microsoft/PowerToys

name: Automatic New Issue Deduplication
on:
  issues:
    types: [opened, reopened]
permissions:
  models: read
  issues: write
concurrency:
  group: ${{ github.workflow }}-${{ github.event.issue.number }}
  cancel-in-progress: true
jobs:
  deduplicate:
    runs-on: ubuntu-latest
    steps:
      - name: Run Deduplicate Action
        uses: pelikhan/action-genai-issue-dedup@v0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          label_as_duplicate: true

# Dependency Review Action
#
# This Action will scan dependency manifest files that change as part of a Pull Request,
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
# Once installed, if the workflow run is marked as required,
# PRs introducing known-vulnerable packages will be blocked from merging.
#
# As recommended by Microsoft's security guidelines (https://docs.opensource.microsoft.com/security/tsg/actions/#requirements-for-security-hardening-your-own-github-actions), 
# 3rd-party actions should be pinned to a specific commit hash to prevent supply chain attacks. 
# This update aligns with best practices; 1st/2nd-party actions is not required hash pinning.
#
# Source repository: https://github.com/actions/dependency-review-action
name: 'Dependency Review'
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@v6
      - name: 'Dependency Review'
        uses: actions/dependency-review-action@v4

name: Manual Batch Issue Deduplication

on:
  workflow_dispatch:
    inputs:
      issue_numbers:
        description: "JSON array of issue numbers to deduplicate (e.g. [101,102,103])"
        required: true
      since:
        description: "Only compare against issues created after this date (ISO 8601, e.g. 2019-05-05T00:00:00Z)"
        required: false
        default: "2019-05-05T00:00:00Z"
      label_as_duplicate:
        description: "Apply duplicate label if duplicates are found (true/false)"
        required: false
        default: "true"

permissions:
  models: read
  issues: write

jobs:
  deduplicate:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        issue: ${{ fromJson(github.event.inputs.issue_numbers) }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Run GenAI Issue Deduplicator
        uses: pelikhan/action-genai-issue-dedup@v0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_issue: ${{ matrix.issue }}
          label_as_duplicate: ${{ github.event.inputs.label_as_duplicate }}
          

name: Store submission on release

on:
  workflow_dispatch:
  release:
    types: [published]

permissions:
  id-token: write

jobs:

  microsoft_store:
    name: Publish Microsoft Store
    environment: store
    runs-on: ubuntu-latest
    steps:
      - name: BODGY - Set up Gnome Keyring for future Cert Auth
        run: |-
          sudo apt-get update && sudo apt-get install -y gnome-keyring
          export $(dbus-launch --sh-syntax)
          export $(echo 'anypass_just_to_unlock' | gnome-keyring-daemon --unlock)
          export $(echo 'anypass_just_to_unlock' | gnome-keyring-daemon --start --components=gpg,pkcs11,secrets,ssh)

      - name: Log in to Azure
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          enable-AzPSSession: true

      - name: Get latest URL from public releases
        id: releaseVars
        run: |
          release=$(curl https://api.github.com/repos/Microsoft/PowerToys/releases | jq '[.[]|select(.name | contains("Release"))][0]')
          assets=$(jq -n "$release" | jq '.assets')
          powerToysSetup=$(jq -n "$assets" | jq '[.[]|select(.name | contains("PowerToysUserSetup"))]')
          echo powerToysInstallerX64Url=$(jq -n "$powerToysSetup" | jq -r '[.[]|select(.name | contains("x64"))][0].browser_download_url') >> $GITHUB_OUTPUT
          echo powerToysInstallerArm64Url=$(jq -n "$powerToysSetup" | jq -r '[.[]|select(.name | contains("arm64"))][0].browser_download_url') >> $GITHUB_OUTPUT

      - name: Setup .NET 9.0
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '9.0.x'

      - uses: microsoft/setup-msstore-cli@v1

      - name: Fetch Store Credential
        uses: azure/cli@v2
        with:
          azcliversion: latest
          inlineScript: |-
            az keyvault secret download --vault-name ${{ secrets.AZURE_KEYVAULT_NAME }} -n ${{ secrets.AZURE_AUTH_CERT_NAME }} -f cert.pfx.b64
            base64 -d < cert.pfx.b64 > cert.pfx

      - name: Configure Store Credentials
        run: |-
          msstore reconfigure -cfp cert.pfx -c ${{ secrets.AZURE_CLIENT_ID }} -t ${{ secrets.AZURE_TENANT_ID }} -s ${{ secrets.SELLER_ID }}

