_build_cli.yaml

name: Build CLI

on:
  workflow_call:
    inputs:
      version:
        type: string
        default: 0.0.0
      sign:
        type: boolean
        default: false
    secrets:
      MACOS_APPLICATION_P12_PASSWORD:
        required: false
      MACOS_APPLICATION_KEY_CERTIFICATE_BASE64:
        required: false
      MACOS_INSTALLER_P12_PASSWORD:
        required: false
      MACOS_INSTALLER_KEY_CERTIFICATE_BASE64:
        required: false
      MACOS_NOTARIZATION_PASSWORD:
        required: false
      MACOS_NOTARIZATION_APPLEID:
        required: false
      MACOS_KEYCHAIN_PASSWORD:
        required: false

jobs:
  build-cli:
    permissions:
      id-token: write
      contents: read
    strategy:
      fail-fast: false
      matrix:
        repo:
          - ${{ github.repository }}
        targets:
          - runs-on: ubuntu-latest
            tag: linux-x64
            arch: x86_64
          - runs-on: ubuntu-24.04-arm
            tag: linux-arm
            arch: arm64
          - runs-on: macos-latest-large
            tag: osx-x64
            arch: x86_64
          - runs-on: macos-latest
            tag: osx-arm
            arch: arm64
          - runs-on: windows-latest
            tag: windows-x64
            arch: x86_64
        exclude:
          - targets:
              tag: linux-arm # not available in private repos
            repo: tracebit-com/tracebit-cli-internal
    name: Build CLI (${{ matrix.targets.tag }})
    runs-on: ${{ matrix.targets.runs-on }}
    environment: ${{ inputs.sign && 'production' || '' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Setup .NET Core SDK
        uses: actions/setup-dotnet@v5
        with:
          global-json-file: ./global.json
      - name: Setup Java runtime
        if: startsWith(matrix.targets.tag, 'windows-') && inputs.sign
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
      - name: Configure AWS credentials
        if: startsWith(matrix.targets.tag, 'windows-') && inputs.sign
        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708
        with:
          role-to-assume: arn:aws:iam::162803876518:role/GithubActionsRole
          role-session-name: tracebit-cli-windows-sign
          aws-region: eu-west-1
      - name: Build binary
        run: >
          dotnet publish
          Tracebit.Cli
          -o Build
          /p:Version=${{ inputs.version }}
      - name: Build daemon binary (windows)
        if: startsWith(matrix.targets.tag, 'windows-')
        run: >
          dotnet publish
          Tracebit.Cli.Daemon.Windows
          -o Build
          /p:Version=${{ inputs.version }}
      - name: Sign binary (windows)
        if: startsWith(matrix.targets.tag, 'windows-') && inputs.sign
        env:
          KMS_KEY_ARN: arn:aws:kms:eu-west-1:162803876518:key/7b1a90f6-81c3-478a-b219-c7a93649b920
        shell: pwsh
        run: |
          ./installers/windows/sign.ps1 -FilePath (Resolve-Path "Build/tracebit.exe") -Description "Tracebit CLI"
          ./installers/windows/sign.ps1 -FilePath (Resolve-Path "Build/tracebit-daemon.exe") -Description "Tracebit Daemon"
      - name: Prepare keychain for signing (osx)
        if: startsWith(matrix.targets.tag, 'osx-') && inputs.sign
        env:
          APPLICATION_P12_PASSWORD: ${{ secrets.MACOS_APPLICATION_P12_PASSWORD }}
          APPLICATION_KEY_CERTIFICATE_BASE64: ${{ secrets.MACOS_APPLICATION_KEY_CERTIFICATE_BASE64 }}
          INSTALLER_P12_PASSWORD: ${{ secrets.MACOS_INSTALLER_P12_PASSWORD }}
          INSTALLER_KEY_CERTIFICATE_BASE64: ${{ secrets.MACOS_INSTALLER_KEY_CERTIFICATE_BASE64 }}
          NOTARIZATION_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PASSWORD }}
          NOTARIZATION_APPLEID: ${{ secrets.MACOS_NOTARIZATION_APPLEID }}
          KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
        run: ./installers/macos/prepare-keychain.sh
      - name: Build and sign installer (osx)
        if: startsWith(matrix.targets.tag, 'osx-')
        env:
          KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
          SIGN_PACKAGE: ${{ inputs.sign }}
          HOST_ARCH: ${{ matrix.targets.arch }}
          VERSION: ${{ inputs.version }}
        run: ./installers/macos/package-and-sign.sh
      - name: Build installer (windows)
        if: startsWith(matrix.targets.tag, 'windows-')
        run: >
          dotnet msbuild
          .\installers\windows\
          -target:Rebuild
          -restore
          -property:Configuration=Release
          -property:Version=${{ inputs.version }}
      - name: Sign installer (windows)
        if: startsWith(matrix.targets.tag, 'windows-') && inputs.sign
        env:
          KMS_KEY_ARN: arn:aws:kms:eu-west-1:162803876518:key/7b1a90f6-81c3-478a-b219-c7a93649b920
        shell: pwsh
        run: |
          $installerPath = Resolve-Path "Build/install-tracebit.msi"
          ./installers/windows/sign.ps1 -FilePath $installerPath -Description "Tracebit Installer"
      - name: Prepare artifacts (linux)
        if: startsWith(matrix.targets.tag, 'linux-')
        run: |
          mv Build/tracebit Build/tracebit-${{ matrix.targets.tag }}
          cp installers/linux/install-tracebit.sh Build/install-tracebit-linux
      - name: Prepare artifacts (osx)
        if: startsWith(matrix.targets.tag, 'osx-')
        # this "ternary" must be inverted because '' is falsy https://github.com/actions/runner/issues/409
        run: |
          mv Build/tracebit Build/tracebit-${{ matrix.targets.tag }}
          mv install-tracebit${{ !inputs.sign && '.unsigned' || '' }}.pkg Build/install-tracebit-${{ matrix.targets.tag }}.pkg
      - name: Prepare artifacts (windows)
        if: startsWith(matrix.targets.tag, 'windows-')
        run: |
          mv Build\tracebit.exe Build\tracebit-${{ matrix.targets.tag }}.exe
          mv Build\tracebit-daemon.exe Build\tracebit-daemon-${{ matrix.targets.tag }}.exe
          mv Build\install-tracebit.msi Build\install-tracebit-${{ matrix.targets.tag }}.msi
      - name: Upload binary artifact
        uses: actions/upload-artifact@v7
        with:
          name: tracebit-${{ matrix.targets.tag }}
          path: Build/tracebit*
          retention-days: 15
          if-no-files-found: error
      - name: Upload installer artifact
        uses: actions/upload-artifact@v7
        with:
          name: install-tracebit-${{ matrix.targets.tag }}
          path: Build/install-tracebit*
          retention-days: 15
          if-no-files-found: error