release.yml

name: Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag_name:
        description: Existing Git tag or GitHub Release tag to publish
        required: true
        type: string
      publish_snap:
        description: Publish the stable snap to the Snap Store during manual recovery
        required: false
        default: false
        type: boolean

concurrency:
  group: ${{ github.workflow }}-${{ github.event.release.tag_name || inputs.tag_name }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -D warnings
  SURGE_VERSION: v1.0.0-beta.6
  SURGE_STORAGE_REPOSITORY: peters/horizon-updates

permissions:
  contents: write

jobs:
  validate-release:
    name: Validate Release
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ steps.validate.outputs.release_tag }}
      release_version: ${{ steps.validate.outputs.release_version }}
      release_prerelease: ${{ steps.validate.outputs.release_prerelease }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.release.tag_name || inputs.tag_name }}
          fetch-depth: 0
          lfs: true
      - name: Restore workflow scripts for manual recovery
        if: ${{ github.event_name == 'workflow_dispatch' }}
        shell: bash
        run: |
          git fetch --no-tags --depth=1 origin "${{ github.sha }}"
          git checkout "${{ github.sha }}" -- scripts

      - name: Verify workspace versions are aligned
        run: ./scripts/check-version-sync.sh

      - id: validate
        name: Validate tag and release metadata
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          source ./scripts/version-lib.sh

          tag_name="${{ github.event.release.tag_name || inputs.tag_name }}"

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            release_json="$(gh release view "$tag_name" --repo "${{ github.repository }}" --json isDraft,isPrerelease)"
            release_draft="$(jq -r '.isDraft' <<<"$release_json")"
            release_prerelease="$(jq -r '.isPrerelease' <<<"$release_json")"

            if [ "$release_draft" = "true" ]; then
              echo "::error::GitHub Release ${tag_name} is still a draft."
              exit 1
            fi
          else
            release_prerelease="${{ github.event.release.prerelease }}"
          fi

          if [[ "$tag_name" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
            release_version="${BASH_REMATCH[1]}"
            tag_prerelease="false"
          elif [[ "$tag_name" =~ ^v([0-9]+\.[0-9]+\.[0-9]+-(alpha|beta)\.[0-9]+)$ ]]; then
            release_version="${BASH_REMATCH[1]}"
            tag_prerelease="true"
          else
            echo "::error::Unsupported release tag: ${tag_name}"
            exit 1
          fi

          if [[ "$release_prerelease" != "$tag_prerelease" ]]; then
            echo "::error::GitHub Release prerelease flag does not match tag ${tag_name}."
            exit 1
          fi

          repo_base_version="$(workspace_base_version)"
          tag_base_version="${release_version%%-*}"

          if [[ "$repo_base_version" != "$tag_base_version" ]]; then
            echo "::error::Cargo.toml base version ${repo_base_version} does not match release line ${tag_base_version}."
            exit 1
          fi

          echo "Validated release: tag=${tag_name} version=${release_version} prerelease=${tag_prerelease}"

          echo "release_tag=${tag_name}" >> "$GITHUB_OUTPUT"
          echo "release_version=${release_version}" >> "$GITHUB_OUTPUT"
          echo "release_prerelease=${tag_prerelease}" >> "$GITHUB_OUTPUT"
          echo "## Release validation" >> "$GITHUB_STEP_SUMMARY"
          echo "Tag: \`${tag_name}\`" >> "$GITHUB_STEP_SUMMARY"
          echo "Version: \`${release_version}\`" >> "$GITHUB_STEP_SUMMARY"

