release-dispatch.yml

# Push-mode update entry. Upstream CI (flatpark/publish-action -> the
# hooks.flatpark.org Worker) fires an `app-release` repository_dispatch the
# moment a release is published; we recompute pins for that one app only and
# open a focused PR on its own auto/release-<app-id> branch. Several apps
# releasing the same day just means several small parallel PRs — no shared
# branch, no races.
#
# update-check.yml (the daily full sweep) stays the safety net: it catches
# releases whose Linux asset was uploaded after the ping, and its supersede
# step closes any auto/release-* PR still open once the batch covers it.
# That's also why there is no supersede here — a single-app diff is never a
# superset of anything else.
name: release-dispatch

on:
  repository_dispatch:
    types: [app-release]

permissions:
  contents: write
  pull-requests: write

# Serialize per app: a re-ping for the same app (retag, workflow re-run)
# queues behind the running one instead of racing the force-push. Different
# apps proceed in parallel on disjoint branches.
concurrency:
  group: release-dispatch-${{ github.event.client_payload.app_id }}

jobs:
  update:
    # 24.04 镜像默认的 apt 源 azure.archive.ubuntu.com 挂了:apt-get update 全线
    # Ign,退回 archive.ubuntu.com 后拉索引时停住,publish #211 就这样零输出吊了
    # 68 分钟。26.04 不走那个源。它目前是 public preview,只当作绕开手段,
    # 那边的源恢复之后换回 ubuntu-latest。
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v6
        with:
          node-version: 24
      # Payload values go through env, never inline ${{ }} inside run — the
      # Worker validates them, but they still originate outside this repo.
      - name: Recompute pins for the released app
        env:
          APP_ID: ${{ github.event.client_payload.app_id }}
          TAG: ${{ github.event.client_payload.tag }}
          UPSTREAM: ${{ github.event.client_payload.repo }}
        run: |
          echo "upstream release: ${UPSTREAM:-?} ${TAG:-?} -> $APP_ID"
          ./scripts/check-updates.sh "$APP_ID"
          # Nothing moved on the common re-ping / not-yet-uploaded path, so the
          # steps below skip instead of re-downloading the current payload.
          git diff --quiet -- registry/ || echo "pins_changed=1" >> "$GITHUB_ENV"
      # Gate the PR on the payload actually unpacking: pin it the way an install
      # does before opening anything, rather than filing a PR around a payload
      # nobody has looked inside. pr-checks re-runs this on the PR, but an
      # upstream that repackages behind an unchanged asset name should never get
      # as far as an open PR (issue #130).
      - name: Install flatpak
        if: env.pins_changed != ''
        run: |
          sudo apt-get update
          sudo apt-get install -y flatpak bubblewrap
          flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
      - name: Verify the new payload unpacks
        if: env.pins_changed != ''
        env:
          APP_ID: ${{ github.event.client_payload.app_id }}
        run: INSTALL_RUNTIME=1 ./scripts/check-apply-extra.sh "$APP_ID"
      - name: Open / update PR if pins changed
        env:
          GH_TOKEN: ${{ github.token }}
          APP_ID: ${{ github.event.client_payload.app_id }}
          TAG: ${{ github.event.client_payload.tag }}
          UPSTREAM: ${{ github.event.client_payload.repo }}
        run: |
          if git diff --quiet -- registry/; then
            echo "no pin changes — asset not uploaded yet or already current; daily update-check is the fallback"
            exit 0
          fi
          branch="auto/release-$APP_ID"
          git config user.name "flatpark-bot"
          git config user.email "bot@flatpark.org"
          git checkout -B "$branch"
          git add registry/
          git commit -m "chore(update): $APP_ID $TAG (upstream release)"
          git push -f origin "$branch"

          title="Update $APP_ID to $TAG"
          body="$(printf 'Upstream published release `%s` on `%s` and pinged us via flatpark/publish-action.\n\nPins recomputed for `%s` only; the resolver decides the actual version. Merging triggers a rebuild + publish of this app.' "$TAG" "${UPSTREAM:-?}" "$APP_ID")"

          if [ -z "$(gh pr list --head "$branch" --state open --json number -q '.[].number')" ]; then
            gh pr create --base main --head "$branch" --title "$title" --body "$body"
          else
            gh pr edit "$branch" --title "$title" --body "$body"
          fi