release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

env:
  SQLITE_VERSION: "3490100"
  SQLITE_YEAR: "2025"
  ZIG_VERSION: "0.15.0"

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux — statically linked via musl, no system dependencies
          - target: x86_64-linux-musl
            asset: sql-pipe-x86_64-linux
            ext: ""
          - target: aarch64-linux-musl
            asset: sql-pipe-aarch64-linux
            ext: ""
          - target: arm-linux-musleabihf
            asset: sql-pipe-armv7-linux
            ext: ""
          - target: riscv64-linux-musl
            asset: sql-pipe-riscv64-linux
            ext: ""
          - target: x86-linux-musl
            asset: sql-pipe-x86-linux
            ext: ""
          # macOS — Zig bundles the macOS SDK for cross-compilation
          - target: x86_64-macos
            asset: sql-pipe-x86_64-macos
            ext: ""
          - target: aarch64-macos
            asset: sql-pipe-aarch64-macos
            ext: ""
          # Windows — MinGW ABI, no MSVC required
          - target: x86_64-windows-gnu
            asset: sql-pipe-x86_64-windows
            ext: ".exe"
          - target: aarch64-windows-gnu
            asset: sql-pipe-aarch64-windows
            ext: ".exe"
          - target: x86-windows-gnu
            asset: sql-pipe-x86-windows
            ext: ".exe"
          # FreeBSD — Zig bundles libc headers for cross-compilation
          - target: x86_64-freebsd
            asset: sql-pipe-x86_64-freebsd
            ext: ""
          - target: aarch64-freebsd
            asset: sql-pipe-aarch64-freebsd
            ext: ""
          # NetBSD
          - target: x86_64-netbsd
            asset: sql-pipe-x86_64-netbsd
            ext: ""
          - target: aarch64-netbsd
            asset: sql-pipe-aarch64-netbsd
            ext: ""

    steps:
      - uses: actions/checkout@v6

      - name: Set up Zig
        uses: mlugg/setup-zig@v2
        with:
          version: ${{ env.ZIG_VERSION }}

      - name: Install scdoc (to generate man page)
        run: |
          sudo apt-get update
          sudo apt-get install -y scdoc

      - name: Download SQLite amalgamation
        run: |
          mkdir -p lib
          curl -fsSL "https://www.sqlite.org/${{ env.SQLITE_YEAR }}/sqlite-amalgamation-${{ env.SQLITE_VERSION }}.zip" -o sqlite.zip
          unzip -j sqlite.zip "*/sqlite3.c" "*/sqlite3.h" -d lib/
          echo "SQLite $(grep -m1 SQLITE_VERSION lib/sqlite3.h | awk '{print $3}')"

      - name: Build
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          zig build \
            -Dbundle-sqlite=true \
            -Dtarget=${{ matrix.target }} \
            -Doptimize=ReleaseSafe \
            -Dversion="$VERSION"

      - name: Generate man page
        run: zig build man

      - name: Stage artifact
        run: |
          mkdir -p dist
          cp zig-out/bin/sql-pipe${{ matrix.ext }} dist/${{ matrix.asset }}${{ matrix.ext }}
          # Include man page (generated the same way for all targets)
          if [ -f zig-out/share/man/man1/sql-pipe.1.gz ]; then
            cp zig-out/share/man/man1/sql-pipe.1.gz dist/sql-pipe.1.gz
          fi

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.asset }}
          path: dist/
          if-no-files-found: error

  release:
    name: Attach assets to release
    needs: build
    if: ${{ always() && needs.build.result != 'cancelled' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts/
          merge-multiple: true

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if gh release view "${{ github.ref_name }}" --repo "${{ github.repository }}" > /dev/null 2>&1; then
            gh release edit "${{ github.ref_name }}" --draft=false \
              --repo "${{ github.repository }}"
            gh release upload "${{ github.ref_name }}" artifacts/* \
              --repo "${{ github.repository }}" \
              --clobber
          else
            gh release create "${{ github.ref_name }}" \
              --title "${{ github.ref_name }}" \
              --generate-notes \
              --repo "${{ github.repository }}" \
              artifacts/*
          fi

