release.yml

name: Build Windows Release

on:
  push:
    tags:
      - 'v*.*.*'
  pull_request:
    branches: [ main ]
    paths:
      - '.github/workflows/release.yml'
      - 'installer/**'
      - 'scripts/publish-release.ps1'
      - 'scripts/generate-sbom.ps1'
      - 'publish-win-x64.ps1'
      - 'build.ps1'
      - 'src/**'
      - 'tests/**'
      - 'ARSVIN.sln'
      - 'Directory.Build.props'
      - 'Directory.Packages.props'
      - 'global.json'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version used for a private workflow artifact build (for example 0.4.0-dev.1)'
        required: false
        default: '0.0.0-dev'

permissions:
  contents: read

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  DOTNET_CLI_TELEMETRY_OPTOUT: '1'
  DOTNET_NOLOGO: '1'
  INNO_SETUP_VERSION: '6.7.1'

jobs:
  package:
    name: Validate portable EXEs and installer
    runs-on: windows-2025
    outputs:
      version: ${{ steps.version.outputs.value }}
      tag_name: ${{ steps.version.outputs.tag_name }}
      artifact_name: ${{ steps.version.outputs.artifact_name }}
      is_prerelease: ${{ steps.version.outputs.is_prerelease }}

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
        with:
          dotnet-version: 8.0.4xx
          cache: true
          cache-dependency-path: |
            Directory.Packages.props
            src/**/packages.lock.json
            tests/**/packages.lock.json

      - name: Resolve version
        id: version
        shell: pwsh
        run: |
          if ('${{ github.event_name }}' -eq 'workflow_dispatch') {
            $version = '${{ inputs.version }}'
            if ([string]::IsNullOrWhiteSpace($version)) {
              $version = '0.0.0-dev'
            }
            $version = $version -replace '^[vV]', ''
          }
          elseif ('${{ github.ref_type }}' -eq 'tag') {
            $version = '${{ github.ref_name }}' -replace '^[vV]', ''
          }
          else {
            $version = "0.0.0-pr.$env:GITHUB_RUN_NUMBER"
          }

          if ($version -notmatch '^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$') {
            throw "Unsupported release version: $version"
          }

          $tagName = "v$version"
          $artifactName = "ARSVIN-$version-windows-x64"
          $isPrerelease = $version.Contains('-').ToString().ToLowerInvariant()

          "value=$version" >> $env:GITHUB_OUTPUT
          "tag_name=$tagName" >> $env:GITHUB_OUTPUT
          "artifact_name=$artifactName" >> $env:GITHUB_OUTPUT
          "is_prerelease=$isPrerelease" >> $env:GITHUB_OUTPUT

          Write-Host "Release version: $version"
          Write-Host "Release tag: $tagName"
          Write-Host "Prerelease: $isPrerelease"

      - name: Verify tagged commit belongs to main
        if: github.ref_type == 'tag'
        shell: pwsh
        run: |
          git fetch origin main --no-tags
          git merge-base --is-ancestor "$env:GITHUB_SHA" 'origin/main'
          if ($LASTEXITCODE -ne 0) {
            throw "Tag ${{ github.ref_name }} does not point to a commit contained in main. Merge the release commit before tagging."
          }

      - name: Build and test with warnings as errors
        shell: pwsh
        run: .\build.ps1

      - name: Publish single-file portable applications
        shell: pwsh
        run: .\scripts\publish-release.ps1 -Version '${{ steps.version.outputs.value }}' -SkipTests

      - name: Install pinned Inno Setup
        shell: pwsh
        run: |
          choco install innosetup --version=$env:INNO_SETUP_VERSION --allow-downgrade --no-progress -y
          if ($LASTEXITCODE -ne 0) {
            throw "Chocolatey could not install Inno Setup $env:INNO_SETUP_VERSION."
          }

          $installed = choco list --local-only --exact innosetup --limit-output
          if ($LASTEXITCODE -ne 0) {
            throw 'Could not query the installed Inno Setup package.'
          }

          if ($installed -notcontains "innosetup|$env:INNO_SETUP_VERSION") {
            throw "Expected Inno Setup $env:INNO_SETUP_VERSION, found: $($installed -join ', ')"
          }

      - name: Build Windows installer
        shell: pwsh
        run: |
          $iscc = @(
            "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe",
            "${env:ProgramFiles}\Inno Setup 6\ISCC.exe"
          ) | Where-Object { Test-Path $_ } | Select-Object -First 1

          if (-not $iscc) {
            throw 'Inno Setup compiler (ISCC.exe) was not found.'
          }

