name: Distribute Release

# Auto-pushes new releases to package managers. Triggers on:
#   - tag push (e.g. v5.9.21) — the normal release flow
#   - workflow_dispatch — manual run for testing or backports
#
# Each step that needs a secret checks for it and skips gracefully with a
# clear warning if it's not set, so the workflow can be merged and tested
# before secrets are configured.

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      version:
        description: 'Override version (e.g. 5.9.21). Leave blank to use tag.'
        required: false
        type: string

permissions:
  contents: read

jobs:
  version:
    name: Resolve version
    runs-on: ubuntu-22.04
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
    outputs:
      version: ${{ steps.v.outputs.version }}
    steps:
      - id: v
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ inputs.version }}" ]; then
            echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT
          else
            echo "version=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT
          fi
      - run: echo "Distributing v${{ steps.v.outputs.version }}"

  docker:
    name: Docker Hub
    needs: version
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write
    env:
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      VERSION: ${{ needs.version.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        run: |
          if [ -z "$DOCKERHUB_TOKEN" ]; then
            echo "::warning::DOCKERHUB_TOKEN secret not set — skipping Docker push. Add it at Settings → Secrets → Actions."
            exit 0
          fi
          echo "$DOCKERHUB_TOKEN" | docker login -u samiahmed7777 --password-stdin

      - name: Wait for release artifacts
        run: |
          # The Dockerfile downloads the daemon .deb from the release URL.
          # On tag-push the release is created first, but the assets get
          # uploaded a few seconds/minutes later by the build job — without
          # this wait, the Docker build races and fails with curl 22 / 404
          # (saw this on v5.9.24 run #24, dist #24, Docker Hub job
          # step #5 — release was published 8 min after the workflow fired).
          for i in {1..90}; do
            URL="https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/cryptographic-triangles-daemon_${VERSION}_amd64.deb"
            if curl -fsSL --head "$URL" >/dev/null 2>&1; then
              echo "✓ Release .deb available: $URL"
              exit 0
            fi
            echo "  waiting for release v${VERSION} daemon .deb... ($i/90)"
            sleep 20
          done
          echo "::error::Release v${VERSION} daemon .deb never became available after 30 minutes"
          exit 1

      - name: Build and push
        run: |
          if [ -z "$DOCKERHUB_TOKEN" ]; then exit 0; fi
          docker buildx build \
            --push \
            --tag samiahmed7777/trianglesd:$VERSION \
            --tag samiahmed7777/trianglesd:latest \
            --cache-from type=gha \
            --cache-to type=gha,mode=max \
            --provenance=false \
            ./packaging/docker

      - name: Verify pushed image
        run: |
          if [ -z "$DOCKERHUB_TOKEN" ]; then exit 0; fi
          docker pull samiahmed7777/trianglesd:$VERSION
          echo "--- trianglesd -version ---"
          docker run --rm samiahmed7777/trianglesd:$VERSION trianglesd -version 2>&1 | head -3
          echo "--- triangles-cli getinfo (will fail without RPC, expected) ---"
          docker run --rm samiahmed7777/trianglesd:$VERSION triangles-cli getinfo 2>&1 | head -3

  aur:
    name: AUR (triangles-qt-bin)
    needs: version
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-22.04
    container:
      image: archlinux:latest
      options: --privileged
    env:
      AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
      VERSION: ${{ needs.version.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Check AUR_SSH_KEY
        run: |
          if [ -z "$AUR_SSH_KEY" ]; then
            echo "::warning::AUR_SSH_KEY secret not set — skipping AUR push. Add it at Settings → Secrets → Actions."
            echo "::warning::The key should be the contents of ~/.ssh/aur_key (private key, not .pub)."
          fi

      - name: Install build tools + create non-root user
        if: env.AUR_SSH_KEY != ''
        run: |
          pacman -Syu --noconfirm --needed git openssh base-devel python sudo
          # makepkg refuses to run as root — create a build user
          useradd -m -s /bin/bash build
          echo 'build ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
          chown -R build:build "$GITHUB_WORKSPACE"

