update-flake-hash.yml

name: Update Flake Hash on Release

on:
  workflow_run:
    workflows: ["Build WinBoat"]
    types:
      - completed
    branches:
      - main
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to update (e.g., 0.8.1)'
        required: true

jobs:
  update-hash:
    runs-on: ubuntu-latest
    # Only run if the workflow succeeded and was triggered by a tag
    if: |
      github.event.workflow_run.conclusion == 'success' &&
      startsWith(github.event.workflow_run.head_branch, 'refs/tags/')
    permissions:
      contents: write
      
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: true

      - name: Set up Nix
        uses: cachix/install-nix-action@v16
        with:
          nix_path: nixpkgs=channel:nixos-25.05

      - name: Calculate SHA256 hash
        id: calculate-hash
        uses: workflow/nix-shell-action@v3
        with:
          packages: nix
          script: |
            set -euo pipefail

            if [ "${{ github.event_name }}" = "workflow_run" ]; then
              # Extract version from the tag ref (refs/tags/v0.8.7 -> v0.8.7)
              VERSION="${{ github.event.workflow_run.head_branch }}"
              VERSION="${VERSION#refs/tags/}"
            else
              # Manual workflow_dispatch trigger
              VERSION="${{ inputs.version }}"
            fi

            VERSION="${VERSION#v}"

            URL="https://github.com/TibixDev/winboat/releases/download/v${VERSION}/winboat-${VERSION}-x64.tar.gz"

            echo "Checking if release asset is available..."
            for i in {1..30}; do
              if curl --head --fail "$URL" &>/dev/null; then
                echo "✓ Release asset is available"
                break
              fi
              if [ $i -eq 30 ]; then
                echo "✗ Release asset not available after 5 minutes"
                exit 1
              fi
              echo "Waiting for asset... (attempt $i/30)"
              sleep 10
            done
            
            echo "Prefetching from: $URL"
            HASH=$(nix-prefetch-url "$URL")

            echo "Calculated SHA256: $HASH"
            echo "nix_sha256=${HASH}" >> $GITHUB_OUTPUT

            ESC_HASH=$(printf '%s' "$HASH" | sed -e 's/[\/&]/\\&/g')

            git config user.name "github-actions[bot]"
            echo "set user.name to github-actions[bot]"
            git config user.email "github-actions[bot]@users.noreply.github.com"
            echo "set user.email to github-actions[bot]@users.noreply.github.com"

            git fetch origin main
            git merge --no-edit -X theirs origin/main

            sed -i "s/sha256 = \".*\";/sha256 = \"${ESC_HASH}\";/" flake.nix


            git add flake.nix || true
            git commit -m "chore: update flake.nix for version ${VERSION}" || echo "No changes to commit"
            git push origin HEAD:main || echo "Push failed"
            
            # Also update the tag with the corrected flake hash
            if [ "${{ github.event_name }}" = "release" ]; then
              TAG="${{ github.event.release.tag_name }}"
              echo "Updating tag ${TAG} with corrected flake hash"
              git tag -f "${TAG}" HEAD
              git push -f origin "${TAG}" || echo "Failed to update tag"
            fi