release.yml

name: Release

on:
  release:
    types: [ published ]

defaults:
  run:
    shell: pwsh

jobs:
  build-test:
    runs-on: windows-latest

    env:
      Project_Path: src\EarthBackground.csproj
      Test_Project_Path: EarthBackground.Tests\EarthBackground.Tests.csproj

    steps:
    - name: Checkout
      uses: actions/checkout@v7
      with:
        fetch-depth: 0

    - name: Setup .NET
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: '10.0.x'

    - name: Restore dependencies
      run: |
        dotnet restore $env:Project_Path
        dotnet restore $env:Test_Project_Path

    - name: Build
      run: dotnet build $env:Test_Project_Path --configuration Release --no-restore

    - name: Test
      run: dotnet test $env:Test_Project_Path --configuration Release --no-build --verbosity normal

  publish:
    needs: build-test
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write


    strategy:
      matrix:
        include:
          - runtime: win-x64
            os: windows-latest
            framework: net10.0-windows
          - runtime: linux-x64
            os: ubuntu-latest
            framework: net10.0
          - runtime: osx-x64
            os: macos-latest
            framework: net10.0
            package_kind: app
          - runtime: osx-arm64
            os: macos-latest
            framework: net10.0
            package_kind: app

    env:
      Project_Path: src/EarthBackground.csproj
      Publish_Dir: publish/${{ matrix.runtime }}
      Release_Tag: ${{ github.ref_name }}
      # Must stay outside Publish_Dir: build-macos-app.sh copies publish into the .app
      App_Bundle_Dir: publish-app/${{ matrix.runtime }}/EarthBackground.app
      Mac_Dmg_Path: publish-app/${{ matrix.runtime }}/EarthBackground-${{ github.ref_name }}-${{ matrix.runtime }}.dmg
      Mac_Notarize_Zip_Path: publish-app/${{ matrix.runtime }}/EarthBackground-${{ github.ref_name }}-${{ matrix.runtime }}-notarize.zip

    steps:
    - name: Checkout
      uses: actions/checkout@v7
      with:
        fetch-depth: 0

    - name: Setup .NET
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: '10.0.x'

    - name: Install Native AOT prerequisites
      if: runner.os == 'Linux'
      run: |
        sudo apt-get update
        sudo apt-get install -y clang zlib1g-dev zip

    - name: Restore Native AOT dependencies
      run: |
        dotnet restore $env:Project_Path `
          -r ${{ matrix.runtime }} `
          -p:TargetFramework=${{ matrix.framework }} `
          -p:PublishAot=true `
          -p:PublishReadyToRun=false

    - name: Publish Avalonia Native AOT app
      run: |
        dotnet publish $env:Project_Path `
          --framework ${{ matrix.framework }} `
          --configuration Release `
          --runtime ${{ matrix.runtime }} `
          --output $env:Publish_Dir `
          --self-contained true `
          --no-restore `
          -p:PublishAot=true `
          -p:PublishReadyToRun=false `
          -p:UseAppHost=true `
          -p:PublishSingleFile=false

    - name: Verify Native AOT output
      run: |
        $executableName = if ("${{ runner.os }}" -eq "Windows") { "EarthBackground.exe" } else { "EarthBackground" }
        $executablePath = Join-Path $env:Publish_Dir $executableName
        if (-not (Test-Path -LiteralPath $executablePath -PathType Leaf)) {
          throw "Native AOT executable was not produced: $executablePath"
        }

        $managedRuntimeFiles = @(
          "coreclr.dll", "hostfxr.dll", "hostpolicy.dll",
          "libcoreclr.so", "libhostfxr.so", "libhostpolicy.so",
          "libcoreclr.dylib", "libhostfxr.dylib", "libhostpolicy.dylib"
        )
        $unexpectedFiles = Get-ChildItem -LiteralPath $env:Publish_Dir -Recurse -File |
          Where-Object { $managedRuntimeFiles -contains $_.Name } |
          Select-Object -ExpandProperty FullName
        if ($unexpectedFiles) {
          throw "Managed .NET runtime files found in Native AOT output: $($unexpectedFiles -join ', ')"
        }

    - name: Build macOS app bundle
      if: runner.os == 'macOS'
      run: |
        $versionMatch = [regex]::Match($env:Release_Tag, '^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$')
        if (-not $versionMatch.Success) {
          throw "Release tag must contain a three-part numeric version: $($env:Release_Tag)"
        }
        $bundleVersion = '{0}.{1}.{2}' -f $versionMatch.Groups[1].Value, $versionMatch.Groups[2].Value, $versionMatch.Groups[3].Value
        chmod +x ./packaging/macos/build-macos-app.sh
        ./packaging/macos/build-macos-app.sh "$env:Publish_Dir" "$env:App_Bundle_Dir" "$bundleVersion" "src/Assets/earth.ico"
        & plutil -lint "$env:App_Bundle_Dir/Contents/Info.plist"
        if ($LASTEXITCODE -ne 0) { throw "plutil validation failed with exit code $LASTEXITCODE" }

