theta-agent/.github/workflows/build-windows.yml

name: build-windows

# Builds the Windows agent, tray, session helper, and the fully-offline Inno
# installer; signs them with Azure Trusted Signing; generates SHA256SUMS; and
# publishes the artifacts to the SSO resource tree (DESIGN-WINDOWS.md §9).
#
# Signing requires GitHub OIDC federation to Azure. If the Azure secrets are
# not configured the workflow still builds and attaches unsigned artifacts.

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

env:
  GO_VERSION: "1.22.2"
  VERSION: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'dev' }}

jobs:
  build-windows:
    runs-on: windows-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Run unit tests
        shell: bash
        run: go test ./...

      - name: Build agent, tray, helper
        shell: bash
        run: |
          mkdir -p dist
          LDFLAGS="-s -w"
          for arch in amd64 arm64; do
            GOOS=windows GOARCH=$arch go build -ldflags="$LDFLAGS" -o dist/theta-agent-windows-$arch.exe .
            GOOS=windows GOARCH=$arch go build -ldflags="$LDFLAGS" -o dist/theta-agent-tray-windows-$arch.exe ./cmd/theta-agent-tray/
            GOOS=windows GOARCH=$arch go build -ldflags="$LDFLAGS" -o dist/theta-agent-helper-windows-$arch.exe ./cmd/theta-agent-helper/
          done

      - name: Fetch vendored, vendor-signed dependencies
        shell: pwsh
        run: |
          $vendor = "installer/windows/vendor"
          New-Item -ItemType Directory -Force -Path $vendor | Out-Null
          # Pinned by sha256; WireGuard MSI and VC++ redist are Microsoft/vendor signed.
          $assets = @(
            @{ url = "https://download.wireguard.com/windows-client/wireguard-amd64-0.5.3.msi"; out = "wireguard-amd64-0.5.3.msi"; sha = "PINNED_WIREGUARD_SHA256" },
            @{ url = "https://aka.ms/vs/17/release/vc_redist.x64.exe"; out = "vc_redist.x64.exe"; sha = "PINNED_VC_REDIST_SHA256" }
          )
          foreach ($a in $assets) {
            $dest = Join-Path $vendor $a.out
            Invoke-WebRequest -Uri $a.url -OutFile $dest
            $h = (Get-FileHash -Algorithm SHA256 $dest).Hash.ToLower()
            if ($h -ne $a.sha) { throw "sha256 mismatch for $($a.out): $h" }
            Set-Content -Path "$dest.sha256" -Value $h
          }
          # OpenCredential (pGina fork) release — swap PINNED below for a real release URL.
          $oc = "https://github.com/pedropablobm/OpenCredential/releases/latest/download/OpenCredential.zip"
          Invoke-WebRequest -Uri $oc -OutFile (Join-Path $vendor "opencredential.zip")
          Expand-Archive -Path (Join-Path $vendor "opencredential.zip") -DestinationPath (Join-Path $vendor "OpenCredential")

      - name: Compile Inno installer
        shell: pwsh
        run: |
          choco install innosetup -y --no-progress
          $iscc = "C:\Program Files (x86)\Inno Setup 6\ISCC.exe"
          if (-not (Test-Path $iscc)) { $iscc = "C:\Program Files\Inno Setup 6\ISCC.exe" }
          & $iscc "/DMyAppVersion=${{ env.VERSION }}" installer/windows/installer.iss
          if ($LASTEXITCODE -ne 0) { throw "ISCC failed" }

      - name: Generate SHA256SUMS
        shell: pwsh
        run: |
          Get-ChildItem dist -File | Where-Object { $_.Extension -in ".exe",".msi" -or $_.Name -like "*setup*" } | ForEach-Object {
            "{0}  {1}" -f (Get-FileHash -Algorithm SHA256 $_.FullName).Hash.ToLower(), $_.Name
          } | Set-Content -Path dist/SHA256SUMS

      - name: Sign with Azure Trusted Signing
        if: env.AZURE_TENANT_ID != ''
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: AzureSignTool (agent, tray, helper, CP, installer)
        if: env.AZURE_TENANT_ID != ''
        uses: azure/trusted-signing-action@v0.4.0
        with:
          endpoint: ${{ secrets.AZURE_TS_ENDPOINT }}
          trusted-signing-account-name: ${{ secrets.AZURE_TS_ACCOUNT }}
          certificate-profile-name: ${{ secrets.AZURE_TS_CERT_PROFILE }}
          files: |
            dist/theta-agent-windows-*.exe
            dist/theta-agent-tray-windows-*.exe
            dist/theta-agent-helper-windows-*.exe
            dist/theta-agent-*-setup.exe
          output-files: ""

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: theta-agent-windows
          path: |
            dist/theta-agent-windows-*.exe
            dist/theta-agent-helper-windows-*.exe
            dist/theta-agent-tray-windows-*.exe
            dist/theta-agent-*-setup.exe
            dist/SHA256SUMS

      - name: Attach to GitHub release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/theta-agent-windows-*.exe
            dist/theta-agent-helper-windows-*.exe
            dist/theta-agent-tray-windows-*.exe
            dist/theta-agent-*-setup.exe
            dist/SHA256SUMS

      # DESIGN-WINDOWS.md §9: the SSO holds the release resources. Publish when
      # an admin-gated upload endpoint is configured; otherwise the artifacts
      # are available from the GitHub release above.
      - name: Publish to SSO resource tree
        if: env.SSO_RESOURCE_PUBLISH_URL != ''
        shell: pwsh
        run: |
          $headers = @{ Authorization = "Bearer $env:SSO_RESOURCE_PUBLISH_TOKEN" }
          foreach ($f in Get-ChildItem dist -File) {
            if ($f.Name -notmatch "setup|windows-|SHA256SUMS") { continue }
            Invoke-RestMethod -Method Post -Uri "$env:SSO_RESOURCE_PUBLISH_URL/$($f.Name)" -InFile $f.FullName -Headers $headers
          }
        env:
          SSO_RESOURCE_PUBLISH_URL: ${{ secrets.SSO_RESOURCE_PUBLISH_URL }}
          SSO_RESOURCE_PUBLISH_TOKEN: ${{ secrets.SSO_RESOURCE_PUBLISH_TOKEN }}