name: build-windows

# Builds the Windows agent, tray, session helper, and the fully-offline Inno
# installer; signs them with Azure Trusted Signing; generates SHA256SUMS; and
# publishes the artifacts to the SSO resource tree (DESIGN-WINDOWS.md §9).
#
# The build itself is driven by scripts/setup-build-env.ps1 (idempotent dev/build
# environment setup: pinned Go version, per-user Inno Setup, checksum-verified
# vendor assets). The workflow only adds signing and publishing on top.
#
# Signing requires GitHub OIDC federation to Azure. If the Azure secrets are
# not configured the workflow still builds and attaches unsigned artifacts.

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

env:
  GO_VERSION: "1.22.2"
  VERSION: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'dev' }}

jobs:
  build-windows:
    runs-on: windows-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      # One idempotent step sets up Inno Setup + fetches/verifies the vendor
      # assets and builds binaries + installer + runs the test suite.
      - name: Setup build environment and build
        shell: pwsh
        run: |
          powershell -NoProfile -ExecutionPolicy Bypass -File scripts/setup-build-env.ps1 -SkipGo -Build -CI
          if ($LASTEXITCODE -ne 0) { throw "setup-build-env failed" }

      - name: Generate SHA256SUMS
        shell: pwsh
        run: |
          Get-ChildItem dist -File | Where-Object {
            $_.Name -match 'windows-.*\.exe$|setup\.exe$' -or $_.Name -eq 'SHA256SUMS'
          } | ForEach-Object {
            "{0}  {1}" -f (Get-FileHash -Algorithm SHA256 $_.FullName).Hash.ToLower(), $_.Name
          } | Set-Content -Path dist/SHA256SUMS

      - name: Sign with Azure Trusted Signing
        if: env.AZURE_TENANT_ID != ''
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: AzureSignTool (agent, tray, helper, CP, installer)
        if: env.AZURE_TENANT_ID != ''
        uses: azure/trusted-signing-action@v0.4.0
        with:
          endpoint: ${{ secrets.AZURE_TS_ENDPOINT }}
          trusted-signing-account-name: ${{ secrets.AZURE_TS_ACCOUNT }}
          certificate-profile-name: ${{ secrets.AZURE_TS_CERT_PROFILE }}
          files: |
            dist/theta-agent-windows-*.exe
            dist/theta-agent-tray-windows-*.exe
            dist/theta-agent-helper-windows-*.exe
            dist/theta-agent-*-setup.exe
          output-files: ""

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: theta-agent-windows
          path: |
            dist/theta-agent-windows-*.exe
            dist/theta-agent-helper-windows-*.exe
            dist/theta-agent-tray-windows-*.exe
            dist/theta-agent-*-setup.exe
            dist/SHA256SUMS

      - name: Attach to GitHub release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/theta-agent-windows-*.exe
            dist/theta-agent-helper-windows-*.exe
            dist/theta-agent-tray-windows-*.exe
            dist/theta-agent-*-setup.exe
            dist/SHA256SUMS

      # DESIGN-WINDOWS.md §9: the SSO holds the release resources. Publish when
      # an admin-gated upload endpoint is configured; otherwise the artifacts
      # are available from the GitHub release above.
      - name: Publish to SSO resource tree
        if: env.SSO_RESOURCE_PUBLISH_URL != ''
        shell: pwsh
        run: |
          $headers = @{ Authorization = "Bearer $env:SSO_RESOURCE_PUBLISH_TOKEN" }
          foreach ($f in Get-ChildItem dist -File) {
            if ($f.Name -notmatch "setup|windows-|SHA256SUMS") { continue }
            Invoke-RestMethod -Method Post -Uri "$env:SSO_RESOURCE_PUBLISH_URL/$($f.Name)" -InFile $f.FullName -Headers $headers
          }
        env:
          SSO_RESOURCE_PUBLISH_URL: ${{ secrets.SSO_RESOURCE_PUBLISH_URL }}
          SSO_RESOURCE_PUBLISH_TOKEN: ${{ secrets.SSO_RESOURCE_PUBLISH_TOKEN }}