build.yml

name: build

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

permissions:
  contents: write   # needed to publish a Release on tag pushes

jobs:
  build:
    runs-on: windows-latest
    # Map secrets to env here — the `secrets` context can't be used in a step `if:`.
    env:
      SIGN_PFX_BASE64: ${{ secrets.SIGN_PFX_BASE64 }}
      SIGN_PFX_PASSWORD: ${{ secrets.SIGN_PFX_PASSWORD }}
    steps:
      - uses: actions/checkout@v4

      # Uses the in-box .NET Framework C# compiler that ships on the runner — no SDK needed.
      - name: Build
        shell: pwsh
        run: ./build.ps1

      # Optional code signing: only runs if you add the SIGN_PFX_BASE64 repo secret
      # (and SIGN_PFX_PASSWORD). Without it, the build is unsigned and this step is skipped.
      - name: Sign (optional)
        if: ${{ env.SIGN_PFX_BASE64 != '' }}
        shell: pwsh
        run: |
          $pfx = Join-Path $env:RUNNER_TEMP cert.pfx
          [IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:SIGN_PFX_BASE64))
          $signtool = Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\bin\*\x64\signtool.exe" |
                      Sort-Object FullName | Select-Object -Last 1
          & $signtool.FullName sign /f $pfx /p $env:SIGN_PFX_PASSWORD /fd SHA256 `
              /tr http://timestamp.digicert.com /td SHA256 bin\LoadView.exe

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: LoadView
          path: bin/LoadView.exe

      - name: Release on tag
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v2
        with:
          files: bin/LoadView.exe