update-dev-appcast.yml

name: Update Dev Appcast

# Runs after Weekly Development Release succeeds. Checks out main fresh,
# downloads the ZIP from the just-created pre-release, signs it, and
# commits the appcast-dev entries - no race with developer pushes.
on:
  workflow_run:
    workflows: ["Weekly Development Release"]
    types:
      - completed
  workflow_dispatch:
    inputs:
      version:
        description: 'Dev version to update appcast for (e.g., 20260315.2-dev.1)'
        required: true
        type: string

permissions:
  contents: write

jobs:
  update-dev-appcast:
    name: Update appcast-dev.xml
    runs-on: [self-hosted]
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}

    steps:
      - name: Extract version
        id: version
        env:
          EVENT_NAME: ${{ github.event_name }}
          INPUT_VERSION: ${{ github.event.inputs.version }}
          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            VERSION="$INPUT_VERSION"
          else
            VERSION="$HEAD_BRANCH"
          fi
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "Updating dev appcast for version: $VERSION"

      - name: Checkout main
        uses: actions/checkout@v6
        with:
          ref: main
          fetch-depth: 0
          clean: true

      - name: Download ZIP from pre-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          mkdir -p dist
          gh release download "${VERSION}" --pattern "SAM-${VERSION}.zip" --dir dist
          ls -lh "dist/SAM-${VERSION}.zip"

      - name: Update development appcast
        env:
          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          TEMP_KEY_FILE=$(mktemp)
          echo "$SPARKLE_PRIVATE_KEY" > "$TEMP_KEY_FILE"
          chmod 600 "$TEMP_KEY_FILE"
          ./scripts/update_dev_appcast.sh "${VERSION}" "dist/SAM-${VERSION}.zip" "$TEMP_KEY_FILE"
          ./scripts/generate-dev-appcast.sh
          rm -f "$TEMP_KEY_FILE"

      - name: Commit and push
        env:
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          git config user.name "GitHub Actions"
          git config user.email "actions@github.com"
          git add appcast-dev-items.xml appcast-dev.xml
          if git diff --staged --quiet; then
            echo "No changes to development appcast files"
          else
            git commit -m "chore(dev-release): update appcast-dev.xml for v${VERSION}"
            git push origin main
          fi