on:
  workflow_dispatch:
  schedule:
  - cron: 0 6 * * *
  push:
    branches:
    - main
    paths:
    - configure
    - m4/version.m4
    - .github/build/windows/download-configure.sh
    - .github/build/windows/download-dependencies.sh
    - .github/workflows/release.yml
  pull_request:
    branches:
    - main
    paths:
    - .github/workflows/release.yml

permissions:
  contents: read

name: Release
jobs:
  version:
    name: Set version
    runs-on: ubuntu-24.04
    outputs:
      version: ${{steps.version.outputs.version}}
      semantic_version: ${{steps.version.outputs.semantic_version}}
      publish: ${{steps.version.outputs.publish}}

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set version
        id: version
        run: |
          version=$(grep -oP "PACKAGE_VERSION='\K[0-9\.-]*" configure)
          semantic_version="${version/-/.}"
          echo "version=$version" >> $GITHUB_OUTPUT
          echo "version=$version"
          echo "semantic_version=$semantic_version" >> $GITHUB_OUTPUT
          echo "semantic_version=$semantic_version"
          tag=$(git describe --tags HEAD --exact-match || true)
          if [[ "$tag" == "$version" ]]; then
            echo "publish=true" >> $GITHUB_OUTPUT
            echo "publish=true"
          fi

  changelog:
    name: Create ChangeLog.md
    runs-on: ubuntu-24.04
    needs:
      - version

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install dependencies
        run: npm install -g git+https://github.com/CookPete/auto-changelog.git#5ba380ad0044dd5be1b2bf4067f64d87202c98bd #v2.5.0

      - name: Create ChangeLog.md
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          if ! git tag -l | grep -q "^$VERSION$"; then
            git tag $VERSION
          fi
          auto-changelog --sort-commits date
          mkdir -p Artifacts
          mv ChangeLog.md Artifacts/ChangeLog.md

      - name: Upload ChangeLog.md
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ChangeLog
          path: Artifacts

  windows_installer:
    name: Windows ${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}} (${{matrix.buildType}})
    runs-on: windows-2025-vs2026
    needs:
      - changelog
      - version

    permissions:
      contents: read
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        architecture: [ x64, arm64, x86 ]
        buildType: [ dynamic, static ]
        quantum: [ Q16, Q8 ]
        hdri: [ hdri, noHdri ]
        exclude:
          - quantum: Q8
            hdri: hdri
        include:
          - architecture: x64
            bit: 64
          - architecture: arm64
            bit: 64
          - architecture: x86
            bit: 32
          - buildType: dynamic
            typeName: dll
          - buildType: static
            typeName: static
          - hdri: hdri
            hdri_flag: -HDRI

    steps:
      - name: Install Strawberry Perl
        if: ${{matrix.buildType == 'dynamic' && matrix.architecture != 'arm64'}}
        shell: cmd
        run: |
          powershell Invoke-WebRequest -Uri https://github.com/ImageMagick/Windows/releases/download/build-binaries-2025-08-30/strawberry-perl-5.30.2.1-${{matrix.bit}}bit.msi -OutFile strawberry-perl-5.30.2.1-${{matrix.bit}}bit.msi
          msiexec /i strawberry-perl-5.30.2.1-${{matrix.bit}}bit.msi /qn INSTALLDIR="C:\Strawberry${{matrix.bit}}"
          mv "C:\Strawberry" "C:\Strawberry64"

      - name: Install Inno Setup
        shell: cmd
        run: |
          powershell Invoke-WebRequest -Uri https://github.com/ImageMagick/Windows/releases/download/build-binaries-2025-08-30/innosetup-6.2.0.exe -OutFile innosetup-6.2.0.exe
          innosetup-6.2.0.exe /SILENT /SUPPRESSMSGBOXES /NORESTART /SP-

      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          path: ImageMagick
          persist-credentials: false

      - name: Download configure
        shell: cmd
        run: |
          ImageMagick\.github\build\windows\download-configure.cmd

      - name: Download dependencies
        shell: cmd
        run: |
          ImageMagick\.github\build\windows\download-dependencies.cmd windows-${{matrix.architecture}}-${{matrix.buildType}}-openMP.zip

      - name: Download ChangeLog.md
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ChangeLog
          path: ImageMagick