      - name: Wait for release artifacts
        if: env.AUR_SSH_KEY != ''
        run: |
          for i in {1..90}; do
            URL="https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/cryptographic-triangles_${VERSION}_amd64.deb"
            if curl -fsSL --head "$URL" >/dev/null 2>&1; then
              echo "✓ Release .deb available: $URL"
              exit 0
            fi
            echo "  waiting for release v${VERSION}... ($i/90)"
            sleep 20
          done
          echo "::error::Release v${VERSION} .deb never became available after 30 minutes"
          exit 1

      - name: Download source .debs
        if: env.AUR_SSH_KEY != ''
        run: |
          cd /tmp
          curl -fsSL -o full.deb "https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/cryptographic-triangles_${VERSION}_amd64.deb"
          curl -fsSL -o daemon.deb "https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/cryptographic-triangles-daemon_${VERSION}_amd64.deb"
          ls -la /tmp/*.deb
          sha256sum /tmp/full.deb /tmp/daemon.deb

      - name: Update PKGBUILD with version + SHA256s
        if: env.AUR_SSH_KEY != ''
        run: |
          cp "$GITHUB_WORKSPACE/packaging/aur/PKGBUILD" /tmp/PKGBUILD
          chown build:build /tmp/PKGBUILD /tmp/full.deb /tmp/daemon.deb
          sudo -u build bash -c '
            set -e
            cd /tmp
            FULL_SHA=$(sha256sum full.deb | awk "{print \$1}")
            DAEMON_SHA=$(sha256sum daemon.deb | awk "{print \$1}")
            echo "version='"$VERSION"' full=$FULL_SHA daemon=$DAEMON_SHA"
            python3 - <<PYEOF
          import re
          with open("/tmp/PKGBUILD") as f:
              content = f.read()
          content = re.sub(r"^pkgver=.*", "pkgver='"$VERSION"'", content, count=1, flags=re.MULTILINE)
          new_shas = """sha256sums=(
              '"'"'$FULL_SHA'"'"'
              '"'"'$DAEMON_SHA'"'"'
              '"'"'SKIP'"'"'
          )"""
          content = re.sub(r"sha256sums=\(.*?\)", new_shas, content, count=1, flags=re.DOTALL)
          with open("/tmp/PKGBUILD", "w") as f:
              f.write(content)
          PYEOF
            echo "--- updated PKGBUILD (pkgver + sha256sums) ---"
            grep -E "^(pkgver|sha256sums)" /tmp/PKGBUILD
          '

      - name: Generate .SRCINFO via makepkg
        if: env.AUR_SSH_KEY != ''
        run: |
          cp /tmp/full.deb "/tmp/cryptographic-triangles_${VERSION}_amd64.deb"
          cp /tmp/daemon.deb "/tmp/cryptographic-triangles-daemon_${VERSION}_amd64.deb"
          chown build:build /tmp/PKGBUILD /tmp/cryptographic-triangles-*.deb
          sudo -u build bash -c '
            cd /tmp
            makepkg --printsrcinfo > .SRCINFO
            echo "--- generated .SRCINFO ---"
            cat .SRCINFO
          '

      - name: Setup SSH key for AUR
        if: env.AUR_SSH_KEY != ''
        run: |
          mkdir -p /home/build/.ssh
          printf '%s\n' "$AUR_SSH_KEY" > /home/build/.ssh/aur_key
          chmod 600 /home/build/.ssh/aur_key
          ssh-keyscan -t ed25519 aur.archlinux.org > /home/build/.ssh/known_hosts 2>/dev/null
          chown -R build:build /home/build/.ssh

      - name: Clone AUR repo
        if: env.AUR_SSH_KEY != ''
        run: |
          sudo -u build bash -c '
            cd /tmp
            GIT_SSH_COMMAND="ssh -i ~/.ssh/aur_key -o IdentitiesOnly=yes" \
              git clone ssh://aur@aur.archlinux.org/triangles-qt-bin.git
            ls -la /tmp/triangles-qt-bin
          '

