deploy-tap.yml

name: Deploy Homebrew Tap

on:
  # Test formula on PRs (audit only, don't deploy)
  pull_request:
    branches: [ master ]
    paths:
      - 'packaging/homebrew/mfc.rb'
      - 'packaging/homebrew/README.md'
  # Deploy to tap on push to master (only when formula files changed)
  push:
    branches: [ master ]
    paths:
      - 'packaging/homebrew/mfc.rb'
      - 'packaging/homebrew/README.md'
  # Note: tag releases are deployed to the tap by homebrew-release.yml, not here.
  workflow_dispatch:

permissions:
  contents: read

jobs:
  deploy-tap:
    name: Audit and deploy formula
    runs-on: macos-14
    permissions:
      contents: write
      pull-requests: write
    environment:
      name: homebrew
      url: https://github.com/MFlowCode/homebrew-mfc
    steps:
      - name: Checkout MFC repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Determine event metadata
        id: meta
        run: |
          set -euo pipefail
          EVENT_NAME="${{ github.event_name }}"
          REF_NAME="${{ github.ref_name }}"
          
          if [[ "${GITHUB_REF_TYPE:-}" == "tag" ]]; then
            # Manual dispatch from a tag ref
            VERSION="${REF_NAME#v}"
            URL="https://github.com/${{ github.repository }}/archive/refs/tags/v${VERSION}.tar.gz"
          else
            # Extract URL from current formula to re-audit and sync
            URL="$(grep -Eo 'https://github.com/[^"]+/archive/refs/tags/v[0-9]+\.[0-9]+\.[0-9]+\.tar\.gz' packaging/homebrew/mfc.rb | tail -n 1)"
            VERSION="$(echo "${URL}" | sed -E 's/.*v([0-9]+\.[0-9]+\.[0-9]+)\.tar\.gz/\1/')"
          fi
          
          SHASUM="$(curl -sL "${URL}" | shasum -a 256 | awk '{print $1}')"
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "url=${URL}" >> $GITHUB_OUTPUT
          echo "sha256=${SHASUM}" >> $GITHUB_OUTPUT
          echo "Event: ${EVENT_NAME}" >> $GITHUB_STEP_SUMMARY
          echo "Version: ${VERSION}" >> $GITHUB_STEP_SUMMARY
          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
            echo "Mode: Audit only (PR)" >> $GITHUB_STEP_SUMMARY
          else
            echo "Mode: Audit and deploy" >> $GITHUB_STEP_SUMMARY
          fi

      - name: Update formula (for tag events)
        if: github.ref_type == 'tag'
        run: |
          /usr/bin/sed -i '' "s@^  url \".*\"@  url \"${{ steps.meta.outputs.url }}\"@" packaging/homebrew/mfc.rb
          /usr/bin/sed -i '' "s@^  sha256 \".*\"@  sha256 \"${{ steps.meta.outputs.sha256 }}\"@" packaging/homebrew/mfc.rb

      - name: Setup Homebrew
        uses: Homebrew/actions/setup-homebrew@main

      - name: Audit/style formula before pushing
        run: |
          brew style packaging/homebrew/mfc.rb
          # Create temporary tap to audit the formula
          brew tap-new mfc/local
          brew trust mfc/local
          cp packaging/homebrew/mfc.rb "$(brew --repository)/Library/Taps/mfc/homebrew-local/Formula/mfc.rb"
          brew audit --online --strict --new --except=homepage mfc/local/mfc || brew audit --online mfc/local/mfc
          brew untap mfc/local

      - name: Clone or bootstrap tap repository
        if: github.event_name != 'pull_request'
        env:
          TAP_TOKEN: ${{ secrets.TAP_REPO_TOKEN }}
        run: |
          set -euo pipefail
          REPO="https://x-access-token:${TAP_TOKEN}@github.com/MFlowCode/homebrew-mfc.git"
          if git ls-remote "${REPO}" HEAD >/dev/null 2>&1; then
            git clone "${REPO}" tap-repo
          else
            # Repo exists but might be empty; fall back to bootstrap
            mkdir -p tap-repo
            cd tap-repo
            git init -b main
            git remote add origin "${REPO}"
            touch .keep
            git add .keep
            git -c user.name="github-actions[bot]" -c user.email="github-actions[bot]@users.noreply.github.com" commit -m "Initialize tap"
            git push -u origin main
          fi

      - name: Copy formula and README into tap
        id: merge
        if: github.event_name != 'pull_request'
        run: |
          set -euo pipefail
          mkdir -p tap-repo/Formula
          SRC=packaging/homebrew/mfc.rb
          TAP=tap-repo/Formula/mfc.rb
          get_ver() { grep -Eo '/archive/refs/tags/v[0-9]+\.[0-9]+\.[0-9]+\.tar\.gz' "$1" | head -n 1 | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+'; }
          MERGED="$(mktemp)"
          cp "${SRC}" "${MERGED}"
          if [[ -f "${TAP}" ]]; then
            SRC_VER="$(get_ver "${SRC}" || true)"
            TAP_VER="$(get_ver "${TAP}" || true)"
            # homebrew-release.yml bumps the tap directly on releases, so the in-repo
            # formula can lag behind. Never downgrade: if the tap pins a newer release,
            # keep the tap's url/sha256 while still syncing the rest of the formula.
            if [[ -n "${SRC_VER}" && -n "${TAP_VER}" && "${SRC_VER}" != "${TAP_VER}" ]] \
               && [[ "$(printf '%s\n%s\n' "${SRC_VER}" "${TAP_VER}" | sort -V | tail -n 1)" == "${TAP_VER}" ]]; then
              TAP_URL_LINE="$(grep -E '^  url ' "${TAP}")"
              TAP_SHA_LINE="$(grep -E '^  sha256 "' "${TAP}" | head -n 1)"
              awk -v url="${TAP_URL_LINE}" -v sha="${TAP_SHA_LINE}" \
                '/^  url / { print url; next } /^  sha256 "/ { print sha; next } { print }' \
                "${SRC}" > "${MERGED}"
            fi
            # If the pinned release is unchanged, keep the tap's existing bottle block so a
            # formula-only push to master doesn't delete bottles already built for this version.
            if [[ "$(grep -E '^  url ' "${MERGED}")" == "$(grep -E '^  url ' "${TAP}")" ]] && grep -q '^  bottle do' "${TAP}"; then
              awk '/^  bottle do/,/^  end$/' "${TAP}" > /tmp/bottle.block
              awk '{ print } /^  head / { print ""; while ((getline line < "/tmp/bottle.block") > 0) print line }' \
                "${MERGED}" > "${MERGED}.tmp" && mv "${MERGED}.tmp" "${MERGED}"
            fi
          fi
          mv "${MERGED}" "${TAP}"
          cp packaging/homebrew/README.md tap-repo/README.md
          echo "version=$(get_ver "${TAP}" || true)" >> "$GITHUB_OUTPUT"

      - name: Commit & push if changed
        if: github.event_name != 'pull_request'
        env:
          TAP_TOKEN: ${{ secrets.TAP_REPO_TOKEN }}
        run: |
          cd tap-repo
          git add Formula/mfc.rb README.md
          if git diff --cached --quiet; then
            echo "No changes in Formula/mfc.rb or README.md; skipping push."
            exit 0
          fi
          git -c user.name="github-actions[bot]" -c user.email="github-actions[bot]@users.noreply.github.com" \
            commit -m "mfc: v${{ steps.merge.outputs.version || steps.meta.outputs.version }}"
          git push origin HEAD:main