  build-artifacts:
    name: Artifacts (${{ matrix.name }})
    needs: validate-release
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            name: Linux x64
            cache_key: linux-release-artifacts
            rid: linux-x64
            release_asset: horizon-linux-x64.tar.gz
            surge_cli: surge
            binary_path: target/release/horizon
            asset_kind: tar
            surge_app_id: horizon-linux-x64
            surge_main_exe: horizon
            surge_installer_asset: horizon-installer-linux-x64.bin
            surge_installer_ext: bin
          - os: macos-latest
            name: macOS arm64
            cache_key: macos-release-artifacts
            rid: osx-arm64
            release_asset: horizon-osx-arm64.tar.gz
            surge_cli: surge
            binary_path: target/release/horizon
            asset_kind: tar
            surge_app_id: horizon-osx-arm64
            surge_main_exe: horizon
            surge_installer_asset: horizon-installer-osx-arm64.bin
            surge_installer_ext: bin
          - os: macos-15-intel
            name: macOS x64
            cache_key: macos-intel-release-artifacts
            rid: osx-x64
            release_asset: horizon-osx-x64.tar.gz
            surge_cli: surge
            binary_path: target/release/horizon
            asset_kind: tar
            surge_app_id: horizon-osx-x64
            surge_main_exe: horizon
            surge_installer_asset: horizon-installer-osx-x64.bin
            surge_installer_ext: bin
          - os: windows-latest
            name: Windows x64
            cache_key: windows-release-artifacts
            rid: win-x64
            release_asset: horizon-windows-x64.exe
            surge_cli: surge.exe
            binary_path: target/release/horizon.exe
            asset_kind: file
            surge_app_id: horizon-win-x64
            surge_main_exe: horizon.exe
            surge_installer_asset: horizon-installer-win-x64.exe
            surge_installer_ext: exe
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.validate-release.outputs.release_tag }}
          lfs: true
      - name: Restore workflow scripts for manual recovery
        if: ${{ github.event_name == 'workflow_dispatch' }}
        shell: bash
        run: |
          git fetch --no-tags --depth=1 origin "${{ github.sha }}"
          git checkout "${{ github.sha }}" -- scripts
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.cache_key }}
      - name: Restore Surge toolchain cache
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        uses: actions/cache@v5
        with:
          path: |
            .surge/toolchain-src
            .cache/surge-toolchain/${{ matrix.rid }}
          key: surge-toolchain-${{ matrix.rid }}-${{ env.SURGE_VERSION }}
      - name: Prepare Surge toolchain source
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        shell: bash
        run: |
          ./scripts/build-surge-toolchain.sh \
            --version "${SURGE_VERSION}" \
            --output-dir ".cache/surge-toolchain/${{ matrix.rid }}" \
            --prepare-only
      - uses: Swatinem/rust-cache@v2
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        with:
          key: surge-toolchain-${{ matrix.rid }}-${{ env.SURGE_VERSION }}
          workspaces: |
            .surge/toolchain-src -> .surge/toolchain-src/target
      - name: Set release version
        shell: bash
        run: ./scripts/set-release-version.sh "${{ needs.validate-release.outputs.release_version }}"
      - run: cargo build --release
      - name: Package release asset
        shell: bash
        run: |
          ./scripts/package-release-asset.sh \
            --binary "${{ matrix.binary_path }}" \
            --kind "${{ matrix.asset_kind }}" \
            --output "${{ matrix.release_asset }}"
      - name: Upload release asset
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.release_asset }}
          path: ${{ matrix.release_asset }}
      - name: Build Surge toolchain
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        shell: bash
        run: |
          ./scripts/build-surge-toolchain.sh \
            --version "${SURGE_VERSION}" \
            --output-dir ".cache/surge-toolchain/${{ matrix.rid }}"
      - name: Stage Surge artifacts
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        shell: bash
        run: |
          ./scripts/stage-surge-artifacts.sh \
            --app-id "${{ matrix.surge_app_id }}" \
            --rid "${{ matrix.rid }}" \
            --version "${{ needs.validate-release.outputs.release_version }}" \
            --binary "${{ matrix.binary_path }}" \
            --main-exe "${{ matrix.surge_main_exe }}"
      - name: Determine Surge storage bucket
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        shell: bash
        run: |
          if [ "${{ github.repository }}" = "peters/horizon" ]; then
            surge_storage_bucket="${SURGE_STORAGE_REPOSITORY}"
          else
            surge_storage_bucket="${{ github.repository }}"
          fi