      - name: Stage updated files
        if: env.AUR_SSH_KEY != ''
        run: |
          cp /tmp/PKGBUILD /tmp/triangles-qt-bin/PKGBUILD
          cp /tmp/.SRCINFO /tmp/triangles-qt-bin/.SRCINFO
          cp "$GITHUB_WORKSPACE/packaging/aur/triangles-qt.desktop" /tmp/triangles-qt-bin/triangles-qt.desktop
          chown -R build:build /tmp/triangles-qt-bin
          sudo -u build bash -c '
            cd /tmp/triangles-qt-bin
            git --no-pager diff --stat
          '

      - name: Commit and push to AUR
        if: env.AUR_SSH_KEY != ''
        run: |
          sudo -u build bash -c '
            cd /tmp/triangles-qt-bin
            git config user.name "Sami Ahmed"
            git config user.email "SamiAhmed7777@users.noreply.github.com"
            git add PKGBUILD .SRCINFO triangles-qt.desktop
            if git diff --cached --quiet; then
              echo "No changes to commit (AUR already at this version)"
              exit 0
            fi
            git commit -m "triangles-qt-bin '"$VERSION"'-1"
            GIT_SSH_COMMAND="ssh -i ~/.ssh/aur_key -o IdentitiesOnly=yes" \
              git push origin master
          '

      - name: ✓ Summary
        if: always()
        run: |
          if [ -z "$AUR_SSH_KEY" ]; then
            echo "::notice::AUR job was skipped because AUR_SSH_KEY is not set."
          else
            echo "::notice::AUR distribution completed."
          fi

  homebrew:
    name: Homebrew tap (SamiAhmed7777/homebrew-triangles)
    needs: version
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-22.04
    env:
      HOMEBREW_GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_TOKEN }}
      VERSION: ${{ needs.version.outputs.version }}
    steps:
      - name: Check HOMEBREW_GITHUB_TOKEN
        run: |
          if [ -z "$HOMEBREW_GITHUB_TOKEN" ]; then
            echo "::warning::HOMEBREW_GITHUB_TOKEN secret not set — skipping Homebrew push. Add it at Settings → Secrets → Actions."
            echo "::warning::Use a GitHub PAT with 'repo' scope for SamiAhmed7777/homebrew-triangles."
          fi

      - name: Wait for release artifacts
        if: env.HOMEBREW_GITHUB_TOKEN != ''
        run: |
          for i in {1..90}; do
            URL="https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/Cryptographic-Triangles-v${VERSION}-macos-arm64.dmg"
            if curl -fsSL --head "$URL" >/dev/null 2>&1; then
              echo "✓ Release .dmg available: $URL"
              exit 0
            fi
            echo "  waiting for release v${VERSION}... ($i/90)"
            sleep 20
          done
          echo "::error::Release v${VERSION} macOS .dmg never became available after 30 minutes"
          exit 1

      - name: Compute macOS .dmg SHA256
        if: env.HOMEBREW_GITHUB_TOKEN != ''
        id: sha
        run: |
          curl -fsSL -o /tmp/triangles.dmg \
            "https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/Cryptographic-Triangles-v${VERSION}-macos-arm64.dmg"
          SHA=$(sha256sum /tmp/triangles.dmg | awk '{print $1}')
          echo "sha=$SHA" >> $GITHUB_OUTPUT
          echo "macOS .dmg SHA256: $SHA"

      - name: Clone homebrew-triangles
        if: env.HOMEBREW_GITHUB_TOKEN != ''
        run: |
          git clone https://x-access-token:$HOMEBREW_GITHUB_TOKEN@github.com/SamiAhmed7777/homebrew-triangles.git /tmp/homebrew-triangles
          cd /tmp/homebrew-triangles
          git --no-pager log --oneline | head -3

