build.yml

name: CI / Release

on:
  push:
    branches: [main]
    tags: ['v*.*.*']
  pull_request:
    branches: [main]

permissions:
  contents: write   # needed to create GitHub Releases

jobs:
  build:
    runs-on: windows-latest
    env:
      # Expose as env var so it can be used in step `if:` conditions
      # (secrets context is not allowed directly in if expressions)
      HAS_SIGNING: ${{ secrets.AZURE_TENANT_ID != '' }}

    steps:
      # ── Checkout ────────────────────────────────────────────────────────────
      - uses: actions/checkout@v7

      # ── .NET 10 ─────────────────────────────────────────────────────────────
      - name: Setup .NET 10
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: '10.x'

      # ── Guard: WiX must reference every file in src/CodeShellManager/Assets.
      # Portable ZIP ships the whole publish output, so this only bites MSI users
      # (e.g. v0.4.1 silently dropped terminal-init.js → blank terminals).
      - name: Verify WiX manifest covers all Assets files
        shell: pwsh
        run: |
          $assetFiles = (Get-ChildItem 'src/CodeShellManager/Assets' -File).Name | Sort-Object
          $wxs = Get-Content 'installer/CodeShellManager.wxs' -Raw
          $matches = [regex]::Matches($wxs, '\$\(var\.PublishDir\)\\Assets\\([^"]+)')
          $wxsRefs = ($matches | ForEach-Object { $_.Groups[1].Value } | Sort-Object -Unique)
          $diff = Compare-Object $assetFiles $wxsRefs
          if ($diff) {
            Write-Host "::error::installer/CodeShellManager.wxs is out of sync with src/CodeShellManager/Assets/"
            $diff | ForEach-Object {
              $side = if ($_.SideIndicator -eq '<=') { 'missing from WiX' } else { 'not present in Assets/' }
              Write-Host "  $($_.InputObject) — $side"
            }
            exit 1
          }
          Write-Host "WiX/Assets in sync ($($assetFiles.Count) files)"
          # Bundled ConPTY files live beside the exe, not under Assets\, so check them by name.
          foreach ($f in 'conpty.dll', 'OpenConsole.exe') {
            if ($wxs -notmatch [regex]::Escape("`$(var.PublishDir)\$f")) {
              Write-Host "::error::installer/CodeShellManager.wxs does not install $f (bundled ConPTY)"
              exit 1
            }
          }
          Write-Host "WiX installs the bundled ConPTY (conpty.dll + OpenConsole.exe)"

      # ── Build (every push / PR) ──────────────────────────────────────────────
      - name: Restore & Build
        run: dotnet build src/CodeShellManager/CodeShellManager.csproj -c Release

      # CI had never run the test suite — it built the app and went straight to
      # packaging, so every test only ever ran on a developer's machine. Found in the
      # v0.8.0 pre-release review, and it matters more than usual now: the regression
      # guards for the WSL command-injection fix (GitServiceInjectionTests) and for the
      # git-off-the-UI-thread fix (GitServiceThreadingTests) live in here.
      #
      # Unit tests only. CodeShellManager.UITests drives the real app through FlaUI and
      # needs an interactive desktop session, which a hosted runner does not reliably
      # provide; adding it here would buy flakiness rather than coverage.
      - name: Test
        run: dotnet test tests/CodeShellManager.Tests/CodeShellManager.Tests.csproj -c Release --nologo

      # ════════════════════════════════════════════════════════════════════════
      # Everything below only runs when a version tag is pushed (e.g. v1.2.3)
      # ════════════════════════════════════════════════════════════════════════

      - name: Extract version from tag
        if: startsWith(github.ref, 'refs/tags/v')
        id: ver
        shell: pwsh
        run: |
          $version = "${{ github.ref_name }}".TrimStart('v')
          "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          Write-Host "Building version $version"