          printf 'SURGE_STORAGE_BUCKET=%s\n' "$surge_storage_bucket" >> "$GITHUB_ENV"
      - name: Render Surge release manifest
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        shell: bash
        run: |
          ./scripts/render-surge-manifest.sh \
            --input .surge/surge.yml \
            --output .surge/release.surge.yml \
            --storage-bucket "${SURGE_STORAGE_BUCKET}"
      - name: Pack Surge release bundle
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        shell: bash
        run: |
          "./.cache/surge-toolchain/${{ matrix.rid }}/${{ matrix.surge_cli }}" \
            --manifest-path .surge/release.surge.yml pack \
            --app-id "${{ matrix.surge_app_id }}" \
            --rid "${{ matrix.rid }}" \
            --version "${{ needs.validate-release.outputs.release_version }}"
      - name: Collect Surge installer asset
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        shell: bash
        run: |
          mkdir -p surge-release-assets
          cp \
            ".surge/installers/${{ matrix.surge_app_id }}/${{ matrix.rid }}/Setup-${{ matrix.rid }}-${{ matrix.surge_app_id }}-stable-offline-gui.${{ matrix.surge_installer_ext }}" \
            "surge-release-assets/${{ matrix.surge_installer_asset }}"
      - name: Upload Surge installer asset
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        uses: actions/upload-artifact@v7
        with:
          name: surge-release-assets-${{ matrix.rid }}
          path: surge-release-assets/*
      - name: Collect Surge publish packages
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        shell: bash
        run: |
          mkdir -p surge-push-packages
          cp ".surge/packages/${{ matrix.surge_app_id }}-${{ needs.validate-release.outputs.release_version }}-${{ matrix.rid }}-full.tar.zst" surge-push-packages/
          delta=".surge/packages/${{ matrix.surge_app_id }}-${{ needs.validate-release.outputs.release_version }}-${{ matrix.rid }}-delta.tar.zst"
          if [ -f "$delta" ]; then
            cp "$delta" surge-push-packages/
          fi
      - name: Upload Surge publish packages
        if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
        uses: actions/upload-artifact@v7
        with:
          name: surge-push-packages-${{ matrix.rid }}
          path: surge-push-packages/*

  upload-release-assets:
    name: Upload Release Assets
    needs: [validate-release, build-artifacts]
    outputs:
      linux_x64_sha256: ${{ steps.checksums.outputs.linux_x64_sha256 }}
      macos_arm64_sha256: ${{ steps.checksums.outputs.macos_arm64_sha256 }}
      macos_x64_sha256: ${{ steps.checksums.outputs.macos_x64_sha256 }}
      windows_x64_sha256: ${{ steps.checksums.outputs.windows_x64_sha256 }}
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts

      - name: Collect release assets
        run: |
          mkdir -p release-assets
          find artifacts -maxdepth 2 -type f \
            \( \
              -name 'horizon-linux-x64.tar.gz' \
              -o -name 'horizon-osx-arm64.tar.gz' \
              -o -name 'horizon-osx-x64.tar.gz' \
              -o -name 'horizon-windows-x64.exe' \
              -o -name 'horizon-installer-*' \
            \) \
            -exec cp {} release-assets/ \;