          $versionInfo = (Get-Item $iscc).VersionInfo
          Write-Host "Validated Chocolatey package: innosetup|$env:INNO_SETUP_VERSION"
          Write-Host "ISCC path: $iscc"
          Write-Host "ISCC product version metadata: $($versionInfo.ProductVersion)"
          Write-Host "ISCC file version metadata: $($versionInfo.FileVersion)"

          $sourceDir = (Resolve-Path '.\artifacts\installer-input').Path
          $outputDir = (Resolve-Path '.\artifacts\release').Path
          $version = '${{ steps.version.outputs.value }}'

          & $iscc `
            "/DMyAppVersion=$version" `
            "/DSourceDir=$sourceDir" `
            "/DOutputDir=$outputDir" `
            '.\installer\ARSVIN.iss'

          if ($LASTEXITCODE -ne 0) {
            throw "Inno Setup failed with exit code $LASTEXITCODE."
          }

      - name: Generate CycloneDX SBOM
        shell: pwsh
        run: .\scripts\generate-sbom.ps1 -Version '${{ steps.version.outputs.value }}'

      - name: Validate release artifacts
        shell: pwsh
        run: |
          $releaseRoot = (Resolve-Path '.\artifacts\release').Path
          $expected = @(
            'ARSVIN-Publisher-win-x64.exe',
            'ArSubsv-Subscriber-win-x64.exe',
            'ARSVIN-Suite-Setup-win-x64.exe',
            'ARSVIN-win-x64-portable.zip',
            'ARSVIN-SBOM.cdx.json'
          )

          foreach ($name in $expected) {
            $path = Join-Path $releaseRoot $name
            if (-not (Test-Path $path -PathType Leaf)) {
              throw "Expected release artifact was not found: $path"
            }

            if ((Get-Item $path).Length -le 0) {
              throw "Release artifact is empty: $path"
            }
          }

          $sbom = Get-Content (Join-Path $releaseRoot 'ARSVIN-SBOM.cdx.json') -Raw | ConvertFrom-Json
          if ($sbom.bomFormat -ne 'CycloneDX' -or $sbom.specVersion -ne '1.5') {
            throw 'Generated SBOM is not CycloneDX 1.5.'
          }

          $serialNumber = [string] $sbom.serialNumber
          if ($serialNumber -notmatch '^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$') {
            throw "Generated CycloneDX SBOM has an invalid or missing serialNumber: $serialNumber"
          }

          $componentVersion = [string] $sbom.metadata.component.version
          if ($componentVersion -ne '${{ steps.version.outputs.value }}') {
            throw "Generated SBOM component version $componentVersion does not match release version ${{ steps.version.outputs.value }}."
          }

          if (@($sbom.components).Count -lt 1) {
            throw 'Generated SBOM contains no dependency components.'
          }

          Write-Host "Validated CycloneDX serial number: $serialNumber"
          Get-ChildItem $releaseRoot -File |
            Select-Object Name, Length |
            Sort-Object Name |
            Format-Table -AutoSize

      - name: Smoke-test silent installer
        shell: pwsh
        run: |
          $setup = (Resolve-Path '.\artifacts\release\ARSVIN-Suite-Setup-win-x64.exe').Path
          $installDir = Join-Path $env:RUNNER_TEMP 'ARSVIN-SmokeInstall'
          $installLog = Join-Path $env:RUNNER_TEMP 'arsvin-install.log'
          $uninstallLog = Join-Path $env:RUNNER_TEMP 'arsvin-uninstall.log'

          if (Test-Path $installDir) {
            Remove-Item $installDir -Recurse -Force
          }
          Remove-Item $installLog, $uninstallLog -Force -ErrorAction SilentlyContinue

          $installArgs = @(
            '/VERYSILENT',
            '/SUPPRESSMSGBOXES',
            '/NORESTART',
            "/DIR=`"$installDir`"",
            "/LOG=`"$installLog`""
          )
          $installProcess = Start-Process -FilePath $setup -ArgumentList $installArgs -Wait -PassThru

          if (Test-Path $installLog) {
            Get-Content $installLog
          }
          if ($installProcess.ExitCode -ne 0) {
            throw "Silent installer failed with exit code $($installProcess.ExitCode)."
          }

          Write-Host 'Installed files:'
          Get-ChildItem $installDir -Recurse -Force |
            Select-Object FullName, Length |
            Format-Table -AutoSize

