From 35326a0e339bbbc60f6867c39a8c1ac775aaa5f1 Mon Sep 17 00:00:00 2001
From: kawaiipunk <kawaiipunk@posteo.net>
Date: Thu, 13 Aug 2026 01:20:42 +0200
Subject: [PATCH] Add automated upstream update workflow

update-version.sh bumps the pinned Patchwork release: it fetches the latest
upstream tag, downloads both tar.gz assets, updates versions.sh, the manifest
and the metainfo, then self-validates with check-versions.sh. A daily cron
workflow commits the bump and opens a PR labeled automerge; the CI workflow
builds the Flatpak in the freedesktop-24.08 container and auto-merges the PR
once the checks pass.
---
 .github/workflows/build.yml  |  63 +++++++++++++++++++++
 .github/workflows/update.yml |  67 ++++++++++++++++++++++
 README.md                    |  21 +++++++
 update-version.sh            | 107 +++++++++++++++++++++++++++++++++++
 4 files changed, 258 insertions(+)
 create mode 100644 .github/workflows/build.yml
 create mode 100644 .github/workflows/update.yml
 create mode 100755 update-version.sh

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..89a5887
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,63 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Validate scripts and pinned versions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Shell syntax check
+        run: bash -n build.sh check-versions.sh update-version.sh versions.sh
+      - name: Validate pinned versions
+        run: ./check-versions.sh
+
+  build:
+    name: Build Flatpak
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/flathub-infra/flatpak-github-actions:freedesktop-24.08
+      options: --privileged
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Electron base app
+        run: |
+          flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+          flatpak install -y flathub org.electronjs.Electron2.BaseApp//24.08
+      - uses: flatpak/flatpak-github-actions/flatpak-builder@v6
+        with:
+          bundle: patchwork.flatpak
+          manifest-path: nz.scuttlebutt.Patchwork.yaml
+          verbose: true
+
+  merge:
+    name: Auto-merge update PR
+    runs-on: ubuntu-latest
+    needs: [check, build]
+    if: |
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.state == 'open' &&
+      github.event.pull_request.user.login == 'github-actions[bot]' &&
+      contains(github.event.pull_request.labels.*.name, 'automerge') &&
+      (github.event.pull_request.mergeable_state == 'clean' ||
+       github.event.pull_request.mergeable_state == 'behind')
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Update branch if behind
+        if: github.event.pull_request.mergeable_state == 'behind'
+        run: gh pr update-branch "${{ github.event.pull_request.number }}"
+      - name: Merge
+        run: gh pr merge --squash --delete-branch "${{ github.event.pull_request.number }}"
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
new file mode 100644
index 0000000..1784f8e
--- /dev/null
+++ b/.github/workflows/update.yml
@@ -0,0 +1,67 @@
+name: Update upstream release
+
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: update-patchwork
+  cancel-in-progress: true
+
+jobs:
+  update:
+    name: Bump to latest Patchwork release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Update pinned version
+        run: ./update-version.sh
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet; then
+            echo "No upstream changes."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Open pull request
+        if: steps.changes.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          source ./versions.sh
+          BRANCH="update-patchwork-${APP_VERSION}"
+          if git ls-remote --exit-code --heads origin "${BRANCH}" >/dev/null 2>&1; then
+            echo "Branch ${BRANCH} already exists (a PR is probably open); nothing to do."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -b "${BRANCH}"
+          git add versions.sh nz.scuttlebutt.Patchwork.yaml nz.scuttlebutt.Patchwork.metainfo.xml
+          git commit -m "Update Patchwork to ${APP_VERSION}"
+          git push -u origin "${BRANCH}"
+          BODY=$(cat <<EOF
+          Bump the pinned Patchwork (Poncho Wonky) release to **${APP_VERSION}**.
+
+          - x86_64 sha256: \`${APP_SHA256_X86_64}\`
+          - aarch64 sha256: \`${APP_SHA256_AARCH64}\`
+
+          See https://github.com/soapdog/patchwork/releases/tag/v${APP_VERSION}
+
+          CI builds the manifest and this PR auto-merges once the checks pass.
+          EOF
+          )
+          gh pr create --label automerge \
+            --title "Update Patchwork to ${APP_VERSION}" \
+            --body "$BODY"
diff --git a/README.md b/README.md
index 04b35d0..fee3e26 100644
--- a/README.md
+++ b/README.md
@@ -99,6 +99,27 @@ To bump the Flatpak environment, update `RUNTIME_VERSION` in `versions.sh` (used
 for the freedesktop runtime, SDK and Electron BaseApp — they always move
 together).
 
+## Automated updates
+
+`update-version.sh` performs the app-version bump above automatically: it
+fetches the latest upstream release, downloads both `tar.gz` assets to compute
+their sha256, and updates `versions.sh`, the manifest and the metainfo
+(including the release date). Run it locally with `--dry-run` to preview, or
+plain to apply (requires `curl` and `jq`).
+
+Two GitHub Actions drive the workflow:
+
+- **`.github/workflows/update.yml`** — on a daily schedule (or
+  `workflow_dispatch`) runs `update-version.sh`, commits the bump as
+  `github-actions[bot]`, pushes a branch and opens a PR labeled `automerge`.
+- **`.github/workflows/build.yml`** — on every PR and push to `main` validates
+  the shell scripts and pinned versions, then builds the Flatpak in the
+  `freedesktop-24.08` Flathub CI container (installing the Electron BaseApp
+  first). A `merge` job auto-merges the bump PR with `--squash` once both jobs
+  pass; if the build fails the PR stays open for manual review.
+
+Runtime bumps are never automated — only the app version is.
+
 ## Notes
 
