release.yml

name: release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (e.g. 0.2.0, no leading 'v')"
        required: true
        type: string

permissions:
  contents: write

jobs:
  release:
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup .NET 8
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: "8.0.x"

      - name: Test
        run: dotnet test GitTab.sln -c Release

      - name: Publish (framework-dependent single file)
        run: >
          dotnet publish src/GitTab.App/GitTab.App.csproj -c Release -r win-x64
          --self-contained false -p:PublishSingleFile=true -o publish

      # Derive the release version from the pushed tag (strip the leading
      # "v"), or from the workflow_dispatch "version" input when triggered
      # manually. Exposed as steps.version.outputs.version for later steps.
      - name: Resolve version
        id: version
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.version }}"
          else
            VERSION="${GITHUB_REF#refs/tags/v}"
          fi
          echo "Resolved version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      # Bundle portable git (MinGit) next to the app so Git Tab is a self-contained,
      # "no CLI required" tool: the app prefers <app>\git\cmd\git.exe over any system git.
      # Best-effort — if the download fails the installer still builds (git is then expected
      # from a system install / PATH), so this must not fail the release.
      - name: Bundle portable git (MinGit)
        continue-on-error: true
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Pinned for reproducible installers. Bump deliberately; the release still builds without
          # a bundle if this tag/asset is unavailable (continue-on-error).
          MINGIT_TAG: "v2.47.1.windows.1"
        run: |
          $headers = @{ Authorization = "Bearer $env:GH_TOKEN"; "User-Agent" = "git-tab-release" }
          $rel = Invoke-RestMethod -Headers $headers "https://api.github.com/repos/git-for-windows/git/releases/tags/$env:MINGIT_TAG"
          $asset = $rel.assets | Where-Object { $_.name -match '^MinGit-.*-64-bit\.zip$' } | Select-Object -First 1
          if (-not $asset) { throw "MinGit 64-bit asset not found for $env:MINGIT_TAG" }
          Write-Host "Downloading $($asset.name)"
          Invoke-WebRequest -Headers $headers -Uri $asset.browser_download_url -OutFile mingit.zip
          Expand-Archive -Path mingit.zip -DestinationPath publish\git -Force
          if (-not (Test-Path publish\git\cmd\git.exe)) { throw "MinGit layout unexpected" }
          Write-Host "Bundled git at publish\git\cmd\git.exe"

      - name: Install Inno Setup
        run: choco install innosetup -y

      # The .iss script guards its own AppVersion define with #ifndef, so
      # passing /DAppVersion here overrides the fallback "0.1.0" baked into
      # the script and stamps the installer + OutputBaseFilename with the
      # exact tag/input version.
      - name: Compile installer with Inno Setup
        shell: pwsh
        run: |
          & "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe" /DAppVersion=${{ steps.version.outputs.version }} installer\GitTab_installer.iss

      # Publish a SHA-256 checksum next to the installer. The in-app updater downloads this and
      # refuses to launch an installer whose hash doesn't match (tamper/corruption protection).
      - name: Checksum installer
        shell: pwsh
        run: |
          Get-ChildItem dist\GitTab-Setup-*.exe | ForEach-Object {
            $h = (Get-FileHash -Algorithm SHA256 $_.FullName).Hash
            "$h  $($_.Name)" | Out-File -Encoding ascii "$($_.FullName).sha256"
            Write-Host "SHA256 $($_.Name) = $h"
          }

      # softprops/action-gh-release publishes the GitHub Release and attaches the installer plus its
      # .sha256. The installer filename (GitTab-Setup-<version>.exe) ends in .exe, which is what the
      # in-app auto-updater looks for.
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ github.event_name == 'workflow_dispatch' && format('v{0}', steps.version.outputs.version) || github.ref_name }}
          files: |
            dist/GitTab-Setup-*.exe
            dist/GitTab-Setup-*.exe.sha256
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}