      - name: Update Formula and Cask
        if: env.HOMEBREW_GITHUB_TOKEN != ''
        env:
          VERSION: ${{ needs.version.outputs.version }}
          SHA: ${{ steps.sha.outputs.sha }}
        run: |
          cd /tmp/homebrew-triangles
          # Update Casks/cryptographic-triangles.rb
          python3 - <<PYEOF
          import re
          for path, old_v_pat, old_sha_pat in [
              ('Casks/cryptographic-triangles.rb', r'^\s*version\s+"[\d.]+"', r'^\s*sha256\s+"[a-f0-9]+"'),
              ('Formula/triangles.rb',             r'^\s*version\s+"[\d.]+"', r'^\s*sha256\s+"[a-f0-9]+"'),
          ]:
              with open(path) as f: content = f.read()
              content = re.sub(old_v_pat, f'  version "$VERSION"', content, count=1, flags=re.MULTILINE)
              content = re.sub(old_sha_pat, f'  sha256 "$SHA"', content, count=1, flags=re.MULTILINE)
              with open(path, 'w') as f: f.write(content)
          PYEOF
          cat Formula/triangles.rb | head -5
          echo "---"
          cat Casks/cryptographic-triangles.rb | head -5
          git --no-pager diff --stat

      - name: Commit and push
        if: env.HOMEBREW_GITHUB_TOKEN != ''
        env:
          VERSION: ${{ needs.version.outputs.version }}
        run: |
          cd /tmp/homebrew-triangles
          git config user.name "Sami Ahmed"
          git config user.email "SamiAhmed7777@users.noreply.github.com"
          git add Formula/triangles.rb Casks/cryptographic-triangles.rb
          if git diff --cached --quiet; then
            echo "No changes to commit (Homebrew tap already at this version)"
            exit 0
          fi
          git commit -m "triangles ${VERSION}"
          git push origin main

      - name: ✓ Summary
        if: always()
        run: |
          if [ -z "$HOMEBREW_GITHUB_TOKEN" ]; then
            echo "::notice::Homebrew job was skipped because HOMEBREW_GITHUB_TOKEN is not set."
          else
            echo "::notice::Homebrew distribution completed."
          fi

  chocolatey:
    name: Chocolatey (triangles)
    needs: version
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
    runs-on: windows-latest
    env:
      CHOCO_API_KEY: ${{ secrets.CHOCO_API_KEY }}
      VERSION: ${{ needs.version.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Check CHOCO_API_KEY + CHOCO_SKIP_WACATAC
        shell: bash
        run: |
          if [ -z "$CHOCO_API_KEY" ]; then
            echo "::warning::CHOCO_API_KEY not set — skipping Chocolatey push."
          fi
          if [ "$CHOCO_SKIP_WACATAC" != "" ]; then
            echo "::warning::CHOCO_SKIP_WACATAC=$CHOCO_SKIP_WACATAC — skipping Chocolatey push (Wacatac still active)."
          fi

      - name: Wait for release artifacts
        if: env.CHOCO_API_KEY != '' && env.CHOCO_SKIP_WACATAC != ''
        shell: bash
        run: |
          for i in {1..90}; do
            URL="https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/Cryptographic-Triangles-${VERSION}-win-x64-setup.exe"
            if curl -fsSL --head "$URL" >/dev/null 2>&1; then
              echo "✓ Release .exe available: $URL"
              exit 0
            fi
            echo "  waiting for release v${VERSION}... ($i/90)"
            sleep 20
          done
          echo "::error::Release v${VERSION} Windows installer never became available after 30 minutes"
          exit 1

      - name: Compute installer SHA256
        if: env.CHOCO_API_KEY != '' && env.CHOCO_SKIP_WACATAC != ''
        shell: bash
        id: sha
        run: |
          curl -fsSL -o /tmp/triangles-setup.exe \
            "https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/Cryptographic-Triangles-${VERSION}-win-x64-setup.exe"
          SHA=$(sha256sum /tmp/triangles-setup.exe | awk '{print $1}')
          echo "sha=$SHA" >> $GITHUB_OUTPUT
          echo "Chocolatey installer SHA256: $SHA"

