ICCery/.gitea/workflows/build-windows.yml

name: Build Windows Packages

on:
  push:
    tags:
      - 'v*'

jobs:
  build-windows:
    name: Build Windows
    runs-on: windows
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install Rust stable
        shell: powershell
        run: |
          if (!(Get-Command rustup -ErrorAction SilentlyContinue) -and !(Test-Path "$env:USERPROFILE\.cargo\bin\rustup.exe")) {
            Write-Host "Downloading rustup-init.exe..."
            Invoke-WebRequest -Uri "https://win.rustup.rs/x86_64" -OutFile "$env:TEMP\rustup-init.exe"
            & "$env:TEMP\rustup-init.exe" -y --default-toolchain stable --profile minimal
          }
          "$env:USERPROFILE\.cargo\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          rustup default stable
          rustup target add x86_64-pc-windows-msvc

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        continue-on-error: true
        with:
          workspaces: "src-tauri -> target"

      - name: Install Node dependencies
        run: npm ci

      - name: Fetch ArgyllCMS binaries
        shell: powershell
        env:
          ARGYLL_SERVER_URL: ${{ github.server_url }}
          ARGYLL_RELEASE_TAG: ${{ vars.ARGYLL_RELEASE_TAG }}
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npm run fetch-argyll -- --force --platform windows-x86_64 --server "${{ github.server_url }}"

      - name: Verify sidecar binaries
        shell: powershell
        run: |
          $required = @(
            "src-tauri\argyll\windows-x86_64\instlist.exe",
            "src-tauri\argyll\windows-x86_64\targen.exe",
            "src-tauri\argyll\windows-x86_64\chartread.exe",
            "src-tauri\argyll\windows-x86_64\colprof.exe",
            "src-tauri\argyll\usb\ArgyllCMS_install_USB.exe",
            "src-tauri\argyll\usb\ArgyllCMS.inf"
          )
          foreach ($p in $required) {
            if (!(Test-Path $p)) { throw "Missing required ArgyllCMS file: $p" }
          }

      - name: Set Release Environment
        id: set_env
        shell: powershell
        run: |
          $TAG = $env:GITHUB_REF_NAME
          $SHORT_SHA = (git rev-parse --short HEAD).Trim()
          "TAG=$TAG" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          "SHORT_SHA=$SHORT_SHA" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          "PREFIX=ICCery_${TAG}-${SHORT_SHA}-windows-x86_64" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Setup Code Signing Certificate
        shell: powershell
        env:
          WINDOWS_CODESIGN_CERT_BASE64: ${{ secrets.WINDOWS_CODESIGN_CERT_BASE64 }}
          WINDOWS_CODESIGN_PASSWORD: ${{ secrets.WINDOWS_CODESIGN_PASSWORD }}
        run: |
          $workspace = (Get-Location).Path
          "$workspace" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          "$workspace\scripts" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          "$workspace\src-tauri" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

          if ($env:WINDOWS_CODESIGN_CERT_BASE64) {
            $certPath = "$env:TEMP\codesign.pfx"
            $bytes = [Convert]::FromBase64String($env:WINDOWS_CODESIGN_CERT_BASE64)
            [IO.File]::WriteAllBytes($certPath, $bytes)
            "WINDOWS_CODESIGN_CERT_PATH=$certPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
            "WINDOWS_CODESIGN_PASSWORD=$env:WINDOWS_CODESIGN_PASSWORD" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
            Write-Host "Code signing certificate initialized at $certPath"
          } else {
            Write-Host "No code signing certificate secret provided. Skipping signing setup."
          }

      - name: Build Tauri App
        env:
          WINDOWS_CODESIGN_PASSWORD: ${{ secrets.WINDOWS_CODESIGN_PASSWORD }}
        run: npm run tauri build -- -v

      - name: Prepare Release Assets
        shell: powershell
        run: |
          New-Item -ItemType Directory -Force -Path "release-assets"
          $PREFIX = $env:PREFIX

          # Stage MSI installer
          $msiFiles = Get-ChildItem -Path "src-tauri\target\release\bundle\msi\*.msi" -ErrorAction SilentlyContinue
          foreach ($file in $msiFiles) {
            Copy-Item -Path $file.FullName -Destination "release-assets\$PREFIX.msi"
          }

          # Stage NSIS installer
          $nsisFiles = Get-ChildItem -Path "src-tauri\target\release\bundle\nsis\*.exe" -ErrorAction SilentlyContinue
          foreach ($file in $nsisFiles) {
            Copy-Item -Path $file.FullName -Destination "release-assets\$PREFIX.exe"
            # Also create a zip archive of the installer
            Compress-Archive -Path $file.FullName -DestinationPath "release-assets\$PREFIX.zip" -Force
          }

      - name: Upload Artifacts
        uses: actions/upload-artifact@v3
        with:
          name: ${{ env.PREFIX }}
          path: release-assets/*

      - name: Upload Release Assets to Gitea
        if: !cancelled()
        shell: powershell
        env:
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SERVER_URL: ${{ github.server_url }}
          REPO: ${{ github.repository }}
        run: |
          $TAG = $env:TAG
          Write-Host "Finding release for tag $TAG..."
          $headers = @{ "Authorization" = "token $env:GITEA_TOKEN" }
          try {
            $release = Invoke-RestMethod -Uri "$env:SERVER_URL/api/v1/repos/$env:REPO/releases/tags/$TAG" -Headers $headers -Method Get
            $releaseId = $release.id
            if ($releaseId) {
              Write-Host "Found Release ID: $releaseId. Uploading Windows assets..."
              $files = Get-ChildItem -Path "release-assets\*" -ErrorAction SilentlyContinue
              foreach ($file in $files) {
                Write-Host "Uploading $($file.Name)..."
                curl.exe -s -X POST `
                  -H "Authorization: token $env:GITEA_TOKEN" `
                  -H "Content-Type: multipart/form-data" `
                  -F "attachment=@$($file.FullName)" `
                  "$env:SERVER_URL/api/v1/repos/$env:REPO/releases/$releaseId/assets?name=$($file.Name)"
              }
            } else {
              Write-Host "No existing release found for tag $TAG. Skipping asset upload."
            }
          } catch {
            Write-Host "Skipping release asset upload: $_"
          }

      - name: Cleanup Code Signing Certificate
        if: always()
        shell: powershell
        run: |
          if (Test-Path "$env:TEMP\codesign.pfx") {
            Remove-Item -Force "$env:TEMP\codesign.pfx"
            Write-Host "Temporary code signing certificate cleaned up."
          }