    - name: Create macOS disk image
      if: runner.os == 'macOS'
      run: |
        hdiutil create -volname EarthBackground -srcfolder "$env:App_Bundle_Dir" -ov -format UDZO "$env:Mac_Dmg_Path"

    - name: Create Release Archive
      run: |
        Get-ChildItem -Path $env:Publish_Dir -Recurse -Include *.pdb,*.dbg,*.dwarf | Remove-Item -Force -ErrorAction SilentlyContinue
        Get-ChildItem -Path $env:Publish_Dir -Directory -Filter images | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
        Get-ChildItem -Path $env:Publish_Dir -Directory -Filter logs | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
        $archiveName = "EarthBackground-${{ github.ref_name }}-${{ matrix.runtime }}.zip"
        $archivePath = Join-Path $PWD $archiveName
        if (Test-Path -LiteralPath $archivePath) { Remove-Item -LiteralPath $archivePath -Force }
        if ("${{ runner.os }}" -eq "macOS") {
          if (-not (Test-Path -LiteralPath $env:App_Bundle_Dir)) {
            throw "macOS app bundle not found: $($env:App_Bundle_Dir)"
          }
          & ditto -c -k --sequesterRsrc --keepParent $env:App_Bundle_Dir $archivePath
        }
        elseif ("${{ runner.os }}" -eq "Linux") {
          Push-Location $env:Publish_Dir
          try {
            & zip -q -r $archivePath .
            if ($LASTEXITCODE -ne 0) { throw "zip failed with exit code $LASTEXITCODE" }
          }
          finally {
            Pop-Location
          }
        }
        else {
          Compress-Archive -Path "$env:Publish_Dir/*" -DestinationPath $archivePath
        }
        if (-not (Test-Path -LiteralPath $archivePath -PathType Leaf)) {
          throw "Failed to create release archive: $archivePath"
        }

    - name: Upload Build Artifacts
      uses: actions/upload-artifact@v7
      with:
        name: EarthBackground-${{ matrix.runtime }}-${{ github.sha }}
        path: ${{ runner.os == 'macOS' && env.App_Bundle_Dir || format('{0}/', env.Publish_Dir) }}

    - name: Upload Release Archive
      uses: actions/upload-artifact@v7
      with:
        name: EarthBackground-${{ matrix.runtime }}-archive
        path: EarthBackground-*.zip

    - name: Upload macOS disk image
      if: runner.os == 'macOS'
      uses: actions/upload-artifact@v7
      with:
        name: EarthBackground-${{ matrix.runtime }}-dmg
        path: ${{ env.Mac_Dmg_Path }}

    - name: Attach zip to Release
      uses: softprops/action-gh-release@v3
      with:
        files: EarthBackground-*.zip
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Attach macOS disk image to Release
      if: runner.os == 'macOS'
      uses: softprops/action-gh-release@v3
      with:
        files: ${{ env.Mac_Dmg_Path }}
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  package:
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: write

    env:
      PACKAGE_ID: LGinC.EarthBackground
      PACKAGE_NAME: EarthBackground
      PUBLISHER: LGinC
      LINUX_RUNTIME: linux-x64
      WINDOWS_RUNTIME: win-x64
      MACOS_ARM64_RUNTIME: osx-arm64
      MACOS_X64_RUNTIME: osx-x64
      RELEASE_TAG: ${{ github.event.release.tag_name }}
      RELEASE_REPOSITORY: ${{ github.repository }}
      RELEASE_SHA: ${{ github.sha }}
      PAGES_BRANCH: gh-pages
      # secrets cannot be referenced in if:; map them to env first
      PACKAGE_FEED_GPG_PRIVATE_KEY: ${{ secrets.PACKAGE_FEED_GPG_PRIVATE_KEY }}
      PACKAGE_FEED_GPG_PASSPHRASE: ${{ secrets.PACKAGE_FEED_GPG_PASSPHRASE }}
      PACKAGE_FEED_GPG_KEY_ID: ${{ secrets.PACKAGE_FEED_GPG_KEY_ID }}

    outputs:
      version: ${{ steps.meta.outputs.version }}
      feed_signed: ${{ steps.feed_signed.outputs.feed_signed }}

    steps:
    - name: Checkout
      uses: actions/checkout@v7
      with:
        fetch-depth: 0
    - name: Install Linux repository tools
      run: |
        sudo apt-get update
        sudo apt-get install -y apt-utils createrepo-c gnupg

    - name: Download publish artifacts
      uses: actions/download-artifact@v8
      with:
        path: publish-inputs

    - name: Normalize publish layout
      run: |
        New-Item -ItemType Directory -Force -Path publish | Out-Null
        Copy-Item -Path "publish-inputs/EarthBackground-${env:LINUX_RUNTIME}-${env:RELEASE_SHA}/*" -Destination "publish/${env:LINUX_RUNTIME}" -Recurse -Force
        $linuxExecutable = "publish/${env:LINUX_RUNTIME}/EarthBackground"
        if (-not (Test-Path -LiteralPath $linuxExecutable -PathType Leaf)) {
          throw "Linux executable not found after artifact download: $linuxExecutable"
        }
        & chmod +x $linuxExecutable
        if ($LASTEXITCODE -ne 0) { throw "chmod failed with exit code $LASTEXITCODE" }
        Copy-Item -Path "publish-inputs/EarthBackground-${env:WINDOWS_RUNTIME}-${env:RELEASE_SHA}/*" -Destination "publish/${env:WINDOWS_RUNTIME}" -Recurse -Force