      - name: Update nuspec version
        if: env.CHOCO_API_KEY != '' && env.CHOCO_SKIP_WACATAC != ''
        shell: bash
        working-directory: ${{ github.workspace }}/packaging/chocolatey
        run: |
          python3 -c "
          import re
          with open('triangles.nuspec') as f: c = f.read()
          c = re.sub(r'<version>[\d.]+</version>', f'<version>${VERSION}</version>', c)
          with open('triangles.nuspec', 'w') as f: f.write(c)
          print('updated nuspec version to', '${VERSION}')
          "
          grep -E "<version>|<id>" triangles.nuspec

      - name: Update nuspec version + install script SHA
        if: env.CHOCO_API_KEY != '' && env.CHOCO_SKIP_WACATAC != ''
        shell: bash
        working-directory: ${{ github.workspace }}/packaging/chocolatey
        run: |
          python3 -c "
          import re
          with open('triangles.nuspec') as f: c = f.read()
          c = re.sub(r'<version>[\d.]+</version>', f'<version>${VERSION}</version>', c)
          with open('triangles.nuspec', 'w') as f: f.write(c)
          with open('tools/chocolateyInstall.ps1') as f: c = f.read()
          c = c.replace('__CHECKSUM_PLACEHOLDER__', '${{ steps.sha.outputs.sha }}')
          with open('tools/chocolateyInstall.ps1', 'w') as f: f.write(c)
          print('updated nuspec version + install script checksum')
          "
          grep -E "<version>|<id>" triangles.nuspec
          grep checksum64 tools/chocolateyInstall.ps1

      - name: Pack Chocolatey package
        if: env.CHOCO_API_KEY != '' && env.CHOCO_SKIP_WACATAC != ''
        shell: pwsh
        working-directory: ${{ github.workspace }}/packaging/chocolatey
        run: |
          choco pack
          Get-ChildItem *.nupkg

      - name: Push to Chocolatey
        if: env.CHOCO_API_KEY != '' && env.CHOCO_SKIP_WACATAC != ''
        shell: pwsh
        working-directory: ${{ github.workspace }}/packaging/chocolatey
        run: |
          $apiKey = [System.Environment]::GetEnvironmentVariable('CHOCO_API_KEY', 'Process')
          choco apikey add --key="$apiKey" --source='https://push.chocolatey.org/'
          Get-ChildItem *.nupkg | ForEach-Object {
            Write-Host "Pushing $($_.Name)..."
            choco push $_.Name --source='https://push.chocolatey.org/'
          }

      - name: ✓ Summary
        if: always()
        shell: bash
        run: |
          if [ -z "$CHOCO_API_KEY" ]; then
            echo "::notice::Chocolatey job skipped (CHOCO_API_KEY not set)."
          elif [ -n "$CHOCO_SKIP_WACATAC" ]; then
            echo "::notice::Chocolatey job skipped (Wacatac detection still active). Set CHOCO_SKIP_WACATAC='' and re-run after Microsoft clears the false-positive."
          else
            echo "::notice::Chocolatey push completed (subject to moderator review)."
          fi

  winget:
    name: WinGet (CryptographicTriangles.TrianglesQt)
    needs: version
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-22.04
    env:
      WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
      VERSION: ${{ needs.version.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Check WINGET_TOKEN
        run: |
          if [ -z "$WINGET_TOKEN" ]; then
            echo "::warning::WINGET_TOKEN not set — skipping WinGet PR. Add a GitHub PAT with 'public_repo' scope at Settings → Secrets → Actions."
          fi

      - name: Wait for release artifacts
        if: env.WINGET_TOKEN != ''
        run: |
          for i in {1..90}; do
            URL="https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/Cryptographic-Triangles-${VERSION}-win-x64-setup.exe"
            if curl -fsSL --head "$URL" >/dev/null 2>&1; then
              echo "✓ Release .exe available: $URL"
              exit 0
            fi
            echo "  waiting for release v${VERSION}... ($i/90)"
            sleep 20
          done
          echo "::error::Release v${VERSION} Windows installer never became available after 30 minutes"
          exit 1

