windows.yml

name: Windows

on:
  pull_request:
    paths:
      - '**.c'
      - '**.h'
      - '**.sh'
      - .github/workflows/windows.yml
      - '**.am'
      - '**.mak'
      - configure.ac
  push:

permissions:
  contents: read  #  to fetch code (actions/checkout)

jobs:
  build:
    runs-on: ${{ matrix.image }}
    strategy:
      matrix:
        platform: [x86, x64, arm64]
        configuration: [Light, Release]
        image: [windows-2025]
        include:
          - platform: x86
            setenv: amd64_x86
          - platform: x64
            setenv: amd64
          - platform: arm64
            setenv: amd64_arm64
    env:
      OPENPACE_VER: 1.1.3
      VCPKG_INSTALLED: ${{ github.workspace }}\vcpkg_installed
      VCPKG_DEFAULT_TRIPLET: ${{ matrix.platform }}-windows-static
      BUILD_NUMBER: ${{ github.run_number }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Package suffix
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "push" ]]; then
            if [[ "${{ github.ref_type }}" == "tag" && "${{ github.ref_name }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(.+)$ ]]; then
              SUFFIX="${BASH_REMATCH[1]}"
            elif [[ "${{ github.ref_name }}" != "master" ]]; then
              SUFFIX="-${{ github.ref_name }}"
            fi
          elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
            if [[ "${{ github.base_ref }}" == "master" ]]; then
              SUFFIX="-pr${{ github.event.number }}"
            else
              SUFFIX="-${{ github.base_ref }}-pr${{ github.event.number }}"
            fi
          fi
          PACKAGE_SUFFIX="${{ matrix.configuration == 'Light' && '-Light' || '' }}${SUFFIX}"
          sed -i.bak "s/^PACKAGE_SUFFIX=\([-~]*[0-9a-zA-Z]*\)$/PACKAGE_SUFFIX=$PACKAGE_SUFFIX/g" VERSION.mk
          cat VERSION.mk
      - name: Install CPDK
        run: choco install windows-cryptographic-provider-development-kit -y > $null
      - name: Setup dev env
        uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: ${{ matrix.setenv }}
      - name: Cache vcpkg
        if: matrix.configuration == 'Release'
        uses: actions/cache@v5
        with:
          path: ${{ github.workspace }}/vcpkg_cache
          key: vcpkg-${{ matrix.configuration }}-${{ matrix.platform }}-${{ hashFiles('.github/vcpkg.json') }}
      - name: Prepare vcpkg
        if: matrix.configuration == 'Release'
        env:
          VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg_cache,readwrite
        run: |
          C:\vcpkg\vcpkg install `
            --x-manifest-root ${{ github.workspace }}/.github `
            --x-install-root ${env:VCPKG_INSTALLED}
      - name: Install WIX
        run: powershell -ExecutionPolicy Bypass -File .github/setup-wix.ps1
      - name: Restore Cache
        if: matrix.configuration == 'Release'
        uses: actions/cache@v5
        id: cache
        with:
          path: openpace-${{ env.OPENPACE_VER }}
          key: OpenPACE-${{ env.OPENPACE_VER }}-${{ matrix.image }}-${{ matrix.platform }}
      - name: Build OpenPACE
        if: matrix.configuration == 'Release' && steps.cache.outputs.cache-hit != 'true'
        run: |
          Invoke-WebRequest "https://github.com/frankmorgner/openpace/archive/${env:OPENPACE_VER}.zip" -OutFile openpace.zip
          tar xf openpace.zip
          cd openpace-${env:OPENPACE_VER}\src
          cl /nologo /O1 /Zi /W3 /GS /MT /I${env:VCPKG_INSTALLED}\${env:VCPKG_DEFAULT_TRIPLET}\include /I. `
            /DX509DIR=`"/`" /DCVCDIR=`"/`" /D_CRT_SECURE_NO_DEPRECATE /DWIN32_LEAN_AND_MEAN `
            /DHAVE_ASN1_STRING_GET0_DATA /DHAVE_DECL_OPENSSL_ZALLOC /DHAVE_DH_GET0_KEY /DHAVE_DH_GET0_PQG `
            /DHAVE_DH_SET0_KEY /DHAVE_DH_SET0_PQG /DHAVE_ECDSA_SIG_GET0 /DHAVE_ECDSA_SIG_SET0 `
            /DHAVE_EC_KEY_METHOD /DHAVE_RSA_GET0_KEY /DHAVE_RSA_SET0_KEY /DHAVE_EC_POINT_GET_AFFINE_COORDINATES `
            /DHAVE_EC_POINT_SET_AFFINE_COORDINATES /DHAVE_EVP_PKEY_DUP /c `
            ca_lib.c cv_cert.c cvc_lookup.c x509_lookup.c eac_asn1.c eac.c eac_ca.c eac_dh.c `
            eac_ecdh.c eac_kdf.c eac_lib.c eac_print.c eac_util.c misc.c pace.c pace_lib.c `
            pace_mappings.c ri.c ri_lib.c ta.c ta_lib.c objects.c ssl_compat.c
          lib /nologo /out:libeac.lib `
            ca_lib.obj cv_cert.obj cvc_lookup.obj x509_lookup.obj eac_asn1.obj eac.obj eac_ca.obj eac_dh.obj `
            eac_ecdh.obj eac_kdf.obj eac_lib.obj eac_print.obj eac_util.obj misc.obj pace.obj pace_lib.obj `
            pace_mappings.obj ri.obj ri_lib.obj ta.obj ta_lib.obj objects.obj ssl_compat.obj
      - name: Set NMake Variables
        if: matrix.configuration == 'Release'
        run: |
          $VCPKG_DIR="${env:VCPKG_INSTALLED}\${env:VCPKG_DEFAULT_TRIPLET}"
          echo "ZLIBSTATIC_DEF=/DENABLE_ZLIB_STATIC" >> $env:GITHUB_ENV
          echo "ZLIB_INCL_DIR=/I${VCPKG_DIR}\include" >> $env:GITHUB_ENV
          echo "ZLIB_LIB=${VCPKG_DIR}\lib\zlib.lib" >> $env:GITHUB_ENV
          echo "OPENSSL_DEF=/DENABLE_OPENSSL" >> $env:GITHUB_ENV
          echo "OPENSSL_DIR=${VCPKG_DIR}" >> $env:GITHUB_ENV
          echo "OPENSSL_LIB=${VCPKG_DIR}\lib\libcrypto.lib" >> $env:GITHUB_ENV
          echo "OPENSSL_EXTRA_CFLAGS=/DOPENSSL_SECURE_MALLOC_SIZE=65536" >> $env:GITHUB_ENV
          echo "OPENPACE_DEF=/DENABLE_OPENPACE" >> $env:GITHUB_ENV
          echo "OPENPACE_DIR=${env:GITHUB_WORKSPACE}\openpace-${env:OPENPACE_VER}" >> $env:GITHUB_ENV
      - name: Build OpenSC
        run: nmake /nologo /f Makefile.mak opensc.msi
      - name: Archive artifacts
        id: upload-unsigned-artifact
        uses: actions/upload-artifact@v6
        with:
          name: msi_${{ matrix.image }}_${{ matrix.platform }}_${{ matrix.configuration }}
          path: ./win32/*.msi
      - name: Push to Signpath.io
        if: ${{ startsWith(github.ref, 'refs/tags/') && github.repository == 'OpenSC/OpenSC' }}
        uses: signpath/github-action-submit-signing-request@v2
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '8d2463fe-39bd-4a41-bb72-f008b4b1fe17'
          project-slug: 'OpenSC'
          signing-policy-slug: 'release-signing'
          github-artifact-id: '${{ steps.upload-unsigned-artifact.outputs.artifact-id }}'
          wait-for-completion: false
      - name: Archive debug artifacts
        uses: actions/upload-artifact@v6
        with:
          name: debug_${{ matrix.image }}_${{ matrix.platform }}_${{ matrix.configuration }}
          path: |
            ./src/**/*.pdb
            ./win32/*.pdb
            !./src/**/vc*.pdb
            !./win32/vc*.pdb