release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      dry_run_publish:
        description: "Build and validate release without winget publication"
        required: false
        default: "false"
        type: choice
        options:
          - "false"
          - "true"

# Read-only by default: only the job that publishes the GitHub release gets write access.
permissions:
  contents: read

jobs:
  build:
    # Match the Windows 11-era APIs exercised by the native integration tests.
    runs-on: windows-2025
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
      prerelease: ${{ steps.version.outputs.prerelease }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: "8.0.x"

      - name: Resolve version
        id: version
        shell: pwsh
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          $refName = $env:REF_NAME
          if ($refName -match '^v\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$') {
            $version = $refName.TrimStart('v')
            $tag = $refName
          }
          else {
            [xml]$project = Get-Content "ThreadPilot.csproj"
            $version = $project.Project.PropertyGroup.Version
            if ([string]::IsNullOrWhiteSpace($version)) {
              throw "Unable to resolve version from tag or ThreadPilot.csproj"
            }

            $tag = "v$version"
          }

          $prerelease = $version.Contains('-').ToString().ToLowerInvariant()
          "prerelease=$prerelease" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
          "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
          "tag=$tag" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append

      - name: Restore
        run: dotnet restore "ThreadPilot_1.sln"

      - name: Build
        run: dotnet build "ThreadPilot_1.sln" --configuration Release --no-restore

      - name: Test
        run: dotnet test "Tests/ThreadPilot.Core.Tests/ThreadPilot.Core.Tests.csproj" --configuration Release --no-restore --verbosity normal --collect:"XPlat Code Coverage" --settings "Tests/ThreadPilot.Core.Tests/coverlet.runsettings" --results-directory TestResults

      - name: Publish self-contained single-file
        run: dotnet publish "ThreadPilot.csproj" --configuration Release -p:PublishProfile=WinX64-SingleFile

      - name: Publish ReadyToRun
        run: dotnet publish "ThreadPilot.csproj" --configuration Release -p:PublishProfile=WinX64-ReadyToRun

      - name: Install Inno Setup
        shell: pwsh
        run: choco install innosetup --version=6.7.1 --no-progress -y

      - name: Build Inno Setup installer
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $version = "${{ steps.version.outputs.version }}"
          $sourceDir = (Resolve-Path "artifacts/release/singlefile").Path

          & iscc.exe "/DMyAppVersion=$version" "/DMyAppSourceDir=$sourceDir" "Installer/setup.iss"

      - name: Prepare signing certificate (optional)
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_SIGNING_CERT_BASE64) -or [string]::IsNullOrWhiteSpace($env:WINDOWS_SIGNING_CERT_PASSWORD))
          {
            Write-Host "Signing secrets not provided via environment variables. Skipping certificate preparation."
            exit 0
          }

          $certPath = Join-Path $env:RUNNER_TEMP "threadpilot-signing.pfx"
          [System.IO.File]::WriteAllBytes($certPath, [System.Convert]::FromBase64String($env:WINDOWS_SIGNING_CERT_BASE64))
          "THREADPILOT_SIGN_CERT_PATH=$certPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Sign binaries and packages (optional)
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          if ([string]::IsNullOrWhiteSpace($env:THREADPILOT_SIGN_CERT_PATH) -or -not (Test-Path $env:THREADPILOT_SIGN_CERT_PATH))
          {
            Write-Host "No signing certificate prepared. Skipping signing step."
            exit 0
          }

          if (-not (Get-Command signtool.exe -ErrorAction SilentlyContinue))
          {
            throw "signtool.exe not found on runner; install Windows SDK or disable signing."
          }

          $timestampUrl = "http://timestamp.digicert.com"
          $password = $env:WINDOWS_SIGNING_CERT_PASSWORD
          $targets = @()
          $targets += Get-ChildItem "artifacts/release/singlefile" -Recurse -File -Include *.exe -ErrorAction SilentlyContinue
          $targets += Get-ChildItem "artifacts/release/readytorun" -Recurse -File -Include *.exe -ErrorAction SilentlyContinue
          $targets += Get-ChildItem "artifacts/release/installer" -Recurse -File -Include *.exe -ErrorAction SilentlyContinue

          foreach ($target in $targets)
          {
            signtool.exe sign /fd SHA256 /tr $timestampUrl /td SHA256 /f "$env:THREADPILOT_SIGN_CERT_PATH" /p $password "$($target.FullName)"
          }

      - name: Create release packages
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $version = "${{ steps.version.outputs.tag }}"
          New-Item -ItemType Directory -Force -Path "artifacts/release/packages" | Out-Null
          New-Item -ItemType Directory -Force -Path "artifacts/release/package-staging" | Out-Null