      - name: Compute installer SHA256
        if: env.WINGET_TOKEN != ''
        id: sha
        run: |
          curl -fsSL -o /tmp/triangles-setup.exe \
            "https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${VERSION}/Cryptographic-Triangles-${VERSION}-win-x64-setup.exe"
          SHA=$(sha256sum /tmp/triangles-setup.exe | awk '{print $1}')
          echo "sha=$SHA" >> $GITHUB_OUTPUT
          echo "WinGet installer SHA256: $SHA"

      - name: "Pre-flight check for existing failed WinGet PRs"
        if: env.WINGET_TOKEN != ''
        env:
          GH_TOKEN: ${{ secrets.WINGET_TOKEN }}
        run: |
          set -e
          # Don't pile up PRs if previous ones still have author-action-needed flags.
          # winget-pkgs moderators can read repeated unfixed failures as spam.
          # Skip the PR for this release if any existing SamiAhmed7777 PR against
          # microsoft/winget-pkgs has a blocker label.
          echo "Checking existing open PRs from SamiAhmed7777 on microsoft/winget-pkgs..."
          BLOCKING=$(gh api -X GET \
            'repos/microsoft/winget-pkgs/issues?state=open&labels=PullRequest-Error,Needs-Author-Feedback&per_page=30' \
            --jq '.[] | select(.user.login=="SamiAhmed7777") | "#\(.number) [\(.state)] \(.title)"' \
            || echo "")
          if [ -n "$BLOCKING" ]; then
            echo "::error::Existing WinGet PR(s) with blocker labels — fix or close those first:"
            echo "$BLOCKING"
            echo "::error::Aborting this WinGet submission to avoid piling up failed PRs."
            exit 1
          fi
          echo "✓ No blocker-labelled PRs found — safe to submit."

      - name: Fork + update WinGet manifest + open PR
        if: env.WINGET_TOKEN != ''
        env:
          GH_TOKEN: ${{ secrets.WINGET_TOKEN }}
          SHA: ${{ steps.sha.outputs.sha }}
          PUBLISHER_INITIAL: c
          PACKAGE_ID: CryptographicTriangles.TrianglesQt
          PACKAGE_SHORT: TrianglesQt
          INSTALLER_URL: https://github.com/SamiAhmed7777/triangles_v5/releases/download/v${{ env.VERSION }}/Cryptographic-Triangles-${{ env.VERSION }}-win-x64-setup.exe
        run: |
          set -e
          # Install gh + jq if missing
          which gh >/dev/null 2>&1 || (curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null && sudo apt update && sudo apt install -y gh jq)

          # Skip if a PR for THIS version already exists (avoid duplicate submissions).
          echo "Checking for existing PR for version ${VERSION}..."
          if gh api 'repos/microsoft/winget-pkgs/pulls?state=open&per_page=30' \
              --jq ".[] | select(.head.ref | startswith(\"triangles-${VERSION}-\")) | .number" \
              | grep -q .; then
            echo "::notice::PR for v${VERSION} already exists — skipping to avoid duplicate."
            exit 0
          fi
          echo "✓ No existing PR for v${VERSION}."

          VERSION="$VERSION"
          # Path convention (winget-pkgs): lowercase first letter of publisher,
          # then publisher folder (PascalCase), then short package folder name.
          # Example: manifests/c/CryptographicTriangles/TrianglesQt/5.9.20/
          MANIFEST_DIR="manifests/$PUBLISHER_INITIAL/CryptographicTriangles/$PACKAGE_SHORT/$VERSION"

          # TrianglesQt is built with NSIS (Nullsoft). Standard silent flag is /S.
          # If the installer tech ever changes, update InstallerSwitches here.
          NSIS_SILENT="/S"
          
          # 1. Clone the winget-pkgs repo (Sami's fork) — auto-create fork if needed
          echo "Forking microsoft/winget-pkgs..."
          GH_REPO="SamiAhmed7777/winget-pkgs"
          if ! gh repo view "$GH_REPO" >/dev/null 2>&1; then
            gh repo fork microsoft/winget-pkgs --remote=false || true
          fi
          rm -rf winget-pkgs
          git clone --depth 1 "https://x-access-token:${WINGET_TOKEN}@github.com/${GH_REPO}.git" winget-pkgs
          cd winget-pkgs
          git config user.name "Sami Ahmed"
          git config user.email "SamiAhmed7777@users.noreply.github.com"
          