      - name: Configure ImageMagick
        shell: cmd
        working-directory: Configure
        run: |
          Configure.Release.x64.exe /noWizard /VS2026 /installedSupport /deprecated /${{matrix.hdri}} /${{matrix.quantum}} /${{matrix.architecture}} /${{matrix.buildType}}

      - name: Build ImageMagick
        shell: cmd
        run: |
          call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools\VsDevCmd.bat"
          msbuild /m /t:Rebuild /p:Configuration=Release,Platform=${{matrix.architecture}}

      - name: Build PerlMagick
        if: ${{matrix.buildType == 'dynamic' && matrix.architecture != 'arm64'}}
        shell: cmd
        run: |
          set PATH=
          call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools\VsDevCmd.bat"
          cd ImageMagick\PerlMagick
          set PATH=%PATH%;C:\Strawberry${{matrix.bit}}\c\bin;C:\Strawberry${{matrix.bit}}\perl\site\bin;C:\Strawberry${{matrix.bit}}\perl\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0
          perl "Makefile.PL" "MAKE=nmake" "CC=g++"
          nmake
          nmake release

      - name: Sign executables and libraries
        uses: ImageMagick/code-signing-action@11c51f7659405bee4dd3529748e1501a0d388911 #v1.0.1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          directory: ${{ github.workspace }}\Artifacts\bin
          files: '*.exe *.dll'

      - name: Create installer
        shell: cmd
        run: |
          call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools\VsDevCmd.bat"
          "C:\Program Files (x86)\Inno Setup 6\iscc.exe" Configure\Installer\Inno\ImageMagick.iss

      - name: Sign installer
        uses: ImageMagick/code-signing-action@11c51f7659405bee4dd3529748e1501a0d388911 #v1.0.1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          directory: ${{ github.workspace }}\Configure\Installer\Inno\Artifacts
          files: '*.exe'

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ImageMagick-${{needs.version.outputs.version}}-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.typeName}}-${{matrix.architecture}}.exe
          path: Configure\Installer\Inno\Artifacts

  windows_source:
    name: Create Windows source archive
    if: github.event_name != 'pull_request'
    runs-on: windows-2025
    needs:
      - changelog
      - version

    steps:
      - name: Clone ImageMagick/Windows
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          repository: ImageMagick/Windows
          ref: refs/heads/main
          persist-credentials: false

      - name: Clone repositories
        shell: cmd
        run: |
          clone-repositories-im7.cmd ${{github.sha}}

      - name: Download ChangeLog.md
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ChangeLog
          path: ImageMagick

      - name: Create Windows source archive
        shell: cmd
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          mkdir source
          move Configure source
          move Dependencies source
          move ImageMagick source
          7z a -mx=9 ImageMagick-%VERSION%-Windows.7z .\source\*

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ImageMagick-${{needs.version.outputs.version}}-Windows.7z
          path: ImageMagick-${{needs.version.outputs.version}}-Windows.7z

  windows_portable:
    name: Windows portable ${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}}
    runs-on: windows-2025-vs2026
    needs:
      - changelog
      - version

    permissions:
      contents: read
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        architecture: [ x64, arm64, x86 ]
        quantum: [ Q16, Q8 ]
        hdri: [ hdri, noHdri ]
        exclude:
          - quantum: Q8
            hdri: hdri
        include:
          - hdri: hdri
            hdri_flag: -HDRI

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          path: ImageMagick
          persist-credentials: false

      - name: Download configure
        shell: cmd
        run: |
          ImageMagick\.github\build\windows\download-configure.cmd

      - name: Download dependencies
        shell: cmd
        run: |
          ImageMagick\.github\build\windows\download-dependencies.cmd windows-${{matrix.architecture}}-static-openMP-linked-runtime.zip

      - name: Download ChangeLog.md
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ChangeLog
          path: ImageMagick

      - name: Configure ImageMagick
        shell: cmd
        working-directory: Configure
        run: |
          Configure.Release.x64.exe /noWizard /VS2026 /${{matrix.hdri}} /${{matrix.quantum}} /${{matrix.architecture}} /static /linkRuntime

      - name: Build ImageMagick
        shell: cmd
        run: |
          call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools\VsDevCmd.bat"
          msbuild /m /t:Rebuild /p:Configuration=Release,Platform=${{matrix.architecture}}