    - name: Compute release metadata
      id: meta
      run: |
        $version = "${env:RELEASE_TAG}"
        if ($version.StartsWith('v')) { $version = $version.Substring(1) }
        "VERSION=$version" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
        "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
        "WIN_ZIP_URL=https://github.com/${env:RELEASE_REPOSITORY}/releases/download/${env:RELEASE_TAG}/EarthBackground-${env:RELEASE_TAG}-${env:WINDOWS_RUNTIME}.zip" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
        "RELEASE_NOTES_URL=https://github.com/${env:RELEASE_REPOSITORY}/releases/tag/${env:RELEASE_TAG}" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

    - name: Install nfpm
      shell: bash
      run: |
        # Official GoReleaser APT repo: https://nfpm.goreleaser.com/docs/install/
        set -euo pipefail
        echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
        sudo apt-get update
        sudo apt-get install -y nfpm
        nfpm --version

    - name: Build deb and rpm packages
      run: |
        nfpm package --packager deb --config packaging/nfpm.yaml --target "EarthBackground-${env:VERSION}-linux-x64.deb"
        nfpm package --packager rpm --config packaging/nfpm.yaml --target "EarthBackground-${env:VERSION}-linux-x64.rpm"

    - name: Compute Windows checksum
      run: |
        $winHash = (Get-FileHash "publish-inputs/EarthBackground-${env:WINDOWS_RUNTIME}-archive/EarthBackground-${env:RELEASE_TAG}-${env:WINDOWS_RUNTIME}.zip" -Algorithm SHA256).Hash.ToLowerInvariant()
        "WIN_SHA256=$winHash" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

    - name: Generate winget manifest
      run: |
        $manifestDir = "dist/winget/${env:PACKAGE_ID}/${env:VERSION}"
        New-Item -ItemType Directory -Force -Path $manifestDir | Out-Null
        @"
        PackageIdentifier: ${env:PACKAGE_ID}
        PackageVersion: ${env:VERSION}
        DefaultLocale: en-US
        ManifestType: version
        ManifestVersion: 1.6.0
        "@ | Set-Content -Path "$manifestDir/${env:PACKAGE_ID}.yaml"
        @"
        PackageIdentifier: ${env:PACKAGE_ID}
        PackageVersion: ${env:VERSION}
        PackageLocale: en-US
        Publisher: ${env:PUBLISHER}
        PackageName: ${env:PACKAGE_NAME}
        License: MIT
        PackageUrl: https://github.com/${env:RELEASE_REPOSITORY}
        PublisherUrl: https://github.com/${{ github.repository_owner }}
        PublisherSupportUrl: https://github.com/${env:RELEASE_REPOSITORY}/issues
        Moniker: earthbackground
        Tags:
          - wallpaper
          - earth
          - satellite
          - avalonia
        ReleaseNotesUrl: ${env:RELEASE_NOTES_URL}
        ShortDescription: Satellite earth wallpaper application built with .NET and Avalonia.
        ManifestType: defaultLocale
        ManifestVersion: 1.6.0
        "@ | Set-Content -Path "$manifestDir/${env:PACKAGE_ID}.locale.en-US.yaml"
        @"
        PackageIdentifier: ${env:PACKAGE_ID}
        PackageVersion: ${env:VERSION}
        Installers:
          - Architecture: x64
            InstallerType: zip
            NestedInstallerType: portable
            NestedInstallerFiles:
              - RelativeFilePath: EarthBackground.exe
                PortableCommandAlias: earthbackground
            InstallerUrl: ${env:WIN_ZIP_URL}
            InstallerSha256: ${env:WIN_SHA256}
        ManifestType: installer
        ManifestVersion: 1.6.0
        "@ | Set-Content -Path "$manifestDir/${env:PACKAGE_ID}.installer.yaml"

    - name: Prepare Homebrew payloads
      run: |
        # Prefer the ditto-built release archives so .app metadata and executable modes survive.
        foreach ($runtime in @($env:MACOS_ARM64_RUNTIME, $env:MACOS_X64_RUNTIME)) {
          $archiveZip = "publish-inputs/EarthBackground-${runtime}-archive/EarthBackground-${env:RELEASE_TAG}-${runtime}.zip"
          if (-not (Test-Path -LiteralPath $archiveZip -PathType Leaf)) {
            throw "macOS release archive not found: $archiveZip"
          }

          $brewZip = "EarthBackground-${env:VERSION}-${runtime}-brew.zip"
          Copy-Item -LiteralPath $archiveZip -Destination $brewZip -Force