  # ── Update Homebrew tap ─────────────────────────────────────────────
  # Requires:
  #   1. Repository: vmvarela/homebrew-tap (with a Formula/ directory)
  #   2. Secret: HOMEBREW_TAP_TOKEN (PAT with contents:write on the tap repo)
  update-homebrew:
    name: Update Homebrew tap
    needs: release
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts/
          merge-multiple: true

      - name: Generate formula and push to tap
        env:
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"

          SHA_MACOS_ARM64=$(sha256sum artifacts/sql-pipe-aarch64-macos | awk '{print $1}')
          SHA_MACOS_X64=$(sha256sum artifacts/sql-pipe-x86_64-macos   | awk '{print $1}')
          SHA_LINUX_ARM64=$(sha256sum artifacts/sql-pipe-aarch64-linux | awk '{print $1}')
          SHA_LINUX_X64=$(sha256sum artifacts/sql-pipe-x86_64-linux   | awk '{print $1}')

          cat > sql-pipe.rb <<'FORMULA'
          class SqlPipe < Formula
            desc "Read CSV from stdin, query with SQL, write CSV to stdout"
            homepage "https://github.com/vmvarela/sql-pipe"
            version "__VERSION__"
            license "MIT"

            on_macos do
              on_arm do
                url "https://github.com/vmvarela/sql-pipe/releases/download/v__VERSION__/sql-pipe-aarch64-macos"
                sha256 "__SHA_MACOS_ARM64__"
              end
              on_intel do
                url "https://github.com/vmvarela/sql-pipe/releases/download/v__VERSION__/sql-pipe-x86_64-macos"
                sha256 "__SHA_MACOS_X64__"
              end
            end

            on_linux do
              on_arm do
                url "https://github.com/vmvarela/sql-pipe/releases/download/v__VERSION__/sql-pipe-aarch64-linux"
                sha256 "__SHA_LINUX_ARM64__"
              end
              on_intel do
                url "https://github.com/vmvarela/sql-pipe/releases/download/v__VERSION__/sql-pipe-x86_64-linux"
                sha256 "__SHA_LINUX_X64__"
              end
            end

            def install
              bin.install Dir["sql-pipe*"].first => "sql-pipe"
            end

            test do
              assert_match "sql-pipe", shell_output("#{bin}/sql-pipe --version 2>&1")
            end
          end
          FORMULA

          # Substitute placeholders with actual values
          sed -i "s/__VERSION__/${VERSION}/g"               sql-pipe.rb
          sed -i "s/__SHA_MACOS_ARM64__/${SHA_MACOS_ARM64}/g" sql-pipe.rb
          sed -i "s/__SHA_MACOS_X64__/${SHA_MACOS_X64}/g"     sql-pipe.rb
          sed -i "s/__SHA_LINUX_ARM64__/${SHA_LINUX_ARM64}/g" sql-pipe.rb
          sed -i "s/__SHA_LINUX_X64__/${SHA_LINUX_X64}/g"     sql-pipe.rb

          echo "==> Generated formula for sql-pipe ${VERSION}:"
          cat sql-pipe.rb

          git clone "https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/vmvarela/homebrew-sql-pipe.git" tap
          mkdir -p tap/Formula
          cp sql-pipe.rb tap/Formula/sql-pipe.rb
          cd tap
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/sql-pipe.rb
          git diff --cached --quiet || git commit -m "sql-pipe ${VERSION}"
          git push

  # ── Update AUR package ──────────────────────────────────────────────
  # Requires:
  #   1. AUR package registered: https://aur.archlinux.org/packages/sql-pipe
  #   2. Secret: AUR_SSH_KEY (SSH private key authorized on AUR)
  update-aur:
    name: Update AUR package
    needs: release
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts/
          merge-multiple: true

      - name: Generate PKGBUILD
        run: |
          VERSION="${GITHUB_REF_NAME#v}"