      - id: checksums
        name: Generate release checksums
        shell: bash
        run: |
          cd release-assets

          required_assets=(
            horizon-linux-x64.tar.gz
            horizon-osx-arm64.tar.gz
            horizon-osx-x64.tar.gz
            horizon-windows-x64.exe
          )

          for asset in "${required_assets[@]}"; do
            if [ ! -f "$asset" ]; then
              echo "::error::Missing required release asset: $asset"
              exit 1
            fi
          done

          if [[ "${{ needs.validate-release.outputs.release_prerelease }}" == "false" ]]; then
            required_installers=(
              horizon-installer-linux-x64.bin
              horizon-installer-osx-arm64.bin
              horizon-installer-osx-x64.bin
              horizon-installer-win-x64.exe
            )

            for asset in "${required_installers[@]}"; do
              if [ ! -f "$asset" ]; then
                echo "::error::Missing required Surge installer asset: $asset"
                exit 1
              fi
            done
          fi

          sha256sum -- * | tee SHA256SUMS.txt

          linux_x64_sha256="$(awk '$2 == "horizon-linux-x64.tar.gz" { print $1 }' SHA256SUMS.txt)"
          macos_arm64_sha256="$(awk '$2 == "horizon-osx-arm64.tar.gz" { print $1 }' SHA256SUMS.txt)"
          macos_x64_sha256="$(awk '$2 == "horizon-osx-x64.tar.gz" { print $1 }' SHA256SUMS.txt)"
          windows_x64_sha256="$(awk '$2 == "horizon-windows-x64.exe" { print $1 }' SHA256SUMS.txt)"

          echo "linux_x64_sha256=${linux_x64_sha256}" >> "$GITHUB_OUTPUT"
          echo "macos_arm64_sha256=${macos_arm64_sha256}" >> "$GITHUB_OUTPUT"
          echo "macos_x64_sha256=${macos_x64_sha256}" >> "$GITHUB_OUTPUT"
          echo "windows_x64_sha256=${windows_x64_sha256}" >> "$GITHUB_OUTPUT"

      - name: Upload assets to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${{ needs.validate-release.outputs.release_tag }}" release-assets/* \
            --repo "${{ github.repository }}" \
            --clobber

  publish-surge-release-index:
    name: Publish Surge Update Storage
    if: ${{ needs.validate-release.outputs.release_prerelease == 'false' }}
    needs: [validate-release, build-artifacts]
    runs-on: ubuntu-latest
    steps:
      - name: Validate Surge storage token
        if: ${{ github.repository == 'peters/horizon' }}
        env:
          SURGE_STORAGE_TOKEN: ${{ secrets.SURGE_STORAGE_TOKEN }}
        run: |
          if [ -z "$SURGE_STORAGE_TOKEN" ]; then
            echo "::error::SURGE_STORAGE_TOKEN secret is required for stable Surge storage publication."
            exit 1
          fi

      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.validate-release.outputs.release_tag }}
          lfs: true
      - name: Restore workflow scripts for manual recovery
        if: ${{ github.event_name == 'workflow_dispatch' }}
        shell: bash
        run: |
          git fetch --no-tags --depth=1 origin "${{ github.sha }}"
          git checkout "${{ github.sha }}" -- scripts

      - uses: actions/cache@v5
        with:
          path: |
            .surge/toolchain-src
            .cache/surge-toolchain/linux-x64
          key: surge-toolchain-linux-x64-${{ env.SURGE_VERSION }}

      - name: Prepare Surge toolchain source
        shell: bash
        run: |
          ./scripts/build-surge-toolchain.sh \
            --version "${SURGE_VERSION}" \
            --output-dir ".cache/surge-toolchain/linux-x64" \
            --prepare-only

      - uses: Swatinem/rust-cache@v2
        with:
          key: surge-toolchain-linux-x64-${{ env.SURGE_VERSION }}
          workspaces: |
            .surge/toolchain-src -> .surge/toolchain-src/target

      - name: Build Surge toolchain
        shell: bash
        run: |
          ./scripts/build-surge-toolchain.sh \
            --version "${SURGE_VERSION}" \
            --output-dir ".cache/surge-toolchain/linux-x64"

