release.yml

name: Release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write
  id-token: write        # required by Azure Trusted Signing, when enabled

jobs:
  publish:
    runs-on: windows-latest

    strategy:
      matrix:
        rid: [win-x64, win-arm64]

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4

      - name: Test before shipping
        run: dotnet test -c Release

      # All publish flags live in OpenKey.csproj, so this line cannot drift from what was tested.
      - name: Publish ${{ matrix.rid }}
        run: dotnet publish src/OpenKey/OpenKey.csproj -c Release -r ${{ matrix.rid }} -o out/${{ matrix.rid }}

      # Both surfaces ship from the same tag: the console for people who live in a terminal,
      # the windowed app for everyone else. Same engine underneath.
      - name: Publish the app ${{ matrix.rid }}
        run: dotnet publish src/OpenKey.Gui/OpenKey.Gui.csproj -c Release -r ${{ matrix.rid }} -o out-app/${{ matrix.rid }}

      - name: Name the artifacts by platform
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force dist | Out-Null
          Copy-Item "out/${{ matrix.rid }}/OpenKey.exe" "dist/OpenKey-${{ matrix.rid }}.exe"
          Copy-Item "out-app/${{ matrix.rid }}/OpenKeyApp.exe" "dist/OpenKeyApp-${{ matrix.rid }}.exe"

      # Code signing removes the SmartScreen "unrecognized app" warning, which is the biggest
      # friction point for a product handed over on a USB stick. Disabled until the secrets exist;
      # enable by adding the four AZURE_* secrets and setting vars.SIGNING_ENABLED to 'true'.
      # See docs/06-build-and-distribute.md.
      - name: Sign
        if: vars.SIGNING_ENABLED == 'true'
        uses: azure/trusted-signing-action@v0
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          trusted-signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE }}
          files-folder: dist
          files-folder-filter: exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      # Hashes are computed after signing, since signing changes the file.
      - name: Checksum
        shell: pwsh
        run: |
          Remove-Item "dist/*.sha256" -ErrorAction SilentlyContinue
          Get-ChildItem dist -Filter *.exe | ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            "$h  $($_.Name)" | Out-File -Encoding ascii -Append "dist/${{ matrix.rid }}.sha256"
            Write-Host "$h  $($_.Name)"
          }

      - uses: actions/upload-artifact@v4
        with:
          name: OpenKey-${{ matrix.rid }}
          path: dist/*

  release:
    needs: publish
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')

    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts

      # One checksums file per release, which is what the Scoop manifest's autoupdate reads.
      - name: Collect checksums
        run: |
          mkdir -p dist
          find artifacts -name '*.exe' -exec cp {} dist/ \;
          cat artifacts/*/*.sha256 > "dist/OpenKey-${GITHUB_REF_NAME#v}-checksums.txt"
          cat "dist/OpenKey-${GITHUB_REF_NAME#v}-checksums.txt"

      # Release titles carry the version only — never a phase number. See docs/06.
      - uses: softprops/action-gh-release@v2
        with:
          name: ${{ github.ref_name }}
          files: dist/*
          generate_release_notes: true