          SHA_X86_64=$(sha256sum artifacts/sql-pipe-x86_64-linux  | awk '{print $1}')
          SHA_AARCH64=$(sha256sum artifacts/sql-pipe-aarch64-linux | awk '{print $1}')

          # Download LICENSE to compute its hash
          curl -fsSL "https://raw.githubusercontent.com/${{ github.repository }}/${GITHUB_REF_NAME}/LICENSE" -o LICENSE
          SHA_LICENSE=$(sha256sum LICENSE | awk '{print $1}')

          cat > PKGBUILD <<'PKGEOF'
          # Maintainer: vmvarela <vmvarela@gmail.com>
          pkgname=sql-pipe
          pkgver=__VERSION__
          pkgrel=1
          pkgdesc="Read CSV via stdin, run SQL, emit CSV via stdout"
          arch=('x86_64' 'aarch64')
          url="https://github.com/vmvarela/sql-pipe"
          license=('MIT')
          provides=("${pkgname}")
          conflicts=("${pkgname}")

          source=("LICENSE::https://raw.githubusercontent.com/vmvarela/sql-pipe/v${pkgver}/LICENSE")
          sha256sums=('__SHA_LICENSE__')

          source_x86_64=("${pkgname}-${pkgver}-x86_64::https://github.com/vmvarela/sql-pipe/releases/download/v${pkgver}/sql-pipe-x86_64-linux")
          sha256sums_x86_64=('__SHA_X86_64__')

          source_aarch64=("${pkgname}-${pkgver}-aarch64::https://github.com/vmvarela/sql-pipe/releases/download/v${pkgver}/sql-pipe-aarch64-linux")
          sha256sums_aarch64=('__SHA_AARCH64__')

          package() {
              install -Dm755 "${pkgname}-${pkgver}-${CARCH}" "${pkgdir}/usr/bin/${pkgname}"
              install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
          }
          PKGEOF

          # Substitute placeholders
          sed -i "s/__VERSION__/${VERSION}/g"         PKGBUILD
          sed -i "s/__SHA_LICENSE__/${SHA_LICENSE}/g"  PKGBUILD
          sed -i "s/__SHA_X86_64__/${SHA_X86_64}/g"   PKGBUILD
          sed -i "s/__SHA_AARCH64__/${SHA_AARCH64}/g" PKGBUILD

          echo "==> Generated PKGBUILD for sql-pipe ${VERSION}:"
          cat PKGBUILD

      - name: Publish to AUR
        uses: KSXGitHub/github-actions-deploy-aur@v4.1.1
        with:
          pkgname: sql-pipe
          pkgbuild: ./PKGBUILD
          commit_username: vmvarela
          commit_email: vmvarela@gmail.com
          ssh_private_key: ${{ secrets.AUR_SSH_KEY }}
          commit_message: "Update to ${{ github.ref_name }}"

  # ── Build and upload .deb packages ─────────────────────────────────
  # Generates Debian packages for amd64, arm64, arm7 and 386 using nfpm.
  # Each arch is independent — one failing arch does not block the others.
  package-deb:
    name: Package DEB (${{ matrix.goarch }})
    needs: release
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - goarch: amd64
            asset: sql-pipe-x86_64-linux
          - goarch: arm64
            asset: sql-pipe-aarch64-linux
          - goarch: arm7
            asset: sql-pipe-armv7-linux
          - goarch: "386"
            asset: sql-pipe-x86-linux

    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v6

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts/
          merge-multiple: true

      - name: Install nfpm
        run: |
          NFPM_VERSION=2.45.1
          curl -sfL -o /tmp/nfpm.tar.gz \
            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_x86_64.tar.gz"
          tar -xzf /tmp/nfpm.tar.gz -C /usr/local/bin nfpm

      - name: Stage files for packaging
        run: |
          mkdir -p pkg-work
          cp artifacts/${{ matrix.asset }}  pkg-work/sql-pipe
          chmod +x pkg-work/sql-pipe
          cp artifacts/sql-pipe.1.gz        pkg-work/sql-pipe.1.gz
          cp LICENSE                         pkg-work/LICENSE