      - name: Update draft submission
        run: |-
          msstore submission update ${{ secrets.PRODUCT_ID }} '{
            "packages":[
                {
                  "packageUrl":"${{ steps.releaseVars.outputs.powerToysInstallerX64Url }}",
                  "languages":["zh-hans", "zh-hant", "en", "cs", "nl", "fr", "pt", "pt-br", "de", "hu", "it", "ja", "ko", "pl", "ru", "es", "tr"],
                  "architectures":["X64"],
                  "installerParameters":"/quiet /norestart",
                  "isSilentInstall":true
                },
                {
                  "packageUrl":"${{ steps.releaseVars.outputs.powerToysInstallerArm64Url }}",
                  "languages":["zh-hans", "zh-hant", "en", "cs", "nl", "fr", "pt", "pt-br", "de", "hu", "it", "ja", "ko", "pl", "ru", "es", "tr"],
                  "architectures":["Arm64"],
                  "installerParameters":"/quiet /norestart",
                  "isSilentInstall":true
                }
            ]
          }'

      - name: Publish Submission
        run: |-
          msstore submission publish ${{ secrets.PRODUCT_ID }}

      - name: Clean up auth certificate
        if: always()
        run: |-
          rm -f cert.pfx cert.pfx.b64

name: WinGet submission on release

on:
  workflow_dispatch:
  release:
    types: [published]

jobs:
  winget:
    name: Publish winget package

    # winget-create is only supported on Windows
    runs-on: windows-latest

    # winget-create will read the following environment variable to access the GitHub token needed for submitting a PR
    # See https://aka.ms/winget-create-token
    env:
      WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.PT_WINGET }}

    # Only submit stable releases
    if: ${{ !github.event.release.prerelease }}
    steps:
      - name: Submit Microsoft.PowerToys package to Windows Package Manager Community Repository
        run: |
          # Get installer info from GitHub release event
          $assets = '${{ toJSON(github.event.release.assets) }}' | ConvertFrom-Json
          $x64UserInstallerUrl = $assets | Where-Object -Property name -match 'PowerToysUserSetup.*x64' | Select -ExpandProperty browser_download_url
          $x64MachineInstallerUrl = $assets | Where-Object -Property name -match 'PowerToysSetup.*x64' | Select -ExpandProperty browser_download_url
          $arm64UserInstallerUrl = $assets | Where-Object -Property name -match 'PowerToysUserSetup.*arm64' | Select -ExpandProperty browser_download_url
          $arm64MachineInstallerUrl = $assets | Where-Object -Property name -match 'PowerToysSetup.*arm64' | Select -ExpandProperty browser_download_url
          $packageVersion = (${{ toJSON(github.event.release.tag_name) }}).Trim('v')

          # Update package using wingetcreate
          curl.exe -JLO https://aka.ms/wingetcreate/latest
          .\wingetcreate.exe update Microsoft.PowerToys `
            --version $packageVersion `
            --urls "$x64UserInstallerUrl|user" "$x64MachineInstallerUrl|machine" "$arm64UserInstallerUrl|user" "$arm64MachineInstallerUrl|machine" `
            --submit

# spelling.yml is blocked per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p
name: Spell checking

# Comment management is handled through a secondary job, for details see:
# https://github.com/check-spelling/check-spelling/wiki/Feature%3A-Restricted-Permissions
#
# `jobs.comment-push` runs when a push is made to a repository and the `jobs.spelling` job needs to make a comment
#   (in odd cases, it might actually run just to collapse a comment, but that's fairly rare)
#   it needs `contents: write` in order to add a comment.
#
# `jobs.comment-pr` runs when a pull_request is made to a repository and the `jobs.spelling` job needs to make a comment
#   or collapse a comment (in the case where it had previously made a comment and now no longer needs to show a comment)
#   it needs `pull-requests: write` in order to manipulate those comments.

# Updating pull request branches is managed via comment handling.
# For details, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Update-expect-list
#
# These elements work together to make it happen:
#
# `on.issue_comment`
#   This event listens to comments by users asking to update the metadata.
#
# `jobs.update`
#   This job runs in response to an issue_comment and will push a new commit
#   to update the spelling metadata.
#
# `with.experimental_apply_changes_via_bot`
#   Tells the action to support and generate messages that enable it
#   to make a commit to update the spelling metadata.
#
# `with.ssh_key`
#   In order to trigger workflows when the commit is made, you can provide a
#   secret (typically, a write-enabled github deploy key).
#
#   For background, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Update-with-deploy-key

# SARIF reporting
#
# Access to SARIF reports is generally restricted (by GitHub) to members of the repository.
#
# Requires enabling `security-events: write`
# and configuring the action with `use_sarif: 1`
#
#   For information on the feature, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-SARIF-output