          $sharedUninstall = "artifacts/release/package-staging/uninstall.bat"
          $sharedLicense = "artifacts/release/package-staging/LICENSE.md"

          $uninstallContent = @'
          @echo off
          setlocal EnableExtensions
          title ThreadPilot Uninstaller

          set "APP_DIR=%~dp0"
          if "%APP_DIR:~-1%"=="\" set "APP_DIR=%APP_DIR:~0,-1%"

          echo ======================================================
          echo ThreadPilot Uninstaller
          echo ======================================================
          echo.

          echo [1/4] Closing running ThreadPilot processes...
          taskkill /IM "ThreadPilot.exe" /F >nul 2>&1

          echo [2/4] Removing startup task and startup registry entry...
          schtasks /Delete /TN "ThreadPilot_Launch" /F >nul 2>&1
          schtasks /Delete /TN "ThreadPilot_Startup" /F >nul 2>&1
          reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ThreadPilot" /f >nul 2>&1

          echo [3/4] Removing ThreadPilot user data for this Windows account...
          rem Full uninstall removes only ThreadPilot-owned per-user AppData. Normal install/update paths never run this script.
          if exist "%APPDATA%\ThreadPilot" (
            rd /s /q "%APPDATA%\ThreadPilot"
            echo ThreadPilot user data removed.
          ) else (
            echo No ThreadPilot user data folder found.
          )

          echo [4/4] Scheduling app folder removal...
          start "" /min cmd /c "timeout /t 5 /nobreak >nul & rd /s /q \"%APP_DIR%\""

          echo.
          echo Uninstall completed. Remaining files will be removed in a few seconds.
          endlocal
          exit /b 0
          '@

          Set-Content -LiteralPath $sharedUninstall -Value $uninstallContent -Encoding Ascii
          Copy-Item "LICENSE" -Destination $sharedLicense -Force

          $portableStage = "artifacts/release/package-staging/portable"
          New-Item -ItemType Directory -Force -Path $portableStage | Out-Null

          Copy-Item "artifacts/release/singlefile/*" -Destination $portableStage -Recurse -Force

          Copy-Item $sharedUninstall -Destination (Join-Path $portableStage "uninstall.bat") -Force
          Copy-Item $sharedLicense -Destination (Join-Path $portableStage "LICENSE.md") -Force

          $portableZip = "artifacts/release/packages/ThreadPilot_$version`_Portable.zip"

          Compress-Archive -Path "$portableStage/*" -DestinationPath $portableZip -Force

      - name: Generate checksums
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $hashFile = "artifacts/release/SHA256SUMS.txt"

          $releaseFiles = @()
          $releaseFiles += Get-ChildItem "artifacts/release/packages" -File -ErrorAction SilentlyContinue
          $releaseFiles += Get-ChildItem "artifacts/release/installer/*.exe" -File -ErrorAction SilentlyContinue

          $releaseFiles | ForEach-Object {
            $hash = Get-FileHash $_.FullName -Algorithm SHA256
            "$($hash.Hash)  $($_.Name)" | Out-File -FilePath $hashFile -Append -Encoding utf8
          }

      - name: Generate winget manifests
        if: steps.version.outputs.prerelease != 'true'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $version = "${{ steps.version.outputs.version }}"
          $tag = "${{ steps.version.outputs.tag }}"
          $installer = Get-ChildItem "artifacts/release/installer/*.exe" -File | Select-Object -First 1
          if (-not $installer)
          {
            throw "Installer executable not found."
          }

          $sha = (Get-FileHash $installer.FullName -Algorithm SHA256).Hash.ToUpperInvariant()
          $url = "https://github.com/${{ github.repository }}/releases/download/$tag/$($installer.Name)"

          ./build/generate-winget-manifests.ps1 `
            -Version $version `
            -Tag $tag `
            -InstallerUrl $url `
            -InstallerSha256 $sha `
            -OutputRoot "winget-manifests"

      - name: Generate SBOM
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          dotnet tool install --global Microsoft.Sbom.DotNetTool --version 4.1.13
          $env:PATH += ";$env:USERPROFILE\.dotnet\tools"
          sbom-tool generate -b ./artifacts -bc . -pn ThreadPilot -pv "${{ steps.version.outputs.version }}" -ps PrimeBuild -nsb https://github.com/PrimeBuild-pc/ThreadPilot

          $sbomReleaseDir = "artifacts/release/sbom"
          New-Item -ItemType Directory -Force -Path $sbomReleaseDir | Out-Null

          $sbomManifest = Get-ChildItem "artifacts" -Recurse -File -Filter "manifest.spdx.json" -ErrorAction SilentlyContinue |
            Sort-Object LastWriteTimeUtc -Descending |
            Select-Object -First 1

          if (-not $sbomManifest)
          {
            throw "SBOM manifest not found under artifacts after generation."
          }