          $installedFiles = @(
            'ARSVIN.exe',
            'ArSubsv.exe',
            'README.md',
            'LICENSE.txt',
            'VERSION.txt'
          )

          foreach ($name in $installedFiles) {
            $path = Join-Path $installDir $name
            if (-not (Test-Path $path -PathType Leaf)) {
              throw "Installer smoke test could not find: $path"
            }
          }

          $uninstaller = Get-ChildItem $installDir -Filter 'unins*.exe' -File |
            Select-Object -First 1
          if (-not $uninstaller) {
            throw "Installer smoke test could not find an uninstaller in: $installDir"
          }

          $uninstallArgs = @(
            '/VERYSILENT',
            '/SUPPRESSMSGBOXES',
            '/NORESTART',
            "/LOG=`"$uninstallLog`""
          )
          $uninstallProcess = Start-Process -FilePath $uninstaller.FullName -ArgumentList $uninstallArgs -Wait -PassThru

          if (Test-Path $uninstallLog) {
            Get-Content $uninstallLog
          }
          if ($uninstallProcess.ExitCode -ne 0) {
            throw "Silent uninstaller failed with exit code $($uninstallProcess.ExitCode)."
          }

      - name: Generate SHA-256 checksums
        shell: pwsh
        run: |
          $releaseRoot = Resolve-Path '.\artifacts\release'
          $lines = Get-ChildItem $releaseRoot -File |
            Where-Object { $_.Name -ne 'SHA256SUMS.txt' } |
            Sort-Object Name |
            ForEach-Object {
              $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
              "$hash  $($_.Name)"
            }

          [System.IO.File]::WriteAllLines(
            (Join-Path $releaseRoot 'SHA256SUMS.txt'),
            $lines,
            [System.Text.UTF8Encoding]::new($false)
          )

          if ($lines.Count -ne 5) {
            throw "Expected five checksummed release artifacts, found $($lines.Count)."
          }

          Get-Content (Join-Path $releaseRoot 'SHA256SUMS.txt')

      - name: Upload release workflow artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ steps.version.outputs.artifact_name }}
          path: |
            artifacts/release/*.exe
            artifacts/release/*.zip
            artifacts/release/*.json
            artifacts/release/SHA256SUMS.txt
          if-no-files-found: error
          retention-days: 30

  release:
    name: Publish GitHub Release
    if: github.ref_type == 'tag'
    needs: package
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      id-token: write
      attestations: write
      artifact-metadata: write

    steps:
      - name: Download validated release artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ${{ needs.package.outputs.artifact_name }}
          path: artifacts/release

      - name: Refuse to overwrite an existing GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.package.outputs.tag_name }}
        shell: bash
        run: |
          set -euo pipefail
          endpoint="repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}"

          if existing_release="$(gh api "$endpoint" 2>&1)"; then
            echo "::error::GitHub Release ${RELEASE_TAG} already exists. Published releases are immutable; create a new semantic-version tag instead."
            exit 1
          fi

          if ! grep -q 'HTTP 404' <<<"$existing_release"; then
            echo "$existing_release" >&2
            echo "::error::Could not verify whether GitHub Release ${RELEASE_TAG} already exists."
            exit 1
          fi

          echo "No existing GitHub Release found for ${RELEASE_TAG}; publication may continue."

      - name: Attest release build provenance
        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4
        with:
          subject-path: |
            artifacts/release/*.exe
            artifacts/release/*.zip
            artifacts/release/*.json
            artifacts/release/SHA256SUMS.txt

      - name: Attest release SBOM
        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4
        with:
          subject-path: |
            artifacts/release/*.exe
            artifacts/release/*.zip
          sbom-path: artifacts/release/ARSVIN-SBOM.cdx.json

      - name: Create GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          tag_name: ${{ needs.package.outputs.tag_name }}
          target_commitish: ${{ github.sha }}
          name: ARSVIN ${{ needs.package.outputs.tag_name }}
          prerelease: ${{ needs.package.outputs.is_prerelease }}
          make_latest: ${{ needs.package.outputs.is_prerelease == 'false' }}
          generate_release_notes: true
          fail_on_unmatched_files: true
          files: |
            artifacts/release/ARSVIN-Publisher-win-x64.exe
            artifacts/release/ArSubsv-Subscriber-win-x64.exe
            artifacts/release/ARSVIN-Suite-Setup-win-x64.exe
            artifacts/release/ARSVIN-win-x64-portable.zip
            artifacts/release/ARSVIN-SBOM.cdx.json
            artifacts/release/SHA256SUMS.txt