release.yml

name: Release

# A version tag (v1.2.3) builds, tests and packages the app and creates a
# DRAFT GitHub release with the zip, its SHA-256 and a build provenance
# attestation. Publishing the draft is a manual step. Run it by hand
# (workflow_dispatch) for a dry run that only uploads the zip as an artifact.
on:
  push:
    tags: ['v*']
  workflow_dispatch:

permissions:
  contents: read

jobs:
  package:
    name: Build and package (x64)
    runs-on: windows-2025
    timeout-minutes: 30
    permissions:
      contents: write        # create the draft release
      id-token: write        # sign the provenance attestation
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Build and test
        run: cmake --workflow --preset ci

      # A tag must match the version compiled into the executables.
      - name: Check the version
        if: startsWith(github.ref, 'refs/tags/')
        shell: pwsh
        env:
          TAG: ${{ github.ref_name }}
        run: |
          $built = (& .\build\Release\gao.exe --version).Split(' ')[-1]
          if ("v$built" -ne $env:TAG) { throw "tag $env:TAG does not match the built version $built" }

      - name: Package
        shell: pwsh
        env:
          NAME: ${{ github.ref_type == 'tag' && github.ref_name || 'dev' }}
        run: |
          $stage = New-Item -ItemType Directory "dist/GpuAutoOptimizer"
          Copy-Item build/Release/GpuAutoOptimizer.exe, build/Release/gao.exe, README.md, LICENSE, THIRD-PARTY-NOTICES.md $stage
          $zip = "dist/GpuAutoOptimizer-$env:NAME-win-x64.zip"
          Compress-Archive -Path "$stage/*" -DestinationPath $zip
          Get-FileHash $zip -Algorithm SHA256 | ForEach-Object { "$($_.Hash.ToLower())  $(Split-Path $zip -Leaf)" } |
            Set-Content -Encoding ascii "$zip.sha256"
          Remove-Item $stage -Recurse

      - name: Upload (dry run)
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: GpuAutoOptimizer-dev
          path: dist/

      - name: Attest build provenance
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/*.zip

      - name: Create draft release
        if: startsWith(github.ref, 'refs/tags/')
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        # A tag with a hyphen (v1.2.3-rc1) is a pre-release: GitHub's
        # "latest release" answer skips it, so the update check does not
        # offer it to users of the stable version.
        run: |
          $pre = if ($env:TAG -like '*-*') { '--prerelease' } else { @() }
          gh release create $env:TAG $pre (Get-ChildItem dist/*).FullName --draft --verify-tag --generate-notes --title "GPU Auto Optimizer $env:TAG"