      - name: Build .deb
        working-directory: pkg-work
        env:
          VERSION: ${{ github.ref_name }}
          GOARCH: ${{ matrix.goarch }}
        run: |
          VERSION="${VERSION#v}"
          mkdir -p dist
          VERSION="$VERSION" GOARCH="$GOARCH" \
            nfpm package -p deb \
              -f "$GITHUB_WORKSPACE/packaging/nfpm.yaml" \
              -t dist/

      - name: Upload .deb to GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        working-directory: pkg-work
        run: |
          gh release upload "${{ github.ref_name }}" dist/*.deb \
            --repo "${{ github.repository }}" \
            --clobber

  # ── Build and upload .rpm packages ─────────────────────────────────
  # Generates RPM packages for x86_64 and aarch64 using nfpm.
  # Each arch is independent — one failing arch does not block the other.
  package-rpm:
    name: Package RPM (${{ matrix.goarch }})
    needs: release
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - goarch: amd64
            asset: sql-pipe-x86_64-linux
          - goarch: arm64
            asset: sql-pipe-aarch64-linux

    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v6

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts/
          merge-multiple: true

      - name: Install nfpm
        run: |
          NFPM_VERSION=2.45.1
          curl -sfL -o /tmp/nfpm.tar.gz \
            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_x86_64.tar.gz"
          tar -xzf /tmp/nfpm.tar.gz -C /usr/local/bin nfpm

      - name: Stage files for packaging
        run: |
          mkdir -p pkg-work
          cp artifacts/${{ matrix.asset }}  pkg-work/sql-pipe
          chmod +x pkg-work/sql-pipe
          cp artifacts/sql-pipe.1.gz        pkg-work/sql-pipe.1.gz
          cp LICENSE                         pkg-work/LICENSE

      - name: Build .rpm
        working-directory: pkg-work
        env:
          VERSION: ${{ github.ref_name }}
          GOARCH: ${{ matrix.goarch }}
        run: |
          VERSION="${VERSION#v}"
          mkdir -p dist
          VERSION="$VERSION" GOARCH="$GOARCH" \
            nfpm package -p rpm \
              -f "$GITHUB_WORKSPACE/packaging/nfpm.yaml" \
              -t dist/

      - name: Upload .rpm to GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        working-directory: pkg-work
        run: |
          gh release upload "${{ github.ref_name }}" dist/*.rpm \
            --repo "${{ github.repository }}" \
            --clobber

  # ── Build and upload .apk packages ────────────────────────────────
  # Generates Alpine Linux packages for x86_64 and aarch64 using nfpm.
  # Each arch is independent — one failing arch does not block the other.
  package-apk:
    name: Package APK (${{ matrix.goarch }})
    needs: release
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - goarch: amd64
            asset: sql-pipe-x86_64-linux
          - goarch: arm64
            asset: sql-pipe-aarch64-linux

    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v6

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts/
          merge-multiple: true

      - name: Install nfpm
        run: |
          NFPM_VERSION=2.45.1
          curl -sfL -o /tmp/nfpm.tar.gz \
            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_x86_64.tar.gz"
          tar -xzf /tmp/nfpm.tar.gz -C /usr/local/bin nfpm

      - name: Stage files for packaging
        run: |
          mkdir -p pkg-work
          cp artifacts/${{ matrix.asset }}  pkg-work/sql-pipe
          chmod +x pkg-work/sql-pipe
          cp artifacts/sql-pipe.1.gz        pkg-work/sql-pipe.1.gz
          cp LICENSE                         pkg-work/LICENSE

      - name: Build .apk
        working-directory: pkg-work
        env:
          VERSION: ${{ github.ref_name }}
          GOARCH: ${{ matrix.goarch }}
        run: |
          VERSION="${VERSION#v}"
          mkdir -p dist
          VERSION="$VERSION" GOARCH="$GOARCH" \
            nfpm package -p apk \
              -f "$GITHUB_WORKSPACE/packaging/nfpm.yaml" \
              -t dist/