# Minimal workflow structure:
#
# on:
#   push:
#     ...
#   pull_request_target:
#     ...
# jobs:
#   # you only want the spelling job, all others should be omitted
#   spelling:
#     # remove `security-events: write` and `use_sarif: 1`
#     # remove `experimental_apply_changes_via_bot: 1`
#     ... otherwise adjust the `with:` as you wish

on:
  push:
    branches:
      - "**"
    tags-ignore:
      - "**"
  pull_request_target:
    branches:
      - "**"
    types:
      - "opened"
      - "reopened"
      - "synchronize"
  issue_comment:
    types:
      - "created"

jobs:
  spelling:
    name: Check Spelling
    permissions:
      contents: read
      pull-requests: read
      actions: read
      security-events: write
    outputs:
      followup: ${{ steps.spelling.outputs.followup }}
    runs-on: ubuntu-latest
    if: ${{ contains(github.event_name, 'pull_request') || github.event_name == 'push' }}
    concurrency:
      group: spelling-${{ github.event.pull_request.number || github.ref }}
      # note: If you use only_check_changed_files, you do not want cancel-in-progress
      cancel-in-progress: true
    steps:
      - name: check-spelling
        id: spelling
        uses: check-spelling/check-spelling@c635c2f3f714eec2fcf27b643a1919b9a811ef2e # v0.0.25
        with:
          config: .github/actions/spell-check
          suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
          checkout: true
          check_file_names: 1
          spell_check_this: microsoft/PowerToys@main
          post_comment: 0
          use_magic_file: 1
          report-timing: 1
          warnings: bad-regex,binary-file,deprecated-feature,ignored-expect-variant,large-file,limited-references,no-newline-at-eof,noisy-file,non-alpha-in-dictionary,token-is-substring,unexpected-line-ending,whitespace-in-dictionary,minified-file,unsupported-configuration,no-files-to-check,unclosed-block-ignore-begin,unclosed-block-ignore-end
          experimental_apply_changes_via_bot: 1
          use_sarif: 1
          check_extra_dictionaries: ""
          dictionary_source_prefixes: >
            {
            "cspell": "https://raw.githubusercontent.com/check-spelling/cspell-dicts/v20241114/dictionaries/"
            }
          extra_dictionaries: |
            cspell:software-terms/softwareTerms.txt
            cspell:cpp/stdlib-c.txt
            cspell:cpp/stdlib-cpp.txt
            cspell:filetypes/filetypes.txt
            cspell:php/php.txt
            cspell:dart/dart.txt
            cspell:dotnet/dotnet.txt
            cspell:powershell/powershell.txt
            cspell:csharp/csharp.txt
            cspell:python/python/python-lib.txt
            cspell:node/node.txt
            cspell:golang/go.txt
            cspell:npm/npm.txt
            cspell:fullstack/fullstack.txt
            cspell:css/css.txt
            cspell:java/java.txt
            cspell:typescript/typescript.txt
            cspell:html/html.txt
            cspell:r/r.txt
            cspell:aws/aws.txt
            cspell:cpp/compiler-msvc.txt
            cspell:python/common/extra.txt
            cspell:scala/scala.txt

  comment-push:
    name: Report (Push)
    # If your workflow isn't running on push, you can remove this job
    runs-on: ubuntu-latest
    needs: spelling
    permissions:
      actions: read
      contents: write
    if: (success() || failure()) && needs.spelling.outputs.followup && github.event_name == 'push'
    steps:
      - name: comment
        uses: check-spelling/check-spelling@c635c2f3f714eec2fcf27b643a1919b9a811ef2e # v0.0.25
        with:
          config: .github/actions/spell-check
          checkout: true
          spell_check_this: microsoft/PowerToys@main
          task: ${{ needs.spelling.outputs.followup }}

  comment-pr:
    name: Report (PR)
    # If you workflow isn't running on pull_request*, you can remove this job
    runs-on: ubuntu-latest
    needs: spelling
    permissions:
      actions: read
      contents: read
      pull-requests: write
    if: (success() || failure()) && needs.spelling.outputs.followup && contains(github.event_name, 'pull_request')
    steps:
      - name: comment
        uses: check-spelling/check-spelling@c635c2f3f714eec2fcf27b643a1919b9a811ef2e # v0.0.25
        with:
          config: .github/actions/spell-check
          checkout: true
          spell_check_this: check-spelling/spell-check-this@prerelease
          task: ${{ needs.spelling.outputs.followup }}
          experimental_apply_changes_via_bot: ${{ github.repository_owner != 'microsoft' && 1 }}

  update:
    name: Update PR
    permissions:
      contents: write
      pull-requests: write
      actions: read
    runs-on: ubuntu-latest
    if: ${{
      github.repository_owner != 'microsoft' &&
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request &&
      contains(github.event.comment.body, '@check-spelling-bot apply') &&
      contains(github.event.comment.body, 'https://')
      }}
    concurrency:
      group: spelling-update-${{ github.event.issue.number }}
      cancel-in-progress: false
    steps:
      - name: apply spelling updates
        uses: check-spelling/check-spelling@c635c2f3f714eec2fcf27b643a1919b9a811ef2e # v0.0.25
        with:
          experimental_apply_changes_via_bot: ${{ github.repository_owner != 'microsoft' && 1 }}
          checkout: true
          ssh_key: "${{ secrets.CHECK_SPELLING }}"