name: Build and test

concurrency:
  group: w64devkit-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
  pull_request:
    branches: [ "master" ]

# Must set Settings -> Actions -> General -> Workflow permissions to
# "Read and write permissions"
permissions:
  contents: write
  id-token: write

jobs:
  build-x64:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    env:
      ARCH: x64

    steps:
      - uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Generate archive name and version string
        id: filename
        run: |
          GIT_VERSION="$(git describe --tags --always)"
          VERSION="${GIT_VERSION#v}"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "archive=w64devkit-$ARCH-$VERSION" >> $GITHUB_OUTPUT

      - name: Build image
        uses: docker/build-push-action@v7
        with:
          context: .
          build-args: VARIANT=x64
          tags: w64devkit:${{ env.ARCH }}
          load: true
          cache-from: type=gha,scope=w64devkit-${{ env.ARCH }}
          cache-to: type=gha,scope=w64devkit-${{ env.ARCH }},mode=max,ignore-error=true

      - name: Build source image
        if: startsWith(github.ref, 'refs/tags/')
        uses: docker/build-push-action@v7
        with:
          context: .
          target: source
          tags: w64devkit:source
          load: true
          cache-from: type=gha,scope=w64devkit-${{ env.ARCH }}

      - name: Extract artifact
        run: |
          docker run --rm w64devkit:${{ env.ARCH }} > w64devkit.exe
          mv w64devkit.exe ${{ steps.filename.outputs.archive }}.7z.exe
          ls -lh ${{ steps.filename.outputs.archive }}.7z.exe

      - name: Extract source tarball
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          docker run --rm w64devkit:source tar cf - \
            --sort=name --mtime='1970-01-01' --owner=0 --group=0 --numeric-owner \
            source/ > source.tar
          ls -lh source.tar

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ steps.filename.outputs.archive }}.7z.exe
          path: ${{ steps.filename.outputs.archive }}.7z.exe
          archive: false

      - name: Upload source tarball
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@v7
        with:
          name: source.tar
          path: source.tar
          archive: false

  build-x86:
    runs-on: ubuntu-latest
    needs: build-x64
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
    env:
      ARCH: x86

    steps:
      - uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Generate archive name and version string
        id: filename
        run: |
          GIT_VERSION="$(git describe --tags --always)"
          VERSION="${GIT_VERSION#v}"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "archive=w64devkit-$ARCH-$VERSION" >> $GITHUB_OUTPUT

      - name: Build image
        uses: docker/build-push-action@v7
        with:
          context: .
          build-args: VARIANT=x86
          tags: w64devkit:${{ env.ARCH }}
          load: true
          cache-from: type=gha,scope=w64devkit-${{ env.ARCH }}
          cache-to: type=gha,scope=w64devkit-${{ env.ARCH }},mode=max,ignore-error=true

      - name: Extract artifact
        run: |
          docker run --rm w64devkit:${{ env.ARCH }} > w64devkit.exe
          mv w64devkit.exe ${{ steps.filename.outputs.archive }}.7z.exe
          ls -lh ${{ steps.filename.outputs.archive }}.7z.exe

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ steps.filename.outputs.archive }}.7z.exe
          path: ${{ steps.filename.outputs.archive }}.7z.exe
          archive: false

  release:
    needs: [build-x64, build-x86]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    environment: release

    env:
      AZURE_CLIENT_ID:   ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID:   ${{ secrets.AZURE_TENANT_ID }}
      AAS_SIGN_ENDPOINT: ${{ secrets.TRUSTED_SIGNING_ENDPOINT }}
      AAS_SIGN_ACCOUNT:  ${{ secrets.TRUSTED_SIGNING_ACCOUNT }}
      AAS_SIGN_PROFILE:  ${{ secrets.CERTIFICATE_PROFILE }}

    steps:
      - uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Compute version
        id: filename
        run: |
          VERSION=${GITHUB_REF_NAME#v}
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      # Checkout leaves a lightweight tag, so re-fetch the annotated tag
      # to read its message. The body omits the "Release vX.Y.Z" subject
      # and the signature. Do this before the slow builds to fail early.
      - name: Release notes from the tag
        run: |
          git fetch --force origin \
              "refs/tags/$GITHUB_REF_NAME:refs/tags/$GITHUB_REF_NAME"
          git tag -l --format='%(contents:body)' "$GITHUB_REF_NAME" \
              >"$RUNNER_TEMP/notes.md"
          if ! grep -q '[^[:space:]]' "$RUNNER_TEMP/notes.md"; then
              echo "::error::tag $GITHUB_REF_NAME has no message body"
              exit 1
          fi
          cat "$RUNNER_TEMP/notes.md"

      - name: Build signed image (x64)
        uses: docker/build-push-action@v7
        with:
          context: .
          build-args: VARIANT=x64
          target: signed
          tags: w64devkit:x64-signed
          load: true
          cache-from: type=gha,scope=w64devkit-x64
          cache-to: type=gha,scope=w64devkit-x64,mode=max,ignore-error=true

      - name: Sign and pack (x64)
        run: |
          docker run --rm \
            -e AZURE_CLIENT_ID -e AZURE_TENANT_ID \
            -e AAS_SIGN_ENDPOINT -e AAS_SIGN_ACCOUNT -e AAS_SIGN_PROFILE \
            -e ACTIONS_ID_TOKEN_REQUEST_URL -e ACTIONS_ID_TOKEN_REQUEST_TOKEN \
            w64devkit:x64-signed \
            > w64devkit-x64-${{ steps.filename.outputs.version }}.7z.exe
          ls -lh w64devkit-x64-${{ steps.filename.outputs.version }}.7z.exe

      - name: Build signed image (x86)
        uses: docker/build-push-action@v7
        with:
          context: .
          build-args: VARIANT=x86
          target: signed
          tags: w64devkit:x86-signed
          load: true
          cache-from: type=gha,scope=w64devkit-x86
          cache-to: type=gha,scope=w64devkit-x86,mode=max,ignore-error=true

      - name: Sign and pack (x86)
        run: |
          docker run --rm \
            -e AZURE_CLIENT_ID -e AZURE_TENANT_ID \
            -e AAS_SIGN_ENDPOINT -e AAS_SIGN_ACCOUNT -e AAS_SIGN_PROFILE \
            -e ACTIONS_ID_TOKEN_REQUEST_URL -e ACTIONS_ID_TOKEN_REQUEST_TOKEN \
            w64devkit:x86-signed \
            > w64devkit-x86-${{ steps.filename.outputs.version }}.7z.exe
          ls -lh w64devkit-x86-${{ steps.filename.outputs.version }}.7z.exe

      - name: Download source tarball
        uses: actions/download-artifact@v8
        with:
          name: source.tar

      - name: Create release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION=${{ steps.filename.outputs.version }}
          # Tags like vX.Y.Z-rcN are pipeline-test runs: publish as a
          # draft prerelease so they don't trigger release immutability
          # and can be deleted/retried freely.
          FLAGS=()
          if [[ "$VERSION" == *-rc* ]]; then
            FLAGS+=(--draft --prerelease)
          fi
          gh release create "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --title "$VERSION" \
            --notes-file "$RUNNER_TEMP/notes.md" \
            "${FLAGS[@]}" \
            w64devkit-*.7z.exe \
            source.tar