          BRANCH="triangles-${VERSION}-${{ github.run_number }}"
          git checkout -b "$BRANCH"
          
          mkdir -p "$MANIFEST_DIR"

          # 2. Generate the three manifest files (winget-pkgs schema 1.12.0)
          #
          # Schema rules (see doc/manifest/schema/1.12.0/*.md and
          # doc/ValidationFailureGuide.md):
          #   - version file: PackageIdentifier, PackageVersion, DefaultLocale
          #     (NOT PackageLocale — that's the old field name), ManifestType
          #     "version", ManifestVersion "1.12.0"
          #   - defaultLocale file: Publisher, PackageName, License,
          #     ShortDescription are REQUIRED (no Publisher in version file)
          #   - installer file: InstallModes array (not "InstallerMode:
          #     interactive" — that's the old field name); ManifestVersion 1.12.0
          #   - All files: include # yaml-language-server: $schema=... comment
          #     for editor + validator support

          SCHEMA_BASE="https://raw.githubusercontent.com/microsoft/winget-cli/master/schemas/JSON/manifests/v1.12.0"

          cat > "$MANIFEST_DIR/${PACKAGE_ID}.yaml" <<EOF
          # yaml-language-server: \$schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
          PackageIdentifier: ${PACKAGE_ID}
          PackageVersion: ${VERSION}
          DefaultLocale: en-US
          ManifestType: version
          ManifestVersion: 1.12.0
          EOF

          cat > "$MANIFEST_DIR/${PACKAGE_ID}.locale.en-US.yaml" <<EOF
          # yaml-language-server: \$schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
          PackageIdentifier: ${PACKAGE_ID}
          PackageVersion: ${VERSION}
          PackageLocale: en-US
          Publisher: Cryptographic Triangles
          PublisherUrl: https://cryptographic-triangles.org
          PackageName: Cryptographic Triangles Qt Wallet
          License: MIT
          ShortDescription: Privacy-focused cryptocurrency wallet with PoS staking, Tor v3, and encrypted messaging.
          Description: |-
            Cryptographic Triangles (TRI) is a privacy-focused cryptocurrency
            featuring Proof-of-Stake consensus with 33% annual staking rewards,
            Tor v3 onion routing, and built-in encrypted peer-to-peer messaging.
            Originally launched in July 2014, featuring the unique Hash9 algorithm
            (13-step hash cascade).
          ManifestType: defaultLocale
          ManifestVersion: 1.12.0
          EOF

          cat > "$MANIFEST_DIR/${PACKAGE_ID}.installer.yaml" <<EOF
          # yaml-language-server: \$schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
          PackageIdentifier: ${PACKAGE_ID}
          PackageVersion: ${VERSION}
          InstallModes:
            - interactive
            - silent
          InstallerSwitches:
            Silent: /S
            SilentWithProgress: /S
          Installers:
            - Architecture: x64
              InstallerType: exe
              InstallerUrl: ${INSTALLER_URL}
              InstallerSha256: ${SHA}
          ManifestType: installer
          ManifestVersion: 1.12.0
          EOF

          git add "$MANIFEST_DIR"
          git commit -m "${PACKAGE_ID} version ${VERSION}"
          git push origin "$BRANCH"
          
          # 3. Open PR
          gh pr create \
            --repo microsoft/winget-pkgs \
            --head "SamiAhmed7777:${BRANCH}" \
            --base master \
            --title "${PACKAGE_ID} version ${VERSION}" \
            --body "Automated update of ${PACKAGE_ID} to v${VERSION}. Artifacts at ${INSTALLER_URL} (SHA256: ${SHA})."
          
          echo "✓ PR opened"

      - name: ✓ Summary
        if: always()
        run: |
          if [ -z "$WINGET_TOKEN" ]; then
            echo "::notice::WinGet job skipped (WINGET_TOKEN not set)."
          else
            echo "::notice::WinGet PR opened."
          fi