      - name: Sign executables and libraries
        uses: ImageMagick/code-signing-action@11c51f7659405bee4dd3529748e1501a0d388911 #v1.0.1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          directory: ${{ github.workspace }}\Artifacts\bin
          files: '*.exe *.dll'

      - name: Copy Files
        shell: pwsh
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          [void](New-Item -Name "portable" -ItemType directory)
          Copy-Item "Artifacts\bin\*.exe" "portable"
          Copy-Item "Artifacts\bin\*.xml" "portable"
          Copy-Item "Artifacts\bin\sRGB.icc" "portable"

          Copy-Item "Artifacts\NOTICE.txt" "portable"
          Copy-Item "ImageMagick\ChangeLog.md" "portable"
          Copy-Item "ImageMagick\LICENSE" "portable\LICENSE.txt"
          7z a -mx=9 "ImageMagick-$env:VERSION-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}}.7z" .\portable\*

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ImageMagick-${{needs.version.outputs.version}}-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}}.7z
          path: ImageMagick-${{needs.version.outputs.version}}-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.architecture}}.7z

  windows_msix:
    name: Create Msix ${{matrix.quantum}}${{matrix.hdri_flag}}
    if: github.event_name != 'pull_request'
    runs-on: windows-2025
    environment: release
    needs:
      - version
      - windows_portable

    permissions:
      contents: read
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        quantum: [ Q16, Q8 ]
        hdri: [ hdri, noHdri ]
        exclude:
          - quantum: Q8
            hdri: hdri
        include:
          - hdri: hdri
            hdri_flag: -HDRI

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          path: ImageMagick
          persist-credentials: false

      - name: Download configure
        shell: cmd
        run: |
          ImageMagick\.github\build\windows\download-configure.cmd

      - name: Download x64 artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ImageMagick-${{needs.version.outputs.version}}-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-x64.7z
          path: Configure\Installer\Msix\x64

      - name: Download arm64 artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ImageMagick-${{needs.version.outputs.version}}-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-arm64.7z
          path: Configure\Installer\Msix\arm64

      - name: Unzip artifacts
        shell: pwsh
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          cd Configure\Installer\Msix\x64
          7z x "ImageMagick-$env:VERSION-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-x64.7z"
          cd ../arm64
          7z x "ImageMagick-$env:VERSION-portable-${{matrix.quantum}}${{matrix.hdri_flag}}-arm64.7z"

      - name: Azure CLI login with federated credential
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 #v3.0.0
        with:
          client-id: ${{secrets.AZURE_CLIENT_ID}}
          tenant-id: ${{secrets.AZURE_TENANT_ID}}
          subscription-id: ${{secrets.AZURE_SUBSCRIPTION_ID}}

      - name: Create msixbundle with Advanced Installer
        uses: caphyon/advinst-github-action@7edde34c6ff935e53e3de72a5699efcfceb5f6c6 #v2.0.3
        with:
          advinst-license: ${{secrets.ADVINST_LICENSE_KEY}}
          aip-path: Configure\Installer\Msix\ImageMagick.${{matrix.quantum}}${{matrix.hdri_flag}}.aip
          aip-build-name: Build_MSIX
          aip-commands: |
              SetVersion ${{needs.version.outputs.semantic_version}}

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ImageMagick.${{matrix.quantum}}${{matrix.hdri_flag}}.msixbundle
          path: Configure\Installer\Msix\Artifacts\ImageMagick.${{matrix.quantum}}${{matrix.hdri_flag}}.msixbundle

  linux_app_image:
    name: Linux AppImage ${{matrix.compiler}}
    container:
      image: ubuntu:22.04
    runs-on: ubuntu-24.04
    needs:
      - version

    strategy:
      matrix:
        compiler: [ gcc, clang ]
        include:
          - compiler: gcc
            cxx_compiler: g++
            packages: gcc g++
          - compiler: clang
            cxx_compiler: clang++
            packages: clang

    steps:
      - name: Install dependencies
        run: |
          set -e
          export DEBIAN_FRONTEND=noninteractive
          apt-get update -y
          apt-get install -y autoconf curl file fuse git kmod squashfs-tools libbz2-dev libdjvulibre-dev libfontconfig-dev libfreetype6-dev libfribidi-dev libharfbuzz-dev libheif-dev liblcms-dev libopenexr-dev libopenjp2-7-dev libturbojpeg0-dev liblqr-dev libraqm-dev libtiff-dev libwebp-dev libx11-dev libxml2-dev liblzma-dev make software-properties-common wget ${{matrix.packages}}

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

        # Avoid fatal: detected dubious ownership in repository at '/__w/ImageMagick/ImageMagick'
        # Possible workaround: https://github.com/actions/runner/issues/2033#issuecomment-1598547465
      - name: Flag current workspace as safe for git
        run: git config --global --add safe.directory ${GITHUB_WORKSPACE}

      - name: Download AppImage
        run: |
          mkdir /app-image
          cd /app-image
          wget -c "https://github.com/probonopd/linuxdeployqt/releases/download/continuous/linuxdeployqt-continuous-x86_64.AppImage"
          chmod a+x linuxdeployqt-continuous-x86_64.AppImage
          ./linuxdeployqt-continuous-x86_64.AppImage --appimage-extract

      - name: Build ImageMagick
        env:
          CFLAGS: -Wno-deprecated-declarations -Wdeclaration-after-statement -Wno-error=unused-variable
          CC: ${{matrix.compiler}}
          CXX: ${{matrix.cxx_compiler}}
        run: |
          set -e
          ./configure --with-quantum-depth=16 --without-magick-plus-plus --without-perl --prefix=/usr
          make
          make install DESTDIR=$(readlink -f /appdir)

      - name: Create ImageMagick AppImage
        env:
          VERSION: ${{needs.version.outputs.version}}-${{matrix.compiler}}
        run: |
          set -e
          mkdir -p /appdir/usr/share/applications/
          cp ./app-image/imagemagick.desktop /appdir/usr/share/applications/
          mkdir -p /appdir/usr/share/icons/hicolor/128x128/apps/
          cp ./app-image/icon.png /appdir/usr/share/icons/hicolor/128x128/apps/imagemagick.png
          unset QTDIR
          unset QT_PLUGIN_PATH
          unset LD_LIBRARY_PATH
          /app-image/linuxdeployqt-continuous-x86_64.AppImage --appimage-extract-and-run /appdir/usr/share/applications/imagemagick.desktop -bundle-non-qt-libs
          rm /appdir/AppRun
          cp ./app-image/AppRun /appdir
          chmod a+x /appdir/AppRun
          PATH=/app-image/squashfs-root/usr/bin:$PATH
          /app-image/squashfs-root/usr/bin/appimagetool -g /appdir/
          mkdir artifacts
          cp ImageMagick-$VERSION-x86_64.AppImage artifacts
          find /appdir -executable -type f -exec ldd {} \; | grep " => /usr" | cut -d " " -f 2-3 | sort | uniq

      - name: Upload ImageMagick AppImage
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: AppImage-${{matrix.compiler}}
          path: artifacts

  source:
    name: Create source archive
    runs-on: ubuntu-24.04
    needs:
      - changelog
      - version

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          path: ImageMagick
          persist-credentials: false

      - name: Download ChangeLog.md
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ChangeLog
          path: ImageMagick

      - name: Create source archive
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          set -e
          DIRECTORIES=(
            ".devcontainer"
            ".git"
            ".github"
            "api_examples"
            "logo"
            "oss-fuzz"
          )
          FILES=(
            ".auto-changelog"
            ".editorconfig"
            ".gitignore"
          )
          for dir_name in "${DIRECTORIES[@]}"; do
            path="ImageMagick/$dir_name"
            if [[ -e "$path" ]]; then
              rm -rf -- "$path"
              echo "Removed: $dir_name"
            else
              echo "Not found: $dir_name"
              exit 1
            fi
          done
          for file_name in "${FILES[@]}"; do
            path="ImageMagick/$file_name"
            if [[ -e "$path" ]]; then
              rm -f -- "$path"
              echo "Removed: $file_name"
            else
              echo "Not found: $file_name"
              exit 1
            fi
          done
          mv ImageMagick "ImageMagick-$VERSION"
          mkdir artifacts
          7z a -mx=9 "artifacts/ImageMagick-$VERSION.7z" "ImageMagick-$VERSION"
          XZ_OPT="-9e" tar -cJf "artifacts/ImageMagick-$VERSION.tar.xz" "ImageMagick-$VERSION"

      - name: Upload source archive
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: ImageMagick-${{needs.version.outputs.version}}.7z
          path: artifacts

  release:
    name: Publish Release
    if: ${{ needs.version.outputs.publish == 'true' }}
    runs-on: ubuntu-24.04
    needs:
      - version
      - source
      - linux_app_image
      - windows_installer
      - windows_portable
      - windows_source
      - windows_msix

    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - name: Clone ImageMagick
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          path: artifacts
          merge-multiple: true

      - name: Generate SLSA provenance
        id: attest
        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 #v4.2.0
        with:
          subject-path: |
            ${{github.workspace}}/artifacts/*.7z
            ${{github.workspace}}/artifacts/*.AppImage
            ${{github.workspace}}/artifacts/*.exe
            ${{github.workspace}}/artifacts/*.msixbundle
            ${{github.workspace}}/artifacts/*.xz

      - name: Save provenance as an artifact
        env:
          BUNDLE_PATH: ${{steps.attest.outputs.bundle-path}}
          VERSION: ${{needs.version.outputs.version}}
        run: |
          cp "$BUNDLE_PATH" "${{github.workspace}}/artifacts/ImageMagick-$VERSION.intoto.jsonl"

      - name: Publish release
        env:
          GH_TOKEN: ${{github.token}}
          VERSION: ${{needs.version.outputs.version}}
        run: |
          gh release create "$VERSION" \
            --title "$VERSION" \
            --notes "$VERSION" \
            ${{github.workspace}}/artifacts/*.7z \
            ${{github.workspace}}/artifacts/*.AppImage \
            ${{github.workspace}}/artifacts/*.exe \
            ${{github.workspace}}/artifacts/*.intoto.jsonl \
            ${{github.workspace}}/artifacts/*.msixbundle \
            ${{github.workspace}}/artifacts/*.xz

  prepare_msix:
    name: Prepare Msix
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-24.04

    steps:
      - name: Sync forked winget-pkgs repository
        env:
          GH_TOKEN: ${{secrets.WINGET_TOKEN}}
        run: gh repo sync dlemstra/winget-pkgs --source microsoft/winget-pkgs

  release_msix:
    name: Publish Msix ${{matrix.quantum}}${{matrix.hdri_flag}}
    needs:
      - version
      - release
      - prepare_msix
    runs-on: windows-2025

    strategy:
      fail-fast: false
      matrix:
        quantum: [ Q16, Q8 ]
        hdri: [ hdri, noHdri ]
        exclude:
          - quantum: Q8
            hdri: hdri
        include:
          - hdri: hdri
            hdri_flag: -HDRI

    steps:
      - name: Install wingetcreate
        run: winget install wingetcreate --disable-interactivity --accept-source-agreements

      - name: Update manifest on winget
        env:
          VERSION: ${{needs.version.outputs.version}}
          SEMANTIC_VERSION: ${{needs.version.outputs.semantic_version}}
        run: wingetcreate update --submit --replace --token ${{secrets.WINGET_TOKEN}} --urls "https://github.com/ImageMagick/ImageMagick/releases/download/$env:VERSION/ImageMagick.${{matrix.quantum}}${{matrix.hdri_flag}}.msixbundle" --version $env:SEMANTIC_VERSION "ImageMagick.${{matrix.quantum}}${{matrix.hdri_flag}}"

  update_website:
    name: Update website
    runs-on: ubuntu-24.04
    needs:
      - version
      - release

    steps:
      - name: Create GitHub app token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 #v3.2.0
        id: app-token
        with:
          client-id: ${{vars.APP_CLIENT_ID}}
          private-key: ${{secrets.APP_PRIVATE_KEY}}
          repositories: Website
          permission-contents: write

      - name: Clone Website
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          repository: ImageMagick/Website
          token: ${{steps.app-token.outputs.token}}

      - name: Download ChangeLog.md
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: ChangeLog

      - name: Move ChangeLog.md
        run: |
          mv ChangeLog.md docs/changelog/index.md

      - name: Configure git
        run: |
          git config --global user.name '${{steps.app-token.outputs.app-slug}}[bot]'
          git config --global user.email '${{vars.APP_USER_ID}}+${{steps.app-token.outputs.app-slug}}[bot]@users.noreply.github.com'

      - name: Update website version
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          ./update-version.sh "$VERSION" "$(date -u +"%Y-%m-%d")"

      - name: Commit and push changes
        env:
          VERSION: ${{needs.version.outputs.version}}
        run: |
          git add -A
          git commit -m "Update version to $VERSION"
          git push
