chocolatey-publish.yml

name: Publish to Chocolatey

on:
  # Manual escape hatch only. The common-path Chocolatey publish is now handled by
  # the reusable release.yml@v1's own manifest-driven channel job; the old
  # `release: published` auto-trigger is removed to avoid double-publishing.
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to publish (e.g., 1.0.25)'
        required: false
        type: string

jobs:
  publish:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Resolve version
        shell: pwsh
        env:
          EVENT_NAME: ${{ github.event_name }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          if ($env:EVENT_NAME -eq "release") {
            $tag = $env:RELEASE_TAG
            if ($tag -notmatch '^v\d') {
              Write-Host "Skipping: release tag '$tag' does not match v<digit>... pattern"
              echo "SKIP=true" >> $env:GITHUB_ENV
              exit 0
            }
            $version = $tag -replace '^v',''
          } else {
            $version = $env:INPUT_VERSION
          }
          if (-not $version) {
            Write-Error "version not provided"
            exit 1
          }
          Write-Host "Resolved version: $version"
          echo "VERSION=$version" >> $env:GITHUB_ENV

      - name: Validate release exists
        if: env.SKIP != 'true'
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $release = gh release view "v$env:VERSION" --json tagName 2>&1
          if ($LASTEXITCODE -ne 0) {
            Write-Error "Release v$env:VERSION not found"
            exit 1
          }
          Write-Host "Found release v$env:VERSION"

      - name: Get checksums from release
        if: env.SKIP != 'true'
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release download "v$env:VERSION" --pattern "checksums.txt" --dir .

          $checksums = Get-Content checksums.txt
          $x64Hash = ($checksums | Select-String "windows_amd64.zip").Line.Split()[0]
          $arm64Hash = ($checksums | Select-String "windows_arm64.zip").Line.Split()[0]

          Write-Host "x64 SHA256: $x64Hash"
          Write-Host "arm64 SHA256: $arm64Hash"

          echo "X64_HASH=$x64Hash" >> $env:GITHUB_ENV
          echo "ARM64_HASH=$arm64Hash" >> $env:GITHUB_ENV

      - name: Update version and checksums
        if: env.SKIP != 'true'
        shell: pwsh
        run: |
          $version = $env:VERSION

          # Update version in nuspec
          $nuspec = 'packaging/chocolatey/google-readonly.nuspec'
          (Get-Content $nuspec) -replace '<version>0.0.0</version>', "<version>$version</version>" | Set-Content $nuspec
          Write-Host "Updated nuspec to version $version"

          # Inject checksums into install script
          $script = 'packaging/chocolatey/tools/chocolateyInstall.ps1'
          $content = Get-Content $script -Raw
          $content = $content -replace 'CHECKSUM_AMD64_PLACEHOLDER', $env:X64_HASH
          $content = $content -replace 'CHECKSUM_ARM64_PLACEHOLDER', $env:ARM64_HASH
          Set-Content $script $content
          Write-Host "Injected checksums into install script"

      - name: Pack Chocolatey package
        if: env.SKIP != 'true'
        shell: pwsh
        run: |
          cd packaging/chocolatey
          choco pack
          Get-ChildItem *.nupkg

      - name: Push to Chocolatey
        if: env.SKIP != 'true'
        shell: pwsh
        run: |
          cd packaging/chocolatey
          choco push (Get-ChildItem *.nupkg).Name --source https://push.chocolatey.org/ --key ${{ secrets.CHOCOLATEY_API_KEY }}