          $probe = Join-Path $PWD "dist/homebrew-probe/$runtime"
          if (Test-Path -LiteralPath $probe) { Remove-Item -LiteralPath $probe -Recurse -Force }
          New-Item -ItemType Directory -Force -Path $probe | Out-Null
          Expand-Archive -LiteralPath $brewZip -DestinationPath $probe -Force
          $app = Get-ChildItem -LiteralPath $probe -Filter 'EarthBackground.app' -Directory -Recurse -ErrorAction SilentlyContinue |
            Select-Object -First 1
          if (-not $app) {
            throw "EarthBackground.app missing from Homebrew payload for $runtime."
          }
          Write-Host "Homebrew payload OK for ${runtime}: $($app.FullName)"
        }

    - name: Compute Homebrew checksums
      run: |
        $armZip = "EarthBackground-${env:VERSION}-${env:MACOS_ARM64_RUNTIME}-brew.zip"
        $x64Zip = "EarthBackground-${env:VERSION}-${env:MACOS_X64_RUNTIME}-brew.zip"
        $armHash = (Get-FileHash $armZip -Algorithm SHA256).Hash.ToLowerInvariant()
        $x64Hash = (Get-FileHash $x64Zip -Algorithm SHA256).Hash.ToLowerInvariant()
        "BREW_ARM64_SHA256=$armHash" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
        "BREW_X64_SHA256=$x64Hash" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
        "BREW_ARM64_ZIP_URL=https://github.com/${env:RELEASE_REPOSITORY}/releases/download/${env:RELEASE_TAG}/$armZip" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
        "BREW_X64_ZIP_URL=https://github.com/${env:RELEASE_REPOSITORY}/releases/download/${env:RELEASE_TAG}/$x64Zip" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

    - name: Generate official Homebrew cask candidate
      run: |
        $officialDir = "dist/homebrew-official/Casks/e"
        New-Item -ItemType Directory -Force -Path $officialDir | Out-Null
        @"
        cask "earthbackground" do
          arch arm: "arm64", intel: "x64"

          version "${env:VERSION}"
          sha256 arm: "${env:BREW_ARM64_SHA256}",
                 intel: "${env:BREW_X64_SHA256}"

          url "https://github.com/${env:RELEASE_REPOSITORY}/releases/download/${env:RELEASE_TAG}/EarthBackground-#{version}-osx-#{arch}-brew.zip"
          name "EarthBackground"
          desc "Satellite earth wallpaper application built with .NET and Avalonia"
          homepage "https://github.com/${env:RELEASE_REPOSITORY}"

          livecheck do
            url :url
            strategy :github_latest
          end

          depends_on macos: ">= :big_sur"

          app "EarthBackground.app"

          zap trash: [
            "~/Library/Preferences/io.github.lginc.earthbackground.plist",
            "~/Library/Saved Application State/io.github.lginc.earthbackground.savedState",
          ]
        end
        "@ | Set-Content -Path "dist/homebrew-official/Casks/e/earthbackground.rb"

    - name: Generate official Homebrew submission notes
      run: |
        @"
        Homebrew official cask candidate
        =================================

        Target repository:
        - Homebrew/homebrew-cask

        Candidate file:
        - Casks/e/earthbackground.rb

        Release assets:
        - Apple Silicon: ${env:BREW_ARM64_ZIP_URL}
        - Intel: ${env:BREW_X64_ZIP_URL}

        SHA256:
        - Apple Silicon: ${env:BREW_ARM64_SHA256}
        - Intel: ${env:BREW_X64_SHA256}

        Verified against docs.brew.sh references used in this task:
        - Adding Software to Homebrew
        - Cask Cookbook

        Current candidate supports separate Apple Silicon and Intel app archives and includes livecheck, depends_on, and a minimal zap stanza.

        The zap paths are inferred from the app bundle identifier because the repository does not currently persist macOS user-library paths explicitly in code. Re-verify them on a real macOS install before submitting an official PR.
        "@ | Set-Content -Path "dist/homebrew-official/README.txt"

    - name: Generate official Homebrew PR checklist
      run: |
        @"
        Homebrew official cask PR checklist
        ==================================

        Candidate files
        - dist/homebrew-official/Casks/e/earthbackground.rb
        - dist/homebrew-official/README.txt

        Manual checks before opening PR
        - Verify both release asset URLs download a zip containing EarthBackground.app.
        - Verify both SHA256 values match their published brew zips.
        - Install locally with brew from the candidate cask on Apple Silicon and Intel Macs and confirm the app launches.
        - Run brew audit --cask --online on the candidate cask in a local Homebrew checkout.
        - Re-check the inferred zap paths on a real macOS install:
          - ~/Library/Preferences/io.github.lginc.earthbackground.plist
          - ~/Library/Saved Application State/io.github.lginc.earthbackground.savedState
        - If the app creates extra files under ~/Library/Application Support, ~/Library/Caches, or other user Library paths, add them to zap before submitting.
        - Check open PRs/issues in Homebrew/homebrew-cask to avoid duplicate submission.
        - Be ready to adjust stanza ordering or metadata to satisfy Homebrew maintainer review.

        Suggested PR scope
        - Add Casks/e/earthbackground.rb only.
        - Do not mix unrelated cleanup with the submission.
        "@ | Set-Content -Path "dist/homebrew-official/PR-CHECKLIST.txt"

    - name: Generate official Homebrew PR template
      run: |
        $template = @'
        ## Summary

        Add `earthbackground` cask.

