release-winget.yml

name: "release-winget"
on:
  release:
    types: [released]

  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag name to release'
        required: true

permissions:
  id-token: write # required for Azure login via OIDC

env:
  TAG_NAME: ${{ github.event.inputs.tag }}

jobs:
  release:
    runs-on: windows-latest
    environment: release
    steps:
      - name: Log into Azure
        uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Publish manifest with winget-create
        run: |
          # Enabling stop on error and tracing
          Set-PSDebug -Trace 2
          $ErrorActionPreference = "Stop"
          $PSNativeCommandErrorActionPreference = "Stop"

          if ($env:TAG_NAME -eq "") {
            # Get latest release
            $github = Get-Content '${{ github.event_path }}' | ConvertFrom-Json

            # Set the tag name environment variable
            $env:TAG_NAME =  $github.release.tag_name

            # Get download URLs
            $asset_x64 = $github.release.assets | Where-Object -Property name -match '64-bit.exe$'
            $asset_arm64 = $github.release.assets | Where-Object -Property name -match 'arm64.exe$'
            $asset_x64_url = $asset_x64.browser_download_url
            $asset_arm64_url = $asset_arm64.browser_download_url
          } else {
            # Get release object by its tag
            $env:GH_TOKEN = ${{ toJson(secrets.GITHUB_TOKEN) }}
            $github = (gh release view -R microsoft/git $env:TAG_NAME --json tagName,assets --jq '{tag_name: .tagName, assets: .assets}') | ConvertFrom-Json

            # Get download URLs
            $asset_x64 = $github.assets | Where-Object -Property name -match '64-bit.exe$'
            $asset_arm64 = $github.assets | Where-Object -Property name -match 'arm64.exe$'
            $asset_x64_url = $asset_x64.url
            $asset_arm64_url = $asset_arm64.url
          }

          # Remove 'v' and 'vfs' from the version
          $env:TAG_NAME -match 'v(.*?)vfs\.(.*)'
          $version = $Matches[1] + $Matches[2]

          # Download the token from Azure Key Vault and mask it in the logs
          $env:WINGET_CREATE_GITHUB_TOKEN = az keyvault secret show --name ${{ secrets.WINGET_TOKEN_SECRET_NAME }} --vault-name ${{ secrets.AZURE_VAULT }} --query "value" -o tsv
          Write-Host -NoNewLine "::add-mask::$env:WINGET_CREATE_GITHUB_TOKEN"

          # Download wingetcreate and create manifests
          Invoke-WebRequest https://aka.ms/wingetcreate/latest -OutFile wingetcreate.exe
          .\wingetcreate.exe update Microsoft.Git `
              -v $version `
              -o . `
              -u "$($asset_x64_url)|x64|machine" `
                 "$($asset_x64_url)|x64|user" `
                 "$($asset_arm64_url)|arm64|machine" `
                 "$($asset_arm64_url)|arm64|user"

          # Sync the winget-pkgs fork with upstream before submitting,
          # to avoid "The forked repository could not be synced with
          # the upstream commits" errors from wingetcreate.
          # If the fork does not exist yet, wingetcreate will create
          # it fresh (and therefore up-to-date), so a 404 is fine.
          # See https://docs.github.com/en/rest/branches/branches#sync-a-fork-branch-with-the-upstream-repository
          $headers = @{
            Authorization = "token $env:WINGET_CREATE_GITHUB_TOKEN"
            Accept = "application/vnd.github+json"
          }
          $user = (Invoke-RestMethod -Uri "https://api.github.com/user" -Headers $headers).login
          try {
            Invoke-RestMethod -Method Post `
              -Uri "https://api.github.com/repos/$user/winget-pkgs/merge-upstream" `
              -Headers $headers `
              -Body '{"branch":"master"}' `
              -ContentType "application/json"
            Write-Host "Synced $user/winget-pkgs fork with upstream."
          } catch {
            if ($_.Exception.Response.StatusCode.value__ -eq 404) {
              Write-Host "No fork found at $user/winget-pkgs; wingetcreate will create one."
            } else {
              throw
            }
          }

          # Submit the manifest to the winget-pkgs repository
          $manifestDirectory = "$PWD\manifests\m\Microsoft\Git\$version"
          $output = & .\wingetcreate.exe submit $manifestDirectory
          Write-Host $output
          $url = $output | Select-String -Pattern 'https://github\.com/microsoft/winget-pkgs/pull/\S+' | ForEach-Object { $_.Matches.Value }
          Write-Host "::notice::Submitted ${env:TAG_NAME} to winget as $url"
        shell: powershell