cd.yml

name: CD

on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]
    branches:
      - master

jobs:
  publish:
    runs-on: windows-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    permissions:
      contents: write
    env:
      SIGNING_CERT_B64: ${{ secrets.SIGNING_CERT_B64 }}
      SIGNING_CERT_PASSWORD: ${{ secrets.SIGNING_CERT_PASSWORD }}

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: "10.0.x"

      - name: Cache NuGet packages
        uses: actions/cache@v6
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
          restore-keys: nuget-${{ runner.os }}-

      - name: Restore tools
        run: dotnet tool restore

      # Display version comes from version.json + commit height via Nerdbank.GitVersioning.
      # On a tag push the tag wins (e.g. v1.2.5 → publicRelease=true, no pre-release suffix).
      - name: Compute version
        id: version
        shell: pwsh
        run: |
          $json = dotnet nbgv get-version --format json | ConvertFrom-Json
          $display = $json.NuGetPackageVersion   # e.g. "1.2.5"
          echo "display=$display" >> $env:GITHUB_OUTPUT

      - name: Inject Application Insights connection string
        shell: pwsh
        run: |
          $file = 'Pointframe/appsettings.json'
          $json = Get-Content $file | ConvertFrom-Json
          $json.ApplicationInsights.ConnectionString = '${{ secrets.APP_INSIGHTS_CONNECTION_STRING }}'
          $json | ConvertTo-Json -Depth 10 | Set-Content $file

      - name: Verify connection string was injected
        shell: pwsh
        run: |
          $len = ((Get-Content 'Pointframe/appsettings.json' | ConvertFrom-Json).ApplicationInsights.ConnectionString).Length
          if ($len -eq 0) { Write-Error "APP_INSIGHTS_CONNECTION_STRING secret is empty or not set"; exit 1 }
          Write-Host "Connection string length: $len (secret injected successfully)"

      - name: Publish (self-contained single-file)
        run: >-
          dotnet publish Pointframe/Pointframe.csproj
          /p:PublishProfile=win-x64
          --nologo

      # Sign the published exe if a code-signing certificate is available.
      # Store your PFX as a base64 secret: SIGNING_CERT_B64
      # Store the PFX password as:          SIGNING_CERT_PASSWORD
      - name: Sign executable
        if: ${{ env.SIGNING_CERT_B64 != '' }}
        env:
          SIGNING_CERT_B64: ${{ env.SIGNING_CERT_B64 }}
          SIGNING_CERT_PASSWORD: ${{ env.SIGNING_CERT_PASSWORD }}
        shell: pwsh
        run: |
          $pfx = [System.Convert]::FromBase64String($env:SIGNING_CERT_B64)
          $pfxPath = Join-Path $env:TEMP 'signing.pfx'
          [IO.File]::WriteAllBytes($pfxPath, $pfx)
          try {
            $signtool = (Get-ChildItem 'C:\Program Files (x86)\Windows Kits\10\bin' -Recurse -Filter signtool.exe |
              Sort-Object -Property FullName -Descending | Select-Object -First 1).FullName
            $exePath = 'Pointframe\bin\publish\win-x64\Pointframe.exe'
            & $signtool sign /fd SHA256 /p $env:SIGNING_CERT_PASSWORD /f $pfxPath /tr http://timestamp.digicert.com /td SHA256 $exePath
            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          } finally {
            Remove-Item $pfxPath -Force -ErrorAction SilentlyContinue
          }

      - name: Install Inno Setup 6
        run: choco install innosetup --yes --no-progress

      - name: Build installer
        shell: pwsh
        run: |
          $iscc = "C:\Program Files (x86)\Inno Setup 6\ISCC.exe"
          & $iscc `
            /DAppVersion=${{ steps.version.outputs.display }} `
            /O"installer\output" `
            installer\Pointframe.iss
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Sign installer
        if: ${{ env.SIGNING_CERT_B64 != '' }}
        env:
          SIGNING_CERT_B64: ${{ env.SIGNING_CERT_B64 }}
          SIGNING_CERT_PASSWORD: ${{ env.SIGNING_CERT_PASSWORD }}
        shell: pwsh
        run: |
          $pfx = [System.Convert]::FromBase64String($env:SIGNING_CERT_B64)
          $pfxPath = Join-Path $env:TEMP 'signing.pfx'
          [IO.File]::WriteAllBytes($pfxPath, $pfx)
          try {
            $signtool = (Get-ChildItem 'C:\Program Files (x86)\Windows Kits\10\bin' -Recurse -Filter signtool.exe |
              Sort-Object -Property FullName -Descending | Select-Object -First 1).FullName
            $setupPath = "installer\output\Pointframe-${{ steps.version.outputs.display }}-x64-Setup.exe"
            & $signtool sign /fd SHA256 /p $env:SIGNING_CERT_PASSWORD /f $pfxPath /tr http://timestamp.digicert.com /td SHA256 $setupPath
            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          } finally {
            Remove-Item $pfxPath -Force -ErrorAction SilentlyContinue
          }

      - name: Upload installer artifact
        uses: actions/upload-artifact@v7
        with:
          name: Pointframe-${{ steps.version.outputs.display }}-x64-Setup
          path: installer/output/Pointframe-${{ steps.version.outputs.display }}-x64-Setup.exe

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: v${{ steps.version.outputs.display }}
          files: installer/output/Pointframe-${{ steps.version.outputs.display }}-x64-Setup.exe
          body: |
            Pointframe ${{ steps.version.outputs.display }}

            - Installer refresh and maintenance release.
            - For the full list of commits, see Compare in this release page.