      - name: Upload .apk to GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        working-directory: pkg-work
        run: |
          gh release upload "${{ github.ref_name }}" dist/*.apk \
            --repo "${{ github.repository }}" \
            --clobber

  # ── Build and upload Chocolatey package ────────────────────────────
  # Creates a .nupkg for Windows (x86 + x86_64) and uploads it to the
  # GitHub Release. If CHOCOLATEY_API_KEY is set, also pushes to the
  # Chocolatey Community Repository.
  package-choco:
    name: Package Chocolatey
    needs: release
    runs-on: windows-latest
    permissions:
      contents: write
    env:
      HAS_CHOCO_KEY: ${{ secrets.CHOCOLATEY_API_KEY != '' }}

    steps:
      - uses: actions/checkout@v6

      - name: Download Windows artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts/
          merge-multiple: true

      - name: Build .nupkg
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $version = "${{ github.ref_name }}".TrimStart('v')

          # Compute checksums from the downloaded artifacts
          $checksumX86 = (Get-FileHash artifacts/sql-pipe-x86-windows.exe -Algorithm SHA256).Hash.ToLower()
          $checksumX64 = (Get-FileHash artifacts/sql-pipe-x86_64-windows.exe -Algorithm SHA256).Hash.ToLower()

          # Prepare working directory with package files
          $pkgDir = "choco-pkg"
          Copy-Item -Recurse packaging/chocolatey $pkgDir

          # Substitute version in .nuspec
          $nuspec = Join-Path $pkgDir "sql-pipe.nuspec"
          (Get-Content $nuspec -Raw) -replace '__VERSION__', $version | Set-Content $nuspec

          # Inject checksums into install script
          $install = Join-Path $pkgDir "tools/chocolateyInstall.ps1"
          (Get-Content $install -Raw) `
            -replace '\$env:CHECKSUM_X86', "'$checksumX86'" `
            -replace '\$env:CHECKSUM_X64', "'$checksumX64'" |
            Set-Content $install

          # Build the package
          choco pack $nuspec --outputdirectory $pkgDir
          Write-Host "==> Built package:"
          Get-ChildItem "$pkgDir/*.nupkg"

      - name: Upload .nupkg to GitHub Release
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $nupkg = Get-ChildItem "choco-pkg/*.nupkg" | Select-Object -First 1
          gh release upload "${{ github.ref_name }}" $nupkg.FullName `
            --repo "${{ github.repository }}" `
            --clobber

      - name: Push to Chocolatey Community Repository
        if: ${{ env.HAS_CHOCO_KEY == 'true' }}
        shell: pwsh
        env:
          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
        run: |
          $nupkg = Get-ChildItem "choco-pkg/*.nupkg" | Select-Object -First 1
          choco push $nupkg.FullName --source https://push.chocolatey.org/ --api-key $env:CHOCOLATEY_API_KEY

  # ── Update WinGet manifest ────────────────────────────────────────
  # Submits a PR to microsoft/winget-pkgs with updated manifest files.
  # Requires:
  #   1. At least one version already in microsoft/winget-pkgs (initial
  #      submission must be done manually via wingetcreate or PR)
  #   2. Fork of microsoft/winget-pkgs under the vmvarela account
  #   3. Secret: WINGET_GITHUB_TOKEN (classic PAT with public_repo scope)
  update-winget:
    name: Update WinGet manifest
    needs: release
    runs-on: ubuntu-latest
    env:
      HAS_WINGET_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN != '' }}
    steps:
      - name: Submit WinGet manifest
        if: ${{ env.HAS_WINGET_TOKEN == 'true' }}
        uses: vedantmgoyal9/winget-releaser@v2
        with:
          identifier: vmvarela.sql-pipe
          installers-regex: 'sql-pipe-.*-windows\.exe$'
          token: ${{ secrets.WINGET_GITHUB_TOKEN }}