          Copy-Item -LiteralPath $sbomManifest.FullName -Destination (Join-Path $sbomReleaseDir "manifest.spdx.json") -Force

      - name: Upload portable artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-portable
          path: artifacts/release/singlefile

      - name: Upload installer artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-installer
          path: artifacts/release/installer

      - name: Upload packages artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-packages
          path: artifacts/release/packages

      - name: Upload checksums artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-checksums
          path: artifacts/release/SHA256SUMS.txt

      - name: Upload winget manifests
        if: steps.version.outputs.prerelease != 'true'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: winget-manifests
          path: winget-manifests

      - name: Upload SBOM
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: sbom
          path: artifacts/release/sbom/manifest.spdx.json
          if-no-files-found: error

  smoke-test:
    runs-on: windows-2025
    needs: build

    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-portable
          path: smoke

      - name: Smoke test
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $exe = Get-ChildItem "smoke" -Recurse -Filter "ThreadPilot.exe" -File | Select-Object -First 1
          if (-not $exe)
          {
            throw "ThreadPilot.exe not found in smoke-test artifact."
          }

          $process = Start-Process -FilePath $exe.FullName -ArgumentList "--smoke-test" -Wait -PassThru
          if ($process.ExitCode -ne 0)
          {
            throw "Smoke test failed with exit code $($process.ExitCode)."
          }

  release:
    runs-on: ubuntu-latest
    # Protected environment: waits for the maintainer's approval before it can write the release.
    environment: release
    permissions:
      contents: write
    needs:
      - build
      - smoke-test

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Download installer artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-installer
          path: release-assets/installer

      - name: Download packages artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-packages
          path: release-assets/packages

      - name: Download checksums artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-checksums
          path: release-assets

      - name: Download winget manifests
        if: needs.build.outputs.prerelease != 'true'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: winget-manifests
          path: winget-manifests

      - name: Download SBOM artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: sbom
          path: sbom

      - name: Validate release assets
        shell: bash
        run: |
          set -euo pipefail

          compgen -G "release-assets/installer/*.exe" > /dev/null || { echo "Missing installer executable in release-assets/installer"; exit 1; }
          compgen -G "release-assets/packages/*.zip" > /dev/null || { echo "Missing release package zip in release-assets/packages"; exit 1; }
          test -f "release-assets/SHA256SUMS.txt" || { echo "Missing release checksums file"; exit 1; }
          if [ "${{ needs.build.outputs.prerelease }}" != "true" ]; then
            find "winget-manifests" -type f -name "*.yaml" | grep -q . || { echo "Missing winget manifest yaml files"; exit 1; }
          fi
          test -f "sbom/manifest.spdx.json" || { echo "Missing SBOM manifest"; exit 1; }

      - name: Stage public GitHub release assets
        shell: bash
        run: |
          set -euo pipefail

          tag="${{ needs.build.outputs.tag }}"
          mkdir -p public-release-assets

          cp "release-assets/installer/ThreadPilot_${tag}_Setup.exe" "public-release-assets/ThreadPilot_${tag}_Setup.exe"
          cp "release-assets/packages/ThreadPilot_${tag}_Portable.zip" "public-release-assets/ThreadPilot_${tag}_Portable.zip"
          cp "release-assets/SHA256SUMS.txt" "public-release-assets/SHA256SUMS.txt"

          expected_count=3
          actual_count="$(find public-release-assets -maxdepth 1 -type f | wc -l | tr -d ' ')"
          if [ "$actual_count" != "$expected_count" ]; then
            echo "Expected $expected_count public release asset files, found $actual_count."
            find public-release-assets -maxdepth 1 -type f -print
            exit 1
          fi

      - name: Install git-cliff
        uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
        with:
          tool: git-cliff@2.10.0

      - name: Generate changelog
        id: git-cliff
        shell: bash
        run: |
          set -euo pipefail
          if [ -f "docs/releases/${{ needs.build.outputs.tag }}.md" ]; then
            cp "docs/releases/${{ needs.build.outputs.tag }}.md" release-notes.md
          else
            git-cliff --config cliff.toml --latest > release-notes.md
          fi

          {
            echo "content<<EOF"
            cat release-notes.md
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Contributors file check (manual maintenance mode)
        shell: pwsh
        run: |
          if (-not (Test-Path "CONTRIBUTORS.md")) {
            throw "CONTRIBUTORS.md not found."
          }

          Write-Host "CONTRIBUTORS.md is maintained manually in this workflow."