      - name: Determine Surge storage bucket
        shell: bash
        run: |
          if [ "${{ github.repository }}" = "peters/horizon" ]; then
            surge_storage_bucket="${SURGE_STORAGE_REPOSITORY}"
          else
            surge_storage_bucket="${{ github.repository }}"
          fi

          printf 'SURGE_STORAGE_BUCKET=%s\n' "$surge_storage_bucket" >> "$GITHUB_ENV"

      - name: Render Surge release manifest
        shell: bash
        run: |
          ./scripts/render-surge-manifest.sh \
            --input .surge/surge.yml \
            --output .surge/release.surge.yml \
            --storage-bucket "${SURGE_STORAGE_BUCKET}"

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts

      - name: Collect Surge packages
        shell: bash
        run: |
          mkdir -p .surge/packages
          find artifacts -maxdepth 2 -type f -name '*.tar.zst' -exec cp {} .surge/packages/ \;

          required_packages=(
            horizon-linux-x64-${{ needs.validate-release.outputs.release_version }}-linux-x64-full.tar.zst
            horizon-osx-arm64-${{ needs.validate-release.outputs.release_version }}-osx-arm64-full.tar.zst
            horizon-osx-x64-${{ needs.validate-release.outputs.release_version }}-osx-x64-full.tar.zst
            horizon-win-x64-${{ needs.validate-release.outputs.release_version }}-win-x64-full.tar.zst
          )

          for package in "${required_packages[@]}"; do
            if [ ! -f ".surge/packages/$package" ]; then
              echo "::error::Missing required Surge package: $package"
              exit 1
            fi
          done

      - name: Push stable Surge releases to dedicated storage repo
        if: ${{ github.repository == 'peters/horizon' }}
        env:
          GITHUB_TOKEN: ${{ secrets.SURGE_STORAGE_TOKEN }}
        shell: bash
        run: |
          surge_bin="./.cache/surge-toolchain/linux-x64/surge"
          while read -r app_id rid; do
            "$surge_bin" --manifest-path .surge/release.surge.yml push \
              --app-id "$app_id" \
              --rid "$rid" \
              --version "${{ needs.validate-release.outputs.release_version }}" \
              --channel stable \
              --packages-dir .surge/packages
          done <<'EOF'
          horizon-linux-x64 linux-x64
          horizon-osx-arm64 osx-arm64
          horizon-osx-x64 osx-x64
          horizon-win-x64 win-x64
          EOF

      - name: Push stable Surge releases to current repository
        if: ${{ github.repository != 'peters/horizon' }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          surge_bin="./.cache/surge-toolchain/linux-x64/surge"
          while read -r app_id rid; do
            "$surge_bin" --manifest-path .surge/release.surge.yml push \
              --app-id "$app_id" \
              --rid "$rid" \
              --version "${{ needs.validate-release.outputs.release_version }}" \
              --channel stable \
              --packages-dir .surge/packages
          done <<'EOF'
          horizon-linux-x64 linux-x64
          horizon-osx-arm64 osx-arm64
          horizon-osx-x64 osx-x64
          horizon-win-x64 win-x64
          EOF

  publish-snap:
    name: Publish Snap
    # Disabled: Snap Store publication paused. Re-enable by restoring the previous
    # condition: ${{ needs.validate-release.outputs.release_prerelease == 'false' && (github.event_name == 'release' || inputs.publish_snap) }}
    if: false
    needs: [validate-release]
    runs-on: ubuntu-latest
    steps:
      - name: Validate Snap Store credentials
        if: ${{ github.repository == 'peters/horizon' }}
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
        run: |
          if [ -z "$SNAPCRAFT_STORE_CREDENTIALS" ]; then
            echo "::error::SNAPCRAFT_STORE_CREDENTIALS secret is required for stable Snap publication."
            exit 1
          fi

      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.validate-release.outputs.release_tag }}
          lfs: true

      - uses: snapcore/action-build@v1
        id: snapcraft
        with:
          path: .