  # ── Update Scoop bucket ──────────────────────────────────────────────
  # Pushes an updated Scoop manifest to the vmvarela/scoop-sql-pipe
  # bucket repository so Windows users can install via:
  #   scoop bucket add sql-pipe https://github.com/vmvarela/scoop-sql-pipe
  #   scoop install sql-pipe
  # Requires:
  #   1. Repository: vmvarela/scoop-sql-pipe (with sql-pipe.json at root)
  #   2. Secret: SCOOP_BUCKET_TOKEN (PAT with contents:write on the bucket repo)
  update-scoop:
    name: Update Scoop bucket
    needs: release
    runs-on: ubuntu-latest
    env:
      HAS_SCOOP_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN != '' }}
    steps:
      - name: Download Windows artifacts
        if: ${{ env.HAS_SCOOP_TOKEN == 'true' }}
        uses: actions/download-artifact@v8
        with:
          path: artifacts/
          merge-multiple: true

      - name: Generate manifest and push to bucket
        if: ${{ env.HAS_SCOOP_TOKEN == 'true' }}
        env:
          SCOOP_BUCKET_TOKEN: ${{ secrets.SCOOP_BUCKET_TOKEN }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"

          SHA_X64=$(sha256sum artifacts/sql-pipe-x86_64-windows.exe   | awk '{print $1}')
          SHA_X86=$(sha256sum artifacts/sql-pipe-x86-windows.exe      | awk '{print $1}')
          SHA_ARM64=$(sha256sum artifacts/sql-pipe-aarch64-windows.exe | awk '{print $1}')

          cat > sql-pipe.json <<MANIFEST
          {
              "version": "${VERSION}",
              "description": "Read CSV from stdin, query with SQL, write CSV to stdout",
              "homepage": "https://github.com/vmvarela/sql-pipe",
              "license": "MIT",
              "architecture": {
                  "64bit": {
                      "url": "https://github.com/vmvarela/sql-pipe/releases/download/v${VERSION}/sql-pipe-x86_64-windows.exe#/sql-pipe.exe",
                      "hash": "${SHA_X64}"
                  },
                  "32bit": {
                      "url": "https://github.com/vmvarela/sql-pipe/releases/download/v${VERSION}/sql-pipe-x86-windows.exe#/sql-pipe.exe",
                      "hash": "${SHA_X86}"
                  },
                  "arm64": {
                      "url": "https://github.com/vmvarela/sql-pipe/releases/download/v${VERSION}/sql-pipe-aarch64-windows.exe#/sql-pipe.exe",
                      "hash": "${SHA_ARM64}"
                  }
              },
              "bin": "sql-pipe.exe",
              "checkver": "github",
              "autoupdate": {
                  "architecture": {
                      "64bit": {
                          "url": "https://github.com/vmvarela/sql-pipe/releases/download/v\$version/sql-pipe-x86_64-windows.exe#/sql-pipe.exe"
                      },
                      "32bit": {
                          "url": "https://github.com/vmvarela/sql-pipe/releases/download/v\$version/sql-pipe-x86-windows.exe#/sql-pipe.exe"
                      },
                      "arm64": {
                          "url": "https://github.com/vmvarela/sql-pipe/releases/download/v\$version/sql-pipe-aarch64-windows.exe#/sql-pipe.exe"
                      }
                  },
                  "hash": {
                      "url": "https://github.com/vmvarela/sql-pipe/releases/download/v\$version/sha256sums.txt"
                  }
              }
          }
          MANIFEST

          echo "==> Generated Scoop manifest for sql-pipe ${VERSION}:"
          cat sql-pipe.json

          git clone "https://x-access-token:${SCOOP_BUCKET_TOKEN}@github.com/vmvarela/scoop-sql-pipe.git" bucket
          cp sql-pipe.json bucket/sql-pipe.json
          cd bucket
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add sql-pipe.json
          git diff --cached --quiet || git commit -m "sql-pipe ${VERSION}"
          git push

