test.yml

# SPDX-FileCopyrightText: Copyright 2026 Jetperch LLC
# SPDX-License-Identifier: Apache-2.0

name: Test

on:
  push:
  pull_request:
  workflow_dispatch:

jobs:

  reuse:
    name: REUSE compliance
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: '3.14'
      - run: python -m pip install "reuse[charset-normalizer]==6.2.0"
      - run: python -m reuse lint

  windows_sign:
    name: windows_sign on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, windows-11-arm]
    env:
      # Sign only on trusted refs, as callers do.  Otherwise this tests the
      # skip path.
      SIGN: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) }}
    steps:
      - uses: actions/checkout@v6

      - name: Build an unsigned executable
        run: |
          cmake -S test -B build
          cmake --build build --config Release
          Copy-Item build/Release/hello.exe build/Release/hello2.exe
          New-Item -ItemType Directory -Force build/nested/deeper | Out-Null
          Copy-Item build/Release/hello.exe build/nested/deeper/hello3.exe

      # Call the script directly and catch the expected error: a failing
      # step with continue-on-error would add an error annotation.
      - name: Missing files fail by default
        env:
          WS_FILES: build/Release/does_not_exist.exe
          WS_KEY_VAULT_URI: unused
          WS_CLIENT_ID: unused
          WS_TENANT_ID: unused
          WS_CLIENT_SECRET: unused
          WS_CERT_NAME: unused
          WS_TIMESTAMP_URL: unused
          WS_IF_NO_FILES_FOUND: error
        run: |
          try {
              & ./windows_sign/windows_sign.ps1
          } catch {
              if ("$_" -notlike '*no files match*') { throw "unexpected error: $_" }
              Write-Host "expected error: $_"
              exit 0
          }
          throw 'expected an error for a pattern without files'

      - name: Sign
        id: sign
        uses: ./windows_sign
        with:
          files: |
            build/Release/*.exe
            build/nested/**/*.exe
          azure_key_vault_uri: ${{ env.SIGN == 'true' && secrets.AZURE_KEY_VAULT_URI || '' }}
          azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
          azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
          azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          azure_cert_name: ${{ secrets.AZURE_CERT_NAME }}

      - name: Check signatures
        env:
          SIGNED: ${{ steps.sign.outputs.signed }}
        run: |
          $expect = if ($env:SIGN -eq 'true') { 'Valid' } else { 'NotSigned' }
          if (($env:SIGN -eq 'true') -ne ($env:SIGNED -eq 'true')) {
              throw "signed output '$env:SIGNED' does not match SIGN '$env:SIGN'"
          }
          foreach ($f in 'build/Release/hello.exe', 'build/Release/hello2.exe', 'build/nested/deeper/hello3.exe') {
              $status = (Get-AuthenticodeSignature $f).Status
              Write-Host "$f : $status"
              if ("$status" -ne $expect) { throw "expected $expect" }
          }
          & build/Release/hello.exe
          if ($LASTEXITCODE) { throw 'hello.exe failed' }