      - name: Upload snap artifact
        uses: actions/upload-artifact@v7
        with:
          name: horizon-linux-x64.snap
          path: ${{ steps.snapcraft.outputs.snap }}

      - name: Publish snap to Snap Store
        if: ${{ github.repository == 'peters/horizon' }}
        uses: snapcore/action-publish@v1
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
        with:
          snap: ${{ steps.snapcraft.outputs.snap }}
          release: stable

  update-homebrew-tap:
    name: Update Homebrew Tap
    if: ${{ needs.validate-release.outputs.release_prerelease == 'false' && github.repository == 'peters/horizon' }}
    needs: [validate-release, upload-release-assets]
    runs-on: ubuntu-latest
    steps:
      - name: Validate Homebrew tap token
        env:
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          if [ -z "$HOMEBREW_TAP_TOKEN" ]; then
            echo "::error::HOMEBREW_TAP_TOKEN secret is required for stable release packaging."
            exit 1
          fi

      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.validate-release.outputs.release_tag }}
          lfs: true
      - name: Restore workflow scripts for manual recovery
        if: ${{ github.event_name == 'workflow_dispatch' }}
        shell: bash
        run: |
          git fetch --no-tags --depth=1 origin "${{ github.sha }}"
          git checkout "${{ github.sha }}" -- scripts

      - name: Checkout Homebrew tap repository
        uses: actions/checkout@v7
        with:
          repository: peters/homebrew-horizon
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: homebrew-horizon

      - name: Update Homebrew tap files
        shell: bash
        run: |
          ./scripts/update-homebrew-tap.sh \
            --tap-dir homebrew-horizon \
            --version "${{ needs.validate-release.outputs.release_version }}" \
            --macos-arm64-sha "${{ needs.upload-release-assets.outputs.macos_arm64_sha256 }}" \
            --macos-x64-sha "${{ needs.upload-release-assets.outputs.macos_x64_sha256 }}" \
            --linux-x64-sha "${{ needs.upload-release-assets.outputs.linux_x64_sha256 }}"

      - name: Commit and push Homebrew tap update
        working-directory: homebrew-horizon
        env:
          RELEASE_TAG: ${{ needs.validate-release.outputs.release_tag }}
        run: |
          if git diff --quiet; then
            echo "Homebrew tap already up to date."
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add Formula/horizon.rb README.md
          git commit -m "horizon ${RELEASE_TAG}"
          git push

  update-winget-pkgs:
    name: Update WinGet Package
    if: ${{ needs.validate-release.outputs.release_prerelease == 'false' && github.repository == 'peters/horizon' }}
    needs: [validate-release, upload-release-assets]
    runs-on: ubuntu-latest
    env:
      WINGET_PKGS_REPOSITORY: peters/winget-pkgs
      WINGET_PACKAGE_IDENTIFIER: Peters.Horizon
    steps:
      - name: Validate WinGet token
        env:
          WINGET_PKGS_TOKEN: ${{ secrets.WINGET_PKGS_TOKEN }}
        run: |
          if [ -z "$WINGET_PKGS_TOKEN" ]; then
            echo "::error::WINGET_PKGS_TOKEN secret is required for stable release packaging."
            exit 1
          fi

      - name: Validate WinGet fork
        env:
          GH_TOKEN: ${{ secrets.WINGET_PKGS_TOKEN }}
        run: |
          repo_json="$(gh api "repos/${WINGET_PKGS_REPOSITORY}")"
          is_fork="$(jq -r '.fork' <<<"$repo_json")"
          parent_full_name="$(jq -r '.parent.full_name // empty' <<<"$repo_json")"

          if [ "$is_fork" != "true" ] || [ "$parent_full_name" != "microsoft/winget-pkgs" ]; then
            echo "::error::${WINGET_PKGS_REPOSITORY} must exist and be a fork of microsoft/winget-pkgs."
            exit 1
          fi