      # ── Publish: self-contained single-file win-x64 ──────────────────────────
      - name: Publish
        if: startsWith(github.ref, 'refs/tags/v')
        shell: pwsh
        run: |
          dotnet publish src/CodeShellManager/CodeShellManager.csproj `
            -c Release `
            -r win-x64 `
            --self-contained true `
            -p:PublishSingleFile=true `
            -p:IncludeNativeLibrariesForSelfExtract=true `
            -p:Version=${{ steps.ver.outputs.version }} `
            -o publish
          # Ensure Assets are always present as loose files alongside the exe
          # (ExcludeFromSingleFile handles this, but belt-and-suspenders for SDK quirks)
          Copy-Item -Path src/CodeShellManager/Assets -Destination publish/Assets -Recurse -Force
          # The unit test pins PerMonitorV2 into the BUILD output; this pins it into the exe
          # that actually ships. Losing the manifest would silently revert to system-DPI
          # scaling (blurry, wrongly sized after a monitor change) — see CLAUDE.md, "DPI
          # awareness and the WebView2 data folder".
          $exe = [System.IO.File]::ReadAllBytes("publish/CodeShellManager.exe")
          if (-not [System.Text.Encoding]::ASCII.GetString($exe).Contains("PerMonitorV2")) {
            throw "Published CodeShellManager.exe does not embed the PerMonitorV2 manifest."
          }
          # Bundled ConPTY: both files must ship as loose files beside the exe (conpty.dll
          # finds OpenConsole.exe next to itself). Missing either silently drops every user
          # back to the inbox ConPTY — see "Bundled ConPTY" in CLAUDE.md.
          foreach ($f in 'conpty.dll', 'OpenConsole.exe') {
            if (-not (Test-Path "publish/$f")) { throw "Bundled ConPTY file missing from publish: $f" }
            $sig = Get-AuthenticodeSignature "publish/$f"
            if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notlike '*O=Microsoft Corporation*') {
              throw "Bundled ConPTY file $f is not validly Microsoft-signed ($($sig.Status))."
            }
          }

      # ── Install WiX v4 ───────────────────────────────────────────────────────
      - name: Install WiX toolset v4 (last open-source release)
        if: startsWith(github.ref, 'refs/tags/v')
        shell: pwsh
        run: |
          dotnet tool install --global wix --version "4.0.5"
          wix extension add --global WixToolset.UI.wixext/4.0.5

      # ── Sign exe (Azure Trusted Signing) ────────────────────────────────────
      # Requires these GitHub secrets to be set on the repo:
      #   AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
      #   AZURE_SIGNING_ENDPOINT  (e.g. https://eus.codesigning.azure.net/)
      #   AZURE_SIGNING_ACCOUNT   (your Trusted Signing account name)
      #   AZURE_SIGNING_PROFILE   (your certificate profile name)
      #
      # Setup guide: https://learn.microsoft.com/azure/trusted-signing/quickstart
      - name: Sign executable (Azure Trusted Signing)
        if: startsWith(github.ref, 'refs/tags/v') && env.HAS_SIGNING == 'true'
        uses: azure/trusted-signing-action@v2.0.0
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          trusted-signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
          certificate-profile-name: ${{ secrets.AZURE_SIGNING_PROFILE }}
          # OUR exe only, by name. publish/ also holds the bundled ConPTY's OpenConsole.exe
          # (and conpty.dll), already signed by Microsoft — the old folder + `exe` filter
          # would have re-signed Microsoft's binary with our certificate.
          files: ${{ github.workspace }}\publish\CodeShellManager.exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      # ── Build MSI ────────────────────────────────────────────────────────────
      - name: Build MSI installer
        if: startsWith(github.ref, 'refs/tags/v')
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force dist | Out-Null
          wix build installer/CodeShellManager.wxs `
            -d Version=${{ steps.ver.outputs.version }} `
            -d PublishDir=publish `
            -ext WixToolset.UI.wixext `
            -arch x64 `
            -o "dist/CodeShellManager-${{ steps.ver.outputs.version }}-Setup.msi"

      # ── Sign MSI (Azure Trusted Signing) ─────────────────────────────────────
      - name: Sign MSI (Azure Trusted Signing)
        if: startsWith(github.ref, 'refs/tags/v') && env.HAS_SIGNING == 'true'
        uses: azure/trusted-signing-action@v2.0.0
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          trusted-signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
          certificate-profile-name: ${{ secrets.AZURE_SIGNING_PROFILE }}
          files-folder: dist
          files-folder-filter: msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      # ── Create portable ZIP ──────────────────────────────────────────────────
      - name: Create portable ZIP
        if: startsWith(github.ref, 'refs/tags/v')
        shell: pwsh
        run: |
          Remove-Item publish\*.pdb -ErrorAction SilentlyContinue
          Compress-Archive -Path publish\* `
            -DestinationPath "dist/CodeShellManager-${{ steps.ver.outputs.version }}-win-x64.zip"

      # ── Create GitHub Release ────────────────────────────────────────────────
      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v3
        with:
          generate_release_notes: true
          files: |
            dist/*.msi
            dist/*.zip