 - **Why `tar.gz` and not the AppImage?** The upstream `tar.gz` assets are the
diff --git a/update-version.sh b/update-version.sh
new file mode 100755
index 0000000..33d3e92
--- /dev/null
+++ b/update-version.sh
@@ -0,0 +1,107 @@
+#!/bin/bash
+# Update the pinned Patchwork (Poncho Wonky) release to the latest upstream
+# release, touching versions.sh, the manifest and the metainfo. Does not touch
+# RUNTIME_VERSION (runtime bumps stay manual).
+#
+# Usage: ./update-version.sh [--dry-run]
+
+set -euo pipefail
+cd "$(dirname "$0")"
+
+DRY_RUN=0
+if [ "${1:-}" = "--dry-run" ]; then
+  DRY_RUN=1
+fi
+
+VERSIONS="versions.sh"
+MANIFEST="nz.scuttlebutt.Patchwork.yaml"
+METAINFO="nz.scuttlebutt.Patchwork.metainfo.xml"
+UPSTREAM="soapdog/patchwork"
+API="https://api.github.com/repos/${UPSTREAM}/releases/latest"
+
+for cmd in curl jq; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "error: '$cmd' is required but not installed." >&2
+    exit 1
+  fi
+done
+
+source "$VERSIONS"
+
+echo "Fetching latest release from ${UPSTREAM}..."
+JSON=$(curl -fsSL "$API") || {
+  echo "error: failed to fetch ${API}" >&2
+  exit 1
+}
+
+TAG=$(printf '%s' "$JSON" | jq -r '.tag_name')
+NEW_VERSION=${TAG#v}
+NEW_DATE=$(printf '%s' "$JSON" | jq -r '.published_at' | cut -dT -f1)
+
+X86_URL=$(printf '%s' "$JSON" | jq -r --arg n "ponchowonky-${NEW_VERSION}.tar.gz" \
+  '.assets[] | select(.name == $n) | .browser_download_url')
+ARM_URL=$(printf '%s' "$JSON" | jq -r --arg n "ponchowonky-${NEW_VERSION}-arm64.tar.gz" \
+  '.assets[] | select(.name == $n) | .browser_download_url')
+
+if [ -z "$X86_URL" ] || [ -z "$ARM_URL" ]; then
+  echo "error: could not find both tar.gz assets for ${TAG}." >&2
+  exit 1
+fi
+
+if [ "$NEW_VERSION" = "$APP_VERSION" ]; then
+  echo "Already up to date (${APP_VERSION})."
+  exit 0
+fi
+if [ "$(printf '%s\n%s\n' "$APP_VERSION" "$NEW_VERSION" | sort -V | head -1)" = "$NEW_VERSION" ]; then
+  echo "Latest upstream (${NEW_VERSION}) is not newer than current (${APP_VERSION}); nothing to do."
+  exit 0
+fi
+
+echo "New version: ${NEW_VERSION} (published ${NEW_DATE})"
+
+if [ "$DRY_RUN" = 1 ]; then
+  echo "dry-run: would update ${APP_VERSION} -> ${NEW_VERSION}"
+  echo "  x86_64:  ${X86_URL}"
+  echo "  aarch64: ${ARM_URL}"
+  exit 0
+fi
+
+OLD_VERSION=$APP_VERSION
+OLD_X86_SHA=$APP_SHA256_X86_64
+OLD_ARM_SHA=$APP_SHA256_AARCH64
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+echo "Downloading x86_64 asset..."
+curl -fsSL -o "$TMPDIR/x86_64.tar.gz" "$X86_URL"
+echo "Downloading aarch64 asset..."
+curl -fsSL -o "$TMPDIR/aarch64.tar.gz" "$ARM_URL"
+
+X86_SHA=$(sha256sum "$TMPDIR/x86_64.tar.gz" | cut -d' ' -f1)
+ARM_SHA=$(sha256sum "$TMPDIR/aarch64.tar.gz" | cut -d' ' -f1)
+
+# Update manifest asset URLs (one pattern covers both the x86_64 and arm64 URLs).
+sed -i "s|/v${OLD_VERSION}/ponchowonky-${OLD_VERSION}|/v${NEW_VERSION}/ponchowonky-${NEW_VERSION}|g" \
+  "$MANIFEST"
+# Update manifest checksums.
+sed -i "s|sha256: ${OLD_X86_SHA}|sha256: ${X86_SHA}|" "$MANIFEST"
+sed -i "s|sha256: ${OLD_ARM_SHA}|sha256: ${ARM_SHA}|" "$MANIFEST"
+
+# Update versions.sh.
+sed -i "s|^export APP_VERSION=.*|export APP_VERSION=\"${NEW_VERSION}\"|" "$VERSIONS"
+sed -i "s|^export APP_SHA256_X86_64=.*|export APP_SHA256_X86_64=\"${X86_SHA}\"|" "$VERSIONS"
+sed -i "s|^export APP_SHA256_AARCH64=.*|export APP_SHA256_AARCH64=\"${ARM_SHA}\"|" "$VERSIONS"
+
+# Insert a new <release> at the top of <releases> (AppStream requires newest-first).
+sed -i "/^  <releases>$/a\\    <release version=\"${NEW_VERSION}\" date=\"${NEW_DATE}\"/>" \
+  "$METAINFO"
+
+# Self-validate.
+./check-versions.sh
+
+echo
+echo "Updated Patchwork to ${NEW_VERSION}."
+echo "  x86_64:  ${X86_SHA}"
+echo "  aarch64: ${ARM_SHA}"
+echo "Changed versions.sh, ${MANIFEST} and ${METAINFO}. Commit the changes."