      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.validate-release.outputs.release_tag }}
          lfs: true
      - name: Restore workflow scripts for manual recovery
        if: ${{ github.event_name == 'workflow_dispatch' }}
        shell: bash
        run: |
          git fetch --no-tags --depth=1 origin "${{ github.sha }}"
          git checkout "${{ github.sha }}" -- scripts

      - name: Checkout WinGet fork
        uses: actions/checkout@v7
        with:
          repository: ${{ env.WINGET_PKGS_REPOSITORY }}
          token: ${{ secrets.WINGET_PKGS_TOKEN }}
          path: winget-pkgs

      - name: Update WinGet manifests
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          release_date="$(gh release view "${{ needs.validate-release.outputs.release_tag }}" --repo "${{ github.repository }}" --json publishedAt --jq '.publishedAt | split("T")[0]')"

          ./scripts/update-winget-pkgs.sh \
            --winget-dir winget-pkgs \
            --version "${{ needs.validate-release.outputs.release_version }}" \
            --installer-sha "${{ needs.upload-release-assets.outputs.windows_x64_sha256 }}" \
            --release-date "${release_date}"

      - id: push-winget
        name: Commit and push WinGet update
        working-directory: winget-pkgs
        env:
          RELEASE_VERSION: ${{ needs.validate-release.outputs.release_version }}
          RELEASE_TAG: ${{ needs.validate-release.outputs.release_tag }}
        run: |
          branch_name="horizon-${RELEASE_VERSION}"
          manifest_path="manifests/p/Peters/Horizon/${RELEASE_VERSION}"
          git checkout -B "$branch_name"

          echo "branch_name=${branch_name}" >> "$GITHUB_OUTPUT"

          if [ -z "$(git status --short -- "$manifest_path")" ]; then
            echo "WinGet manifests already up to date."
            echo "changes_present=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add "$manifest_path"
          git commit -m "New version: ${WINGET_PACKAGE_IDENTIFIER} version ${RELEASE_VERSION}"
          git push --force-with-lease origin "$branch_name"
          echo "changes_present=true" >> "$GITHUB_OUTPUT"

      - name: Open or reuse WinGet pull request
        working-directory: winget-pkgs
        env:
          GH_TOKEN: ${{ secrets.WINGET_PKGS_TOKEN }}
          RELEASE_VERSION: ${{ needs.validate-release.outputs.release_version }}
          RELEASE_TAG: ${{ needs.validate-release.outputs.release_tag }}
        run: |
          branch_name="${{ steps.push-winget.outputs.branch_name }}"
          fork_owner="${WINGET_PKGS_REPOSITORY%%/*}"
          existing_pr_url="$(gh pr list \
            --repo microsoft/winget-pkgs \
            --state open \
            --head "${fork_owner}:${branch_name}" \
            --json url \
            --jq '.[0].url // empty')"

          if [ -n "$existing_pr_url" ]; then
            echo "WinGet PR already exists: $existing_pr_url"
            exit 0
          fi

          if [ "${{ steps.push-winget.outputs.changes_present }}" != "true" ]; then
            echo "No WinGet manifest changes to publish."
            exit 0
          fi

          pr_body="$(printf '%s\n' \
            'New stable Horizon release submission for WinGet.' \
            '' \
            "- Package identifier: \`${WINGET_PACKAGE_IDENTIFIER}\`" \
            "- Version: \`${RELEASE_VERSION}\`" \
            "- Installer URL: https://github.com/peters/horizon/releases/download/${RELEASE_TAG}/horizon-windows-x64.exe" \
            "- Installer SHA256: \`${{ needs.upload-release-assets.outputs.windows_x64_sha256 }}\`" \
            '' \
            'Generated by the Horizon stable release workflow.')"

          gh pr create \
            --repo microsoft/winget-pkgs \
            --base master \
            --head "${fork_owner}:${branch_name}" \
            --title "New version: ${WINGET_PACKAGE_IDENTIFIER} version ${RELEASE_VERSION}" \
            --body "$pr_body"