release.yml

# Build the Windows MSI installer(s) and publish them to a GitHub Release on
# every version tag (e.g. `git tag v1.0.0 && git push --tags`). Builds both
# x64 and ARM64; `fail-fast: false` means an ARM64 hiccup never blocks the x64
# release. End users go to the Releases page and download the MSI for their
# architecture (`...-x86_64.msi` or `...-aarch64.msi`).

name: release

# Run JavaScript actions on Node 24; Node 20 is deprecated on GitHub-hosted
# runners (forced to Node 24 from 2026-06-16).
env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'

on:
  push:
    tags:
      - 'v*'
  # Also allow manual dry-runs from the Actions tab — useful for verifying the
  # pipeline (incl. the ARM64 cross-build) without cutting a real release.
  workflow_dispatch:

permissions:
  contents: write  # needed to upload assets to the release

jobs:
  windows-msi:
    name: Build ${{ matrix.arch }} MSI
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-pc-windows-msvc
            arch: x64
          - target: aarch64-pc-windows-msvc
            arch: arm64
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust (${{ matrix.target }})
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # WiX 3 ships on the GitHub-hosted Windows runner image (ARM64 MSI support
      # needs WiX >= 3.14 — print the version so a dry-run can confirm).
      - name: Verify WiX toolset on PATH
        shell: pwsh
        run: |
          candle.exe -? | Select-Object -First 1
          light.exe -? | Select-Object -First 1

      - name: Install cargo-wix
        shell: pwsh
        run: cargo install cargo-wix --locked

      - name: Cache cargo build
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.arch }}  # keep x64 and arm64 caches separate
          # Restore-only. Saving the multi-GB target/ tar on the Windows runner
          # intermittently fails and reds the release leg even though the MSI
          # built + uploaded fine (e.g. v0.3.14 arm64). A post-action can't be
          # made non-fatal, so we just never write a new cache here — builds
          # still restore from existing caches; releases just don't update them.
          save-if: false

      # Decode the optional code-signing certificate. When the
      # `WINDOWS_CERT_BASE64` secret is unset (open-source fork with no cert),
      # the step writes an empty `pfx` output and the sign steps skip via
      # `if: steps.cert.outputs.pfx != ''`.
      - name: Stage code-signing cert
        id: cert
        shell: pwsh
        env:
          WINDOWS_CERT_BASE64: ${{ secrets.WINDOWS_CERT_BASE64 }}
        run: |
          if ([string]::IsNullOrEmpty($env:WINDOWS_CERT_BASE64)) {
            Write-Host "WINDOWS_CERT_BASE64 not set — MSI will be unsigned"
            exit 0
          }
          $pfx = Join-Path $env:RUNNER_TEMP 'codesign.pfx'
          [IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:WINDOWS_CERT_BASE64))
          "pfx=$pfx" | Out-File -Append -FilePath $env:GITHUB_OUTPUT

      - name: Build release binary (${{ matrix.target }})
        shell: pwsh
        run: cargo build --release --target ${{ matrix.target }}

      # Locate signtool.exe once — the Windows SDK version on the hosted runner
      # changes, so find the newest x64 bin dir dynamically (the x64 signtool
      # signs binaries of any target architecture).
      - name: Find signtool
        id: signtool
        if: steps.cert.outputs.pfx != ''
        shell: pwsh
        run: |
          $sdk = Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\bin'
          $st = Get-ChildItem -Path $sdk -Filter 'signtool.exe' -Recurse `
            | Where-Object { $_.FullName -match '\\x64\\' } `
            | Sort-Object FullName -Descending `
            | Select-Object -First 1
          if ($null -eq $st) { throw "signtool.exe not found under $sdk" }
          "path=$($st.FullName)" | Out-File -Append -FilePath $env:GITHUB_OUTPUT

      - name: Sign searchbox.exe
        if: steps.cert.outputs.pfx != ''
        shell: pwsh
        env:
          WINDOWS_CERT_PASSWORD: ${{ secrets.WINDOWS_CERT_PASSWORD }}
        run: |
          & "${{ steps.signtool.outputs.path }}" sign `
            /f "${{ steps.cert.outputs.pfx }}" `
            /p "$env:WINDOWS_CERT_PASSWORD" `
            /tr http://timestamp.digicert.com /td sha256 /fd sha256 `
            target\${{ matrix.target }}\release\searchbox.exe

      - name: Build MSI
        shell: pwsh
        # We already built (and possibly signed) searchbox.exe above —
        # -SkipBuild reuses it rather than recompiling (which would unsign it).
        run: .\wix\build.ps1 -SkipBuild -Target ${{ matrix.target }}

      - name: Locate MSI artifact
        id: find_msi
        shell: pwsh
        run: |
          $msi = Get-ChildItem -Path target\wix -Filter '*.msi' | Select-Object -First 1
          if ($null -eq $msi) { throw "No MSI produced under target\wix" }
          "path=$($msi.FullName)" | Out-File -Append -FilePath $env:GITHUB_OUTPUT
          "name=$($msi.Name)"     | Out-File -Append -FilePath $env:GITHUB_OUTPUT

      - name: Sign MSI
        if: steps.cert.outputs.pfx != ''
        shell: pwsh
        env:
          WINDOWS_CERT_PASSWORD: ${{ secrets.WINDOWS_CERT_PASSWORD }}
        run: |
          & "${{ steps.signtool.outputs.path }}" sign `
            /f "${{ steps.cert.outputs.pfx }}" `
            /p "$env:WINDOWS_CERT_PASSWORD" `
            /tr http://timestamp.digicert.com /td sha256 /fd sha256 `
            "${{ steps.find_msi.outputs.path }}"

      - name: Scrub cert from runner
        if: always() && steps.cert.outputs.pfx != ''
        shell: pwsh
        run: Remove-Item -Force -ErrorAction SilentlyContinue "${{ steps.cert.outputs.pfx }}"

      - name: Upload MSI to workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: searchbox-msi-${{ matrix.arch }}
          path: ${{ steps.find_msi.outputs.path }}
          if-no-files-found: error

      # Publish a `<msi>.sha256` sidecar next to each MSI. The in-app updater
      # downloads it and verifies the MSI's hash before launching the installer.
      - name: Compute MSI checksum
        id: sha
        shell: pwsh
        run: |
          $msi = "${{ steps.find_msi.outputs.path }}"
          $hash = (Get-FileHash $msi -Algorithm SHA256).Hash.ToLower()
          $name = Split-Path $msi -Leaf
          $sumfile = "$msi.sha256"
          "$hash  $name" | Out-File -FilePath $sumfile -Encoding ascii -NoNewline
          "path=$sumfile" | Out-File -Append -FilePath $env:GITHUB_OUTPUT
          Write-Host "SHA256($name) = $hash"

      # Only publish to a Release when the trigger was a tag push.
      # workflow_dispatch runs skip this so manual dry-runs don't make junk
      # releases. Both matrix legs attach to the same release (files appended).
      - name: Attach MSI to GitHub Release
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            ${{ steps.find_msi.outputs.path }}
            ${{ steps.sha.outputs.path }}
          draft: false
          generate_release_notes: true
          fail_on_unmatched_files: true