  # ── Generate final SHA256 checksums ────────────────────────────────
  # Runs after all packaging jobs so sha256sums.txt covers all assets:
  # binaries, man page, .deb, .rpm AND .nupkg packages.
  checksums:
    name: Generate SHA256 checksums
    needs: [release, package-deb, package-rpm, package-apk, package-choco]
    if: >-
      always()
      && needs.release.result == 'success'
      && (needs.package-deb.result == 'success' || needs.package-deb.result == 'skipped')
      && (needs.package-rpm.result == 'success' || needs.package-rpm.result == 'skipped')
      && (needs.package-apk.result == 'success' || needs.package-apk.result == 'skipped')
      && (needs.package-choco.result == 'success' || needs.package-choco.result == 'skipped')
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Download all release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p assets
          gh release download "${{ github.ref_name }}" \
            --repo "${{ github.repository }}" \
            --dir assets

      - name: Generate SHA256 checksums
        working-directory: assets
        run: |
          # Exclude any pre-existing sha256sums.txt to avoid self-referencing
          sha256sum $(ls | grep -v sha256sums.txt) | tee sha256sums.txt

      - name: Upload sha256sums.txt to GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${{ github.ref_name }}" assets/sha256sums.txt \
            --repo "${{ github.repository }}" \
            --clobber

  # ── Update Nix package versions ────────────────────────────────────
  # Updates packaging/nix/versions.json with the new release hashes and
  # opens a Pull Request so `nix run github:vmvarela/sql-pipe` always
  # points to the latest version.
  update-nix:
    name: Update Nix package
    needs: checksums
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v6
        with:
          ref: master

      - name: Update versions.json
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"

          # Download the checksums file generated by the previous job
          gh release download "${{ github.ref_name }}" \
            --repo "${{ github.repository }}" \
            --pattern sha256sums.txt \
            --dir .

          SHA_X64_LINUX=$(awk '$2 == "sql-pipe-x86_64-linux"   { print $1 }' sha256sums.txt)
          SHA_A64_LINUX=$(awk '$2 == "sql-pipe-aarch64-linux"  { print $1 }' sha256sums.txt)
          SHA_X64_MACOS=$(awk '$2 == "sql-pipe-x86_64-macos"   { print $1 }' sha256sums.txt)
          SHA_A64_MACOS=$(awk '$2 == "sql-pipe-aarch64-macos"  { print $1 }' sha256sums.txt)

          cat > packaging/nix/versions.json <<EOF
          {
            "x86_64-linux": {
              "url": "https://github.com/vmvarela/sql-pipe/releases/download/v${VERSION}/sql-pipe-x86_64-linux",
              "sha256": "${SHA_X64_LINUX}",
              "version": "${VERSION}"
            },
            "aarch64-linux": {
              "url": "https://github.com/vmvarela/sql-pipe/releases/download/v${VERSION}/sql-pipe-aarch64-linux",
              "sha256": "${SHA_A64_LINUX}",
              "version": "${VERSION}"
            },
            "x86_64-darwin": {
              "url": "https://github.com/vmvarela/sql-pipe/releases/download/v${VERSION}/sql-pipe-x86_64-macos",
              "sha256": "${SHA_X64_MACOS}",
              "version": "${VERSION}"
            },
            "aarch64-darwin": {
              "url": "https://github.com/vmvarela/sql-pipe/releases/download/v${VERSION}/sql-pipe-aarch64-macos",
              "sha256": "${SHA_A64_MACOS}",
              "version": "${VERSION}"
            }
          }
          EOF

          echo "==> Updated Nix versions.json for sql-pipe ${VERSION}:"
          cat packaging/nix/versions.json

      - name: Open Pull Request
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          BRANCH="chore/nix-update-${{ github.ref_name }}"
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git checkout -b "${BRANCH}"
          git add packaging/nix/versions.json
          git diff --cached --quiet && echo "No changes to commit." && exit 0
          git commit -m "chore(nix): update versions.json to ${{ github.ref_name }}"
          git push origin "${BRANCH}"
          gh pr create \
            --base master \
            --head "${BRANCH}" \
            --title "chore(nix): update versions.json to ${{ github.ref_name }}" \
            --body "Automated update of \`packaging/nix/versions.json\` hashes for release \`${{ github.ref_name }}\`." \
            --label "type:chore"