winget.yml

name: Winget Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g., v0.1.0)'
        required: true

env:
  PACKAGE_ID: CortexLM.Cortex

jobs:
  # Lightweight job - 4 vCPU Blacksmith Windows runner
  winget:
    name: Publish to Winget
    runs-on: blacksmith-4vcpu-windows-2025
    steps:
      - uses: actions/checkout@v7

      - name: Get version
        id: version
        shell: pwsh
        run: |
          if ("${{ github.event_name }}" -eq "workflow_dispatch") {
            $version = "${{ github.event.inputs.tag }}" -replace '^v', ''
          } else {
            $version = "${{ github.event.release.tag_name }}" -replace '^v', ''
          }
          echo "version=$version" >> $env:GITHUB_OUTPUT
          echo "Version: $version"

      - name: Get release URLs and hashes
        id: release
        shell: pwsh
        run: |
          $tag = "v${{ steps.version.outputs.version }}"
          $baseUrl = "https://github.com/${{ github.repository }}/releases/download/$tag"
          
          # Download and hash x64
          $x64Url = "$baseUrl/cortex-cli-windows-x64.zip"
          Invoke-WebRequest -Uri $x64Url -OutFile "cortex-x64.zip" -ErrorAction Stop
          $x64Hash = (Get-FileHash -Path "cortex-x64.zip" -Algorithm SHA256).Hash
          
          # ARM64 is intentionally absent from the release matrix.
          echo "x64_url=$x64Url" >> $env:GITHUB_OUTPUT
          echo "x64_hash=$x64Hash" >> $env:GITHUB_OUTPUT

      - name: Create winget manifest directory
        shell: pwsh
        run: |
          $version = "${{ steps.version.outputs.version }}"
          $manifestDir = "manifests/c/CortexLM/Cortex/$version"
          New-Item -ItemType Directory -Force -Path $manifestDir
          echo "MANIFEST_DIR=$manifestDir" >> $env:GITHUB_ENV

      - name: Generate version manifest
        shell: pwsh
        run: |
          $content = @"
          PackageIdentifier: ${{ env.PACKAGE_ID }}
          PackageVersion: ${{ steps.version.outputs.version }}
          DefaultLocale: en-US
          ManifestType: version
          ManifestVersion: 1.6.0
          "@
          $content | Out-File -FilePath "${{ env.MANIFEST_DIR }}/${{ env.PACKAGE_ID }}.yaml" -Encoding utf8

      - name: Generate installer manifest
        shell: pwsh
        run: |
          $installers = @"
          PackageIdentifier: ${{ env.PACKAGE_ID }}
          PackageVersion: ${{ steps.version.outputs.version }}
          Platform:
            - Windows.Desktop
          MinimumOSVersion: 10.0.17763.0
          InstallerType: zip
          NestedInstallerType: portable
          NestedInstallerFiles:
            - RelativeFilePath: Cortex.exe
              PortableCommandAlias: cortex
          Installers:
            - Architecture: x64
              InstallerUrl: ${{ steps.release.outputs.x64_url }}
              InstallerSha256: ${{ steps.release.outputs.x64_hash }}
          "@
          
          $installers += @"

          ManifestType: installer
          ManifestVersion: 1.6.0
          "@
          
          $installers | Out-File -FilePath "${{ env.MANIFEST_DIR }}/${{ env.PACKAGE_ID }}.installer.yaml" -Encoding utf8

      - name: Generate locale manifest
        shell: pwsh
        run: |
          $content = @"
          PackageIdentifier: ${{ env.PACKAGE_ID }}
          PackageVersion: ${{ steps.version.outputs.version }}
          PackageLocale: en-US
          Publisher: CortexLM
          PublisherUrl: https://github.com/CortexLM
          PublisherSupportUrl: https://github.com/CortexLM/cli/issues
          PackageName: Cortex CLI
          PackageUrl: https://github.com/CortexLM/cli
          License: Apache-2.0
          LicenseUrl: https://github.com/CortexLM/cli/blob/main/LICENSE
          ShortDescription: Cortex CLI - A modern AI coding agent
          Description: Cortex is a powerful command-line AI coding assistant that helps developers write, debug, and maintain code more efficiently.
          Tags:
            - ai
            - cli
            - coding
            - developer-tools
            - rust
          ManifestType: defaultLocale
          ManifestVersion: 1.6.0
          "@
          $content | Out-File -FilePath "${{ env.MANIFEST_DIR }}/${{ env.PACKAGE_ID }}.locale.en-US.yaml" -Encoding utf8

      - name: Require provisioned package tooling
        shell: pwsh
        run: |
          # Do not execute an unpinned executable downloaded at publish time.
          # The Windows runner image must provision the reviewed tooling.
          $tool = Get-Command wingetcreate.exe -CommandType Application -ErrorAction Stop
          $signature = Get-AuthenticodeSignature -FilePath $tool.Source
          if ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notmatch 'O=Microsoft Corporation') {
            throw 'wingetcreate must have a valid Microsoft signature'
          }

      - name: Validate manifests
        shell: pwsh
        run: |
          wingetcreate.exe validate ${{ env.MANIFEST_DIR }}

      - name: Submit to winget-pkgs
        shell: pwsh
        run: |
          wingetcreate.exe submit ${{ env.MANIFEST_DIR }} --token $env:WINGET_PAT
        env:
          WINGET_PAT: ${{ secrets.WINGET_PAT }}

      - name: Upload manifests as artifact
        uses: actions/upload-artifact@v7
        with:
          name: winget-manifests
          path: manifests/