name: Homebrew Cask Update

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to bump, for example 1.0.14. Defaults to the latest stable release."
        required: false
        type: string

permissions:
  contents: read

jobs:
  bump-official-cask:
    name: Open Homebrew cask bump PR
    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
    runs-on: macos-26
    timeout-minutes: 15

    steps:
      - name: Resolve release metadata
        id: release
        env:
          GH_TOKEN: ${{ github.token }}
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          if [[ -n "$INPUT_VERSION" ]]; then
            TAG="v${INPUT_VERSION#v}"
            release="$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}")"
          else
            release="$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest")"
          fi

          if [[ -z "$release" || "$release" == "null" ]]; then
            echo "No stable release found." >&2
            exit 1
          fi

          TAG="$(printf '%s' "$release" | jq -r '.tag_name')"
          VERSION="${TAG#v}"
          DOWNLOAD_URL="$(printf '%s' "$release" | jq -r \
            '.assets[] | select(.name == "MacTools.dmg") | .browser_download_url')"
          SHA256_URL="$(printf '%s' "$release" | jq -r \
            '.assets[] | select(.name == "MacTools.sha256") | .browser_download_url')"

          if [[ -z "$DOWNLOAD_URL" || "$DOWNLOAD_URL" == "null" ]]; then
            echo "MacTools.dmg asset not found in release ${TAG}." >&2
            exit 1
          fi

          if [[ -z "$SHA256_URL" || "$SHA256_URL" == "null" ]]; then
            echo "MacTools.sha256 asset not found in release ${TAG}." >&2
            exit 1
          fi

          SHA256="$(curl -fsSL "$SHA256_URL" | awk '{ print $1; exit }')"
          if [[ ! "$SHA256" =~ ^[0-9a-fA-F]{64}$ ]]; then
            echo "Invalid SHA256 read from ${SHA256_URL}: ${SHA256}" >&2
            exit 1
          fi

          {
            echo "tag=$TAG"
            echo "version=$VERSION"
            echo "sha256=$SHA256"
          } >> "$GITHUB_OUTPUT"

      - name: Check official cask version
        id: cask
        env:
          HOMEBREW_NO_INSTALL_FROM_API: 1
        run: |
          brew update
          current="$(brew info --cask --json=v2 mactools | jq -r '.casks[0].version')"
          latest="${{ steps.release.outputs.version }}"

          {
            echo "current=$current"
            echo "latest=$latest"
            if [[ "$current" == "$latest" ]]; then
              echo "up_to_date=true"
            else
              echo "up_to_date=false"
            fi
          } >> "$GITHUB_OUTPUT"

      - name: Open Homebrew/homebrew-cask bump PR
        if: steps.cask.outputs.up_to_date == 'false'
        env:
          HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
          HOMEBREW_NO_INSTALL_FROM_API: 1
        run: |
          if [[ -z "$HOMEBREW_GITHUB_API_TOKEN" ]]; then
            echo "Missing HOMEBREW_GITHUB_API_TOKEN secret. Create a GitHub token with public_repo access." >&2
            exit 1
          fi

          brew bump-cask-pr mactools \
            --version "${{ steps.release.outputs.version }}" \
            --sha256 "${{ steps.release.outputs.sha256 }}" \
            --no-browse

      - name: Already up to date
        if: steps.cask.outputs.up_to_date == 'true'
        run: |
          echo "Official Homebrew cask is already at version ${{ steps.cask.outputs.current }}."