ci-windows-installer.yml

---
name: CI-Windows-Installer
permissions: {}

on:
  workflow_call:
    inputs:
      azure_signing_account:
        default: ''
        required: false
        type: string
      azure_signing_cert_profile:
        default: ''
        required: false
        type: string
      azure_signing_endpoint:
        default: ''
        required: false
        type: string
      publish_release:
        default: false
        required: false
        type: boolean
      release_version:
        default: ''
        required: false
        type: string
    secrets:
      AZURE_CLIENT_ID:
        required: false
      AZURE_CLIENT_SECRET:
        required: false
      AZURE_TENANT_ID:
        required: false

jobs:
  windows_installer:
    name: Windows Installer (${{ matrix.target }})
    permissions:
      contents: read
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-pc-windows-msvc
          - target: aarch64-pc-windows-msvc
    env:
      CARGO_TERM_COLOR: always
      INPUT_AZURE_SIGNING_ACCOUNT: ${{ inputs.azure_signing_account }}
      INPUT_AZURE_SIGNING_CERT_PROFILE: ${{ inputs.azure_signing_cert_profile }}
      INPUT_AZURE_SIGNING_ENDPOINT: ${{ inputs.azure_signing_endpoint }}
      INPUT_PUBLISH_RELEASE: ${{ inputs.publish_release }}
      INPUT_RELEASE_VERSION: ${{ inputs.release_version }}
      WIX_EXTENSION_VERSION: 7.0.0
      WIX_TOOL_PATH: ${{ github.workspace }}\.wix
      WIX_VERSION: 7.0.0
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Download Windows build artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: build-windows-${{ matrix.target }}
          path: .

      - name: Setup Rust
        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
        with:
          target: ${{ matrix.target }}
          cache: true
          cache-on-failure: false

      - name: Install Cargo tools
        shell: pwsh
        run: |
          $metadata = cargo metadata --locked --no-deps --format-version 1 | ConvertFrom-Json
          $cargoRunBinVersion = $metadata.metadata.ci.'cargo-run-bin'
          cargo install --locked cargo-run-bin --version $cargoRunBinVersion
          if ($env:INPUT_RELEASE_VERSION) {
            cargo bin cargo-set-version --version
          }

      - name: Update Version
        if: env.INPUT_RELEASE_VERSION != ''
        shell: pwsh
        run: |
          cargo bin cargo-set-version $env:INPUT_RELEASE_VERSION
          cargo update --workspace
          cargo metadata --locked --no-deps --format-version 1 > $null

      - name: Setup dotnet
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68  # v6.0.0
        with:
          dotnet-version: '10.x'

      - name: Install WiX
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path $env:WIX_TOOL_PATH | Out-Null
          dotnet tool install --tool-path $env:WIX_TOOL_PATH wix --version $env:WIX_VERSION
          $env:WIX_TOOL_PATH >> $env:GITHUB_PATH
          $env:PATH = "$env:WIX_TOOL_PATH;$env:PATH"
          wix eula accept wix7
          wix extension add "WixToolset.UI.wixext/$env:WIX_EXTENSION_VERSION"
          wix extension add "WixToolset.Util.wixext/$env:WIX_EXTENSION_VERSION"
          wix --version

      - name: Sign Windows executable
        if: env.INPUT_PUBLISH_RELEASE == 'true' && env.INPUT_AZURE_SIGNING_ACCOUNT != ''
        uses: azure/trusted-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82  # v2.0.0
        with:
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          certificate-profile-name: ${{ env.INPUT_AZURE_SIGNING_CERT_PROFILE }}
          endpoint: ${{ env.INPUT_AZURE_SIGNING_ENDPOINT }}
          files: ${{ github.workspace }}\target\${{ matrix.target }}\release\koko.exe
          signing-account-name: ${{ env.INPUT_AZURE_SIGNING_ACCOUNT }}

      - name: Create Windows archive
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path artifacts | Out-Null
          7z a "artifacts\koko-${{ matrix.target }}.7z" `
            ".\assets" `
            ".\target\${{ matrix.target }}\release\koko.exe"

      - name: Resolve MSI package version
        shell: pwsh
        run: |
          $metadata = cargo metadata --locked --no-deps --format-version 1 | ConvertFrom-Json
          $packageVersion = ($metadata.packages | Where-Object { $_.name -eq 'koko' } | Select-Object -First 1).version
          if (-not $packageVersion) {
            throw 'Failed to resolve koko package version from cargo metadata'
          }
          $msiPackageVersion = cargo msi-version $packageVersion
          "MSI_PACKAGE_VERSION=$msiPackageVersion" >> $env:GITHUB_ENV
          "Package version: $packageVersion"
          "MSI package version: $msiPackageVersion"

      - name: Package Windows installer
        shell: pwsh
        run: |
          $target = '${{ matrix.target }}'
          $wixArch = switch -Wildcard ($target) {
            'aarch64-*' { 'arm64'; break }
            'x86_64-*' { 'x64'; break }
            default { throw "Unsupported WiX target architecture for $target" }
          }
          $cargoTargetDir = Join-Path $env:GITHUB_WORKSPACE 'target'
          $cargoTargetBinDir = Join-Path $cargoTargetDir "$target\release"

          wix build `
            -arch $wixArch `
            -d "Version=$env:MSI_PACKAGE_VERSION" `
            -d "Platform=$wixArch" `
            -d "Profile=release" `
            -d 'TargetEnv=msvc' `
            -d "TargetTriple=$target" `
            -d 'CargoProfile=release' `
            -d 'TargetVendor=pc' `
            -d "CargoTargetDir=$cargