update.yml

name: Update Dependencies and Linters
on:
  schedule:
    - cron: '30 8 * * 0'  # Sunday 18:00 UTC+9:30
  workflow_dispatch:

jobs:
  refresh-dependencies-and-linters:
    runs-on: ubuntu-latest
    environment: automation
    permissions:
      contents: write
      pull-requests: write
    env:
      UV_PYTHON: 3.14
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: "3.14"

      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Update Rust dependencies
        run: cargo update

      - name: Install prek
        run: uv tool install prek

      - name: Run prek autoupdate
        run: prek autoupdate --cooldown-days 7

      - name: Bump pinned wingetcreate version
        # Keep release.yml's reviewed wingetcreate pin (version + verified SHA256)
        # current. The checksum is read from the release's `wingetcreate.exe.txt`
        # asset (UTF-16) rather than recomputed, so the pin stays a value Microsoft
        # published. No-op when already current, so the diff gate below decides
        # whether a PR is opened.
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |-
          set -euo pipefail
          release_file=.github/workflows/release.yml
          current=$(grep -oP 'WINGETCREATE_VERSION:\s*\K\S+' "$release_file")
          latest=$(gh api repos/microsoft/winget-create/releases/latest --jq .tag_name)
          # latest is interpolated into the sed below, so reject anything but a
          # vX.Y... tag: a sed metachar (&, |, \) in the tag must never reach it.
          if [[ ! "$latest" =~ ^v[0-9.]+$ ]]; then
            echo "Unexpected winget-create tag '$latest'" >&2
            exit 1
          fi
          if [ "$current" = "$latest" ]; then
            echo "wingetcreate already pinned to $current"
            exit 0
          fi
          echo "Bumping wingetcreate $current -> $latest"
          url="https://github.com/microsoft/winget-create/releases/download/${latest}/wingetcreate.exe.txt"
          sha=$(curl -fsSL "$url" | iconv -f UTF-16 -t UTF-8 | tr -dc '0-9A-Fa-f')
          if [ "${#sha}" -ne 64 ]; then
            echo "Unexpected SHA256 length ${#sha} from ${url}" >&2
            exit 1
          fi
          sed -i -E "s|(WINGETCREATE_VERSION: ).*|\1${latest}|" "$release_file"
          sed -i -E "s|(WINGETCREATE_SHA256: ).*|\1${sha}|" "$release_file"

      - name: Check for changes
        id: check_diff
        run: |-
          if git diff --quiet; then
            echo "changed=false" >> $GITHUB_OUTPUT
          else
            echo "changed=true" >> $GITHUB_OUTPUT
          fi

      - name: Generate token
        if: steps.check_diff.outputs.changed == 'true'
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        id: generate-token
        with:
          client-id: ${{ secrets.AUTH_APP_CLIENT_ID }}
          private-key: ${{ secrets.AUTH_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write
          # The wingetcreate step edits release.yml, and GitHub rejects an App push
          # touching .github/workflows/ without this.
          permission-workflows: write

      - name: Create PR with updated deps and linters
        if: steps.check_diff.outputs.changed == 'true'
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
        with:
          token: ${{ steps.generate-token.outputs.token }}
          commit-message: "chore: refresh dependencies and linters"
          title: "chore: refresh dependencies and linters"
          body: |-
            Automated dependency and linter refresh:
            - Ran `cargo update`
            - Ran `prek autoupdate --cooldown-days 7`
            - Checked the pinned `wingetcreate` version against the latest `winget-create` release

            If the `wingetcreate` pin changed, verify the version and SHA256 against
            https://github.com/microsoft/winget-create/releases/latest before merging.
          branch: bot/update-deps-and-linters
          author: GitHub Actions <actions@github.com>
          delete-branch: true