        ## What this PR adds

        - New cask: `earthbackground`
        - Apple Silicon asset: __BREW_ARM64_ZIP_URL__
        - Apple Silicon SHA256: __BREW_ARM64_SHA256__
        - Intel asset: __BREW_X64_ZIP_URL__
        - Intel SHA256: __BREW_X64_SHA256__

        ## Local verification

        - [ ] `brew install --cask ./Casks/e/earthbackground.rb`
        - [ ] App launches successfully
        - [ ] `brew audit --cask --online earthbackground`

        ## Notes

        - App bundles are distributed as architecture-specific zips containing `EarthBackground.app`.
        - `depends_on macos: ">= :big_sur"` is derived from the app bundle minimum system version.
        - `zap` paths are a minimal set inferred from `io.github.lginc.earthbackground` and should be rechecked on a real macOS install.
        '@
        $template = $template.Replace('__BREW_ARM64_ZIP_URL__', $env:BREW_ARM64_ZIP_URL).Replace('__BREW_ARM64_SHA256__', $env:BREW_ARM64_SHA256).Replace('__BREW_X64_ZIP_URL__', $env:BREW_X64_ZIP_URL).Replace('__BREW_X64_SHA256__', $env:BREW_X64_SHA256)
        $template | Set-Content -Path "dist/homebrew-official/PR-TEMPLATE.md"

    - name: Generate apt repository metadata with apt-ftparchive
      run: |
        New-Item -ItemType Directory -Force -Path @('dist/packages/apt','dist/packages/yum') | Out-Null
        Copy-Item -Path "EarthBackground-${env:VERSION}-linux-x64.deb" -Destination "dist/packages/apt/" -Force
        Copy-Item -Path "EarthBackground-${env:VERSION}-linux-x64.rpm" -Destination "dist/packages/yum/" -Force
        bash -lc 'cd dist/packages/apt && apt-ftparchive packages . > Packages && gzip -kf Packages && apt-ftparchive release . > Release'

    - name: Generate yum repository metadata with createrepo_c
      run: |
        bash -lc 'createrepo_c dist/packages/yum'

    - name: Import feed signing key
      if: env.PACKAGE_FEED_GPG_PRIVATE_KEY != '' && env.PACKAGE_FEED_GPG_PASSPHRASE != ''
      shell: bash
      env:
        PACKAGE_FEED_GPG_PRIVATE_KEY: ${{ secrets.PACKAGE_FEED_GPG_PRIVATE_KEY }}
      run: |
        set -euo pipefail
        key_path="$RUNNER_TEMP/package-feed-private.asc"
        trap 'rm -f "$key_path"' EXIT
        printf '%s' "$PACKAGE_FEED_GPG_PRIVATE_KEY" > "$key_path"
        gpg --batch --import "$key_path"

    - name: Export feed signing public key
      if: env.PACKAGE_FEED_GPG_PRIVATE_KEY != '' && env.PACKAGE_FEED_GPG_PASSPHRASE != ''
      shell: bash
      env:
        PACKAGE_FEED_GPG_KEY_ID: ${{ secrets.PACKAGE_FEED_GPG_KEY_ID }}
      run: |
        set -euo pipefail
        mkdir -p dist/packages
        key_spec=()
        if [[ -n "$PACKAGE_FEED_GPG_KEY_ID" ]]; then
          key_spec=("$PACKAGE_FEED_GPG_KEY_ID")
        fi
        gpg --armor --export "${key_spec[@]}" > dist/packages/public.key
        test -s dist/packages/public.key

    - name: Sign apt and yum repository metadata
      id: feed_signing
      if: env.PACKAGE_FEED_GPG_PRIVATE_KEY != '' && env.PACKAGE_FEED_GPG_PASSPHRASE != ''
      shell: bash
      env:
        PACKAGE_FEED_GPG_PASSPHRASE: ${{ secrets.PACKAGE_FEED_GPG_PASSPHRASE }}
        PACKAGE_FEED_GPG_KEY_ID: ${{ secrets.PACKAGE_FEED_GPG_KEY_ID }}
      run: |
        set -euo pipefail
        key_args=()
        if [[ -n "$PACKAGE_FEED_GPG_KEY_ID" ]]; then
          key_args=(--local-user "$PACKAGE_FEED_GPG_KEY_ID")
        fi
        printf '%s' "$PACKAGE_FEED_GPG_PASSPHRASE" | gpg --batch --yes --pinentry-mode loopback --passphrase-fd 0 "${key_args[@]}" --clearsign -o dist/packages/apt/InRelease dist/packages/apt/Release
        printf '%s' "$PACKAGE_FEED_GPG_PASSPHRASE" | gpg --batch --yes --pinentry-mode loopback --passphrase-fd 0 "${key_args[@]}" --detach-sign --armor -o dist/packages/apt/Release.gpg dist/packages/apt/Release
        printf '%s' "$PACKAGE_FEED_GPG_PASSPHRASE" | gpg --batch --yes --pinentry-mode loopback --passphrase-fd 0 "${key_args[@]}" --detach-sign --armor -o dist/packages/yum/repodata/repomd.xml.asc dist/packages/yum/repodata/repomd.xml

