }}
        run: |
          set -euo pipefail
          assets="$(gh release view "$TAG" --repo "stablyai/orca-$CHANNEL" --json assets --jq '.assets[].name')"
          for required in latest.yml orca-windows-setup.exe orca-windows-setup.exe.blockmap; do
            if ! grep -qx "$required" <<<"$assets"; then
              echo "::error::$TAG is missing $required; Windows could not install this build."
              exit 1
            fi
          done