      - name: Publish GitHub release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ needs.build.outputs.tag }}
          name: ThreadPilot ${{ needs.build.outputs.tag }}
          body: ${{ steps.git-cliff.outputs.content }}
          files: |
            public-release-assets/ThreadPilot_${{ needs.build.outputs.tag }}_Setup.exe
            public-release-assets/ThreadPilot_${{ needs.build.outputs.tag }}_Portable.zip
            public-release-assets/SHA256SUMS.txt
          prerelease: ${{ needs.build.outputs.prerelease == 'true' }}
          make_latest: ${{ needs.build.outputs.prerelease == 'true' && 'false' || 'true' }}
          generate_release_notes: true

  publish-winget:
    runs-on: windows-2022
    environment: release
    needs:
      - build
      - release
    if: needs.release.result == 'success' && needs.build.outputs.prerelease != 'true'

    steps:
      - name: Resolve winget publish policy
        id: policy
        shell: pwsh
        env:
          EVENT_NAME: ${{ github.event_name }}
          DRY_RUN_INPUT: ${{ github.event.inputs.dry_run_publish }}
        run: |
          $ErrorActionPreference = "Stop"
          $dryRun = $env:EVENT_NAME -eq "workflow_dispatch" -and $env:DRY_RUN_INPUT -eq "true"
          "dry_run=$($dryRun.ToString().ToLowerInvariant())" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append

      - name: Check winget publish policy
        id: gate
        shell: pwsh
        env:
          WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
          WINGET_FORK_OWNER: ${{ secrets.WINGET_FORK_OWNER }}
        run: |
          $ErrorActionPreference = "Stop"
          $logsDir = "release-channel-logs"
          New-Item -ItemType Directory -Force -Path $logsDir | Out-Null
          $logPath = Join-Path $logsDir "winget-submit-log.txt"
          $dryRun = "${{ steps.policy.outputs.dry_run }}" -eq "true"

          if ($dryRun)
          {
            $summary = @(
              "## winget publish",
              "- attempted: false",
              "- version: ${{ needs.build.outputs.version }}",
              "- result: dry-run",
              "- reason: workflow_dispatch requested dry_run_publish=true"
            )

            $summary | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Encoding utf8 -Append
            "Dry run requested. Winget submission intentionally skipped." | Set-Content -Path $logPath -Encoding utf8
            "enabled=false" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
            exit 0
          }

          if ([string]::IsNullOrWhiteSpace($env:WINGET_GITHUB_TOKEN) -or [string]::IsNullOrWhiteSpace($env:WINGET_FORK_OWNER))
          {
            $message = "Winget publish secrets are missing. Refusing to report a green public release without a submission attempt."
            $summary = @(
              "## winget publish",
              "- attempted: false",
              "- version: ${{ needs.build.outputs.version }}",
              "- result: failed-policy",
              "- reason: missing WINGET_GITHUB_TOKEN and/or WINGET_FORK_OWNER"
            )

            $summary | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Encoding utf8 -Append
            $message | Set-Content -Path $logPath -Encoding utf8
            throw $message
          }

          "enabled=true" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append

      - name: Checkout
        if: steps.gate.outputs.enabled == 'true'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download winget manifests
        if: steps.gate.outputs.enabled == 'true'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: winget-manifests
          path: winget-manifests

      - name: Submit winget PR
        if: steps.gate.outputs.enabled == 'true'
        shell: pwsh
        env:
          WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
          WINGET_FORK_OWNER: ${{ secrets.WINGET_FORK_OWNER }}
        run: |
          $ErrorActionPreference = "Stop"
          $logsDir = "release-channel-logs"
          New-Item -ItemType Directory -Force -Path $logsDir | Out-Null
          $logPath = Join-Path $logsDir "winget-submit-log.txt"

          try
          {
            & ./build/submit-winget-pr.ps1 `
              -Version "${{ needs.build.outputs.version }}" `
              -ManifestSourcePath "winget-manifests" `
              -ForkOwner "$env:WINGET_FORK_OWNER" `
              -RepositoryOwner "PrimeBuild" `
              -PackageIdentifier "PrimeBuild.ThreadPilot" `
              -GithubToken "$env:WINGET_GITHUB_TOKEN" *>&1 | Tee-Object -FilePath $logPath

            if ($LASTEXITCODE -ne 0)
            {
              throw "submit-winget-pr.ps1 exited with code $LASTEXITCODE"
            }

            @(
              "## winget publish",
              "- attempted: true",
              "- version: ${{ needs.build.outputs.version }}",
              "- result: submitted"
            ) | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Encoding utf8 -Append
          }
          catch
          {
            @(
              "## winget publish",
              "- attempted: true",
              "- version: ${{ needs.build.outputs.version }}",
              "- result: failed"
            ) | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Encoding utf8 -Append
            throw
          }

      - name: Upload winget publish logs
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: winget-publish-logs
          path: release-channel-logs/winget-submit-log.txt
          if-no-files-found: error