    - name: Record feed signing status
      id: feed_signed
      if: always()
      run: |
        $signed = if ('${{ steps.feed_signing.outcome }}' -eq 'success') { 'true' } else { 'false' }
        "feed_signed=$signed" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8

    - name: Upload package artifacts
      uses: actions/upload-artifact@v7
      with:
        name: EarthBackground-packages-${{ github.sha }}
        path: |
          EarthBackground-*.deb
          EarthBackground-*.rpm
          EarthBackground-*-brew.zip
          dist/winget/**
          dist/homebrew-official/**
          dist/packages/**

    - name: Attach package artifacts to release
      uses: softprops/action-gh-release@v3
      with:
        files: |
          EarthBackground-*.deb
          EarthBackground-*.rpm
          EarthBackground-*-brew.zip
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-package-feeds:
    needs: package
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
    - name: Checkout gh-pages branch
      uses: actions/checkout@v7
      with:
        ref: gh-pages
        path: gh-pages
        fetch-depth: 0
      continue-on-error: true

    - name: Initialize gh-pages branch contents
      run: |
        if (-not (Test-Path gh-pages/.git)) {
          New-Item -ItemType Directory -Force -Path gh-pages | Out-Null
          Set-Location gh-pages
          git init
          git checkout -b gh-pages
          git remote add origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
          Set-Location ..
        }
        New-Item -ItemType Directory -Force -Path @('gh-pages/packages/apt','gh-pages/packages/yum') | Out-Null

    - name: Download packaged repository metadata
      uses: actions/download-artifact@v8
      with:
        name: EarthBackground-packages-${{ github.sha }}
        path: package-artifacts

    - name: Publish apt and yum feeds
      run: |
        Remove-Item -Recurse -Force gh-pages/packages/apt/* -ErrorAction SilentlyContinue
        Remove-Item -Recurse -Force gh-pages/packages/yum/* -ErrorAction SilentlyContinue
        Remove-Item -Force gh-pages/packages/public.key -ErrorAction SilentlyContinue
        Copy-Item -Path package-artifacts/dist/packages/apt/* -Destination gh-pages/packages/apt -Recurse -Force
        Copy-Item -Path package-artifacts/dist/packages/yum/* -Destination gh-pages/packages/yum -Recurse -Force
        $publicKey = 'package-artifacts/dist/packages/public.key'
        if (Test-Path -LiteralPath $publicKey -PathType Leaf) {
          Copy-Item -LiteralPath $publicKey -Destination gh-pages/packages/public.key -Force
        }
        Set-Location gh-pages
        git config user.name github-actions
        git config user.email github-actions@github.com
        git add packages
        if (git diff --cached --quiet) {
          Write-Host 'No package feed changes.'
          exit 0
        }
        git commit -m "Publish package feeds for ${{ needs.package.outputs.version }}"
        git push -u origin HEAD:gh-pages

  publish-homebrew-official-pr:
    needs: package
    if: vars.HOMEBREW_CASK_FORK_REPOSITORY != ''
    runs-on: ubuntu-latest
    env:
      HOMEBREW_CASK_PAT: ${{ secrets.HOMEBREW_CASK_PAT }}

    steps:
    - name: Require Homebrew PAT
      if: env.HOMEBREW_CASK_PAT == ''
      run: |
        Write-Host 'HOMEBREW_CASK_PAT is not configured; skipping official Homebrew PR job steps.'
        "official_pr_status=skipped_no_pat" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

    - name: Checkout fork of homebrew-cask
      if: env.HOMEBREW_CASK_PAT != ''
      uses: actions/checkout@v7
      with:
        repository: ${{ vars.HOMEBREW_CASK_FORK_REPOSITORY }}
        token: ${{ env.HOMEBREW_CASK_PAT }}
        path: homebrew-cask-fork
        fetch-depth: 1
        sparse-checkout: Casks/e

    - name: Download official cask candidate artifacts
      if: env.HOMEBREW_CASK_PAT != ''
      uses: actions/download-artifact@v8
      with:
        name: EarthBackground-packages-${{ github.sha }}
        path: package-artifacts

    - name: Create or update Homebrew cask PR branch
      if: env.HOMEBREW_CASK_PAT != ''
      env:
        GH_TOKEN: ${{ env.HOMEBREW_CASK_PAT }}
        FORK_REPOSITORY: ${{ vars.HOMEBREW_CASK_FORK_REPOSITORY }}
      run: |
        $forkParts = $env:FORK_REPOSITORY.Split('/')
        if ($forkParts.Length -ne 2 -or [string]::IsNullOrWhiteSpace($forkParts[0])) {
          throw 'Unable to derive fork owner from HOMEBREW_CASK_FORK_REPOSITORY.'
        }
        $forkOwner = $forkParts[0]
        $branchName = "earthbackground-${{ needs.package.outputs.version }}"
        $caskSource = "package-artifacts/dist/homebrew-official/Casks/e/earthbackground.rb"
        $bodySource = "package-artifacts/dist/homebrew-official/PR-TEMPLATE.md"
        if (-not (Test-Path -LiteralPath $caskSource -PathType Leaf)) { throw 'Official cask candidate file missing.' }
        if (-not (Test-Path -LiteralPath $bodySource -PathType Leaf)) { throw 'Official PR template file missing.' }
        $caskPath = (Resolve-Path -LiteralPath $caskSource).Path
        $bodyPath = (Resolve-Path -LiteralPath $bodySource).Path

        Set-Location homebrew-cask-fork
        $remoteUrl = git remote get-url origin
        if ($remoteUrl -notmatch [Regex]::Escape($env:FORK_REPOSITORY)) {
          throw "Checked out fork does not match HOMEBREW_CASK_FORK_REPOSITORY: $remoteUrl"
        }
        gh auth status
        $defaultBranch = gh repo view Homebrew/homebrew-cask --json defaultBranchRef --jq '.defaultBranchRef.name'
        if ([string]::IsNullOrWhiteSpace($defaultBranch)) { throw 'Unable to resolve Homebrew/homebrew-cask default branch.' }
        $defaultBranch = $defaultBranch.Trim()
        $syncType = gh api --method POST "repos/$env:FORK_REPOSITORY/merge-upstream" -f "branch=$defaultBranch" --jq '.merge_type'
        if ($LASTEXITCODE -ne 0) { throw "Unable to sync $env:FORK_REPOSITORY with Homebrew/homebrew-cask." }
        Write-Host "Homebrew fork sync result: $syncType"
        git fetch origin $defaultBranch --depth=1
        if ($LASTEXITCODE -ne 0) { throw "Unable to fetch origin/$defaultBranch after syncing the fork." }
        git checkout -B $branchName "origin/$defaultBranch"
        if ($LASTEXITCODE -ne 0) { throw "Unable to create branch $branchName." }

        New-Item -ItemType Directory -Force -Path Casks/e | Out-Null
        Copy-Item -LiteralPath $caskPath -Destination "Casks/e/earthbackground.rb" -Force
        git config user.name github-actions
        git config user.email github-actions@github.com
        git add Casks/e/earthbackground.rb
        git diff --cached --quiet
        if ($LASTEXITCODE -eq 0) {
          "official_pr_status=no_changes" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
          Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value "No official Homebrew cask changes for $branchName."
          exit 0
        }
        if ($LASTEXITCODE -ne 1) { throw 'Unable to inspect staged Homebrew changes.' }

        git commit -m "Add earthbackground cask ${{ needs.package.outputs.version }}"
        if ($LASTEXITCODE -ne 0) { throw 'Unable to commit Homebrew cask changes.' }
        git push --force --set-upstream origin HEAD
        if ($LASTEXITCODE -ne 0) { throw 'Unable to push Homebrew cask branch.' }

        $headRef = "${forkOwner}:$branchName"
        $existingPrUrl = gh pr list --repo Homebrew/homebrew-cask --head $headRef --json url --jq '.[0].url // empty'
        if (-not [string]::IsNullOrWhiteSpace($existingPrUrl)) {
          "official_pr_status=existing" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
          "official_pr_url=$existingPrUrl" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
          "official_pr_fork_owner=$forkOwner" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
          Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value "Existing official Homebrew PR: $existingPrUrl"
          exit 0
        }
        $prUrl = gh pr create --repo Homebrew/homebrew-cask --base $defaultBranch --head $headRef --title 'Add earthbackground cask' --body-file $bodyPath
        if ([string]::IsNullOrWhiteSpace($prUrl)) { throw 'gh pr create did not return a PR URL.' }
        "official_pr_status=created" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
        "official_pr_url=$prUrl" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
        "official_pr_fork_owner=$forkOwner" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
        Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value "Created official Homebrew PR: $prUrl"

    - name: Write official PR result summary
      if: always()
      run: |
        New-Item -ItemType Directory -Force -Path official-pr-result | Out-Null
        $status = if ($env:official_pr_status) { $env:official_pr_status } else { 'unknown' }
        $url = if ($env:official_pr_url) { $env:official_pr_url } else { '' }
        $forkOwner = if ($env:official_pr_fork_owner) { $env:official_pr_fork_owner } else {
          $forkParts = "${{ vars.HOMEBREW_CASK_FORK_REPOSITORY }}".Split('/')
          if ($forkParts.Length -ge 1) { $forkParts[0] } else { '' }
        }
        @"
        {
          "status": "$status",
          "url": "$url",
          "forkRepository": "${{ vars.HOMEBREW_CASK_FORK_REPOSITORY }}",
          "forkOwner": "$forkOwner",
          "version": "${{ needs.package.outputs.version }}"
        }
        "@ | Set-Content -Path official-pr-result/homebrew-official-pr-result.json

    - name: Upload official PR result artifact
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: homebrew-official-pr-result-${{ github.sha }}
        path: official-pr-result/homebrew-official-pr-result.json
  publish-winget:
    needs: package
    runs-on: ubuntu-latest
    env:
      WINGET_PAT: ${{ secrets.WINGET_PAT }}
      WINGET_PACKAGE_ID: LGinC.EarthBackground
      WINGET_FORK_REPOSITORY: ${{ format('{0}/winget-pkgs', github.repository_owner) }}

    steps:
    - name: Skip winget when PAT missing
      if: env.WINGET_PAT == ''
      run: Write-Host 'WINGET_PAT is not configured; skipping winget submission.'

    - name: Checkout fork of winget-pkgs
      if: env.WINGET_PAT != ''
      uses: actions/checkout@v7
      with:
        repository: ${{ env.WINGET_FORK_REPOSITORY }}
        token: ${{ env.WINGET_PAT }}
        path: winget-pkgs-fork
        fetch-depth: 1
        sparse-checkout: manifests/l/LGinC/EarthBackground

    - name: Download generated manifest
      if: env.WINGET_PAT != ''
      uses: actions/download-artifact@v8
      with:
        name: EarthBackground-packages-${{ github.sha }}
        path: package-artifacts

    - name: Create or update WinGet manifest PR
      if: env.WINGET_PAT != ''
      env:
        GH_TOKEN: ${{ env.WINGET_PAT }}
      run: |
        $forkParts = $env:WINGET_FORK_REPOSITORY.Split('/')
        if ($forkParts.Length -ne 2 -or [string]::IsNullOrWhiteSpace($forkParts[0])) {
          throw 'Unable to derive fork owner from WINGET_FORK_REPOSITORY.'
        }
        $forkOwner = $forkParts[0]
        $version = '${{ needs.package.outputs.version }}'
        $branchName = "earthbackground-$version"
        $manifestSource = "package-artifacts/dist/winget/$($env:WINGET_PACKAGE_ID)/$version"
        if (-not (Test-Path -LiteralPath $manifestSource -PathType Container)) {
          throw "Generated WinGet manifest directory missing: $manifestSource"
        }
        $manifestSource = (Resolve-Path -LiteralPath $manifestSource).Path

        Set-Location winget-pkgs-fork
        $remoteUrl = git remote get-url origin
        if ($remoteUrl -notmatch [Regex]::Escape($env:WINGET_FORK_REPOSITORY)) {
          throw "Checked out fork does not match WINGET_FORK_REPOSITORY: $remoteUrl"
        }
        gh auth status
        $defaultBranch = gh repo view microsoft/winget-pkgs --json defaultBranchRef --jq '.defaultBranchRef.name'
        if ([string]::IsNullOrWhiteSpace($defaultBranch)) {
          throw 'Unable to resolve microsoft/winget-pkgs default branch.'
        }
        if ((git remote) -contains 'upstream') {
          git remote set-url upstream https://github.com/microsoft/winget-pkgs.git
        }
        else {
          git remote add upstream https://github.com/microsoft/winget-pkgs.git
        }
        git fetch upstream $defaultBranch --depth=1
        if ($LASTEXITCODE -ne 0) { throw "Unable to fetch upstream/$defaultBranch." }
        git checkout -B $branchName "upstream/$defaultBranch"
        if ($LASTEXITCODE -ne 0) { throw "Unable to create branch $branchName." }

        $packageParts = $env:WINGET_PACKAGE_ID.Split('.')
        $manifestRoot = "manifests/$($packageParts[0].Substring(0, 1).ToLowerInvariant())/$($packageParts -join '/')"
        $targetDir = "$manifestRoot/$version"
        if (Test-Path -LiteralPath $targetDir) {
          Remove-Item -LiteralPath $targetDir -Recurse -Force
        }
        New-Item -ItemType Directory -Force -Path $targetDir | Out-Null
        Copy-Item -Path "$manifestSource/*" -Destination $targetDir -Recurse -Force

        git config user.name github-actions
        git config user.email github-actions@github.com
        git add $targetDir
        git diff --cached --quiet
        if ($LASTEXITCODE -eq 0) {
          Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value "No WinGet manifest changes for $branchName."
          exit 0
        }
        if ($LASTEXITCODE -ne 1) { throw 'Unable to inspect staged WinGet changes.' }

        git commit -m "Add $($env:WINGET_PACKAGE_ID) $version"
        if ($LASTEXITCODE -ne 0) { throw 'Unable to commit WinGet manifest changes.' }
        git push --force --set-upstream origin HEAD
        if ($LASTEXITCODE -ne 0) { throw 'Unable to push WinGet manifest branch.' }

        $headRef = "${forkOwner}:$branchName"
        $existingPrUrl = gh pr list --repo microsoft/winget-pkgs --head $headRef --json url --jq '.[0].url // empty'
        if (-not [string]::IsNullOrWhiteSpace($existingPrUrl)) {
          Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value "Existing WinGet PR: $existingPrUrl"
          exit 0
        }
        $prUrl = gh pr create --repo microsoft/winget-pkgs --base $defaultBranch --head $headRef --title "Add $($env:WINGET_PACKAGE_ID) $version" --body "Automated submission for $($env:WINGET_PACKAGE_ID) $version."
        if ([string]::IsNullOrWhiteSpace($prUrl)) { throw 'gh pr create did not return a WinGet PR URL.' }
        Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value "Created WinGet PR: $prUrl"