release.yml

name: Release

# Tag-triggered Velopack build for WhisperHeim.
# Pushing a tag like `v0.0.1` runs publish → vpk pack → vpk upload, which
# attaches Setup.exe, the full + delta nupkgs, and the RELEASES manifest to a
# GitHub Release named after the tag.
#
# Channel discipline: all `v*` tags currently go to a single Release channel.
# When beta channels are needed, parameterise on tag shape (e.g. `v*-beta`).
# Out of scope here -- see Task 111 notes.

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write   # required for `vpk upload github` to create/update Releases

jobs:
  build:
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET 9
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.x'

      - name: Extract version from tag
        id: ver
        shell: pwsh
        run: |
          $tag = "${{ github.ref_name }}".TrimStart('v')
          "version=$tag" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8

      - name: Publish (self-contained, ReadyToRun, no trimming)
        shell: pwsh
        run: |
          dotnet publish src/WhisperHeim/WhisperHeim.csproj `
            -c Release -r win-x64 --self-contained `
            -p:PublishReadyToRun=true `
            -o publish

      - name: Install vpk (Velopack CLI)
        shell: pwsh
        run: dotnet tool install -g vpk --version 0.0.1298

      - name: Download previous releases (for delta computation)
        # No-ops gracefully on the very first release (no prior tag exists yet).
        # `continue-on-error` so a brand-new repo / first ever tag doesn't fail the job.
        continue-on-error: true
        shell: pwsh
        run: |
          vpk download github `
            --repoUrl https://github.com/${{ github.repository }} `
            --token ${{ secrets.GITHUB_TOKEN }}

      - name: Pack (vpk pack)
        shell: pwsh
        # TODO post-UG (Task 115): insert one of the two signing flags below into the
        # `vpk pack` command. Velopack does incremental signing of both the app binaries
        # and its own Update.exe / Setup.exe in the correct order, so signing MUST go
        # through `vpk pack` -- a post-build `signtool` step would miss bootstrappers.
        #
        # Path A -- Traditional signtool (PFX file + password)
        #   Required GitHub Secrets:
        #     CERT_PFX_BASE64   base64-encoded PFX bundle (private key + cert chain)
        #     CERT_PASSWORD     password for the PFX
        #   Add a step BEFORE this one that decodes the PFX to disk, e.g.:
        #     [IO.File]::WriteAllBytes("$env:RUNNER_TEMP\cert.pfx",
        #       [Convert]::FromBase64String($env:CERT_PFX_BASE64))
        #   Then append to vpk pack:
        #     --signParams "/td sha256 /fd sha256 /tr http://timestamp.acs.microsoft.com /f $env:RUNNER_TEMP\cert.pfx /p $env:CERT_PASSWORD"
        #   env block on this step would set:
        #     CERT_PFX_BASE64: ${{ secrets.CERT_PFX_BASE64 }}
        #     CERT_PASSWORD:   ${{ secrets.CERT_PASSWORD }}
        #
        # Path B -- Azure Trusted Signing (preferred once the UG is registered and
        # enrolled; ~$10/month, no hardware token, no PFX in CI):
        #   Auth via OIDC / federated identity (no secrets in the JSON):
        #     permissions: { id-token: write, contents: write }
        #     - uses: azure/login@v2 with client-id / tenant-id / subscription-id
        #   Commit `signing.json` (Account, CodeSigningAccountName, CertificateProfileName,
        #   EndpointUrl) -- no secrets in the file -- and append to vpk pack:
        #     --azureTrustedSignFile signing.json
        #
        # See docs/release.md "Signing" for the full runbook, and docs/why-unsigned.md
        # for the user-facing rationale that becomes obsolete once signing is enabled.
        run: |
          vpk pack `
            --packId WhisperHeim `
            --packVersion ${{ steps.ver.outputs.version }} `
            --packDir publish `
            --mainExe WhisperHeim.exe `
            --packTitle "Whisperheim" `
            --packAuthors "Marco Heimeshoff"

      - name: SHA-256 of Setup.exe
        id: hash
        shell: pwsh
        run: |
          $setup = Get-ChildItem -Path Releases -Filter '*-Setup.exe' | Select-Object -First 1
          if (-not $setup) { throw "No Setup.exe found in Releases/" }
          $hash = (Get-FileHash -Algorithm SHA256 $setup.FullName).Hash
          Write-Host "Setup.exe: $($setup.Name)"
          Write-Host "SHA-256:   $hash"
          "sha256=$hash" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
          "setup_name=$($setup.Name)" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8

      - name: Upload to GitHub Release
        shell: pwsh
        run: |
          vpk upload github `
            --repoUrl https://github.com/${{ github.repository }} `
            --tag v${{ steps.ver.outputs.version }} `
            --releaseName "Whisperheim ${{ steps.ver.outputs.version }}" `
            --publish `
            --token ${{ secrets.GITHUB_TOKEN }}

      - name: Summary
        shell: pwsh
        run: |
          "## Whisperheim ${{ steps.ver.outputs.version }}" | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
          "" | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
          "- Setup: ``${{ steps.hash.outputs.setup_name }}``" | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
          "- SHA-256: ``${{ steps.hash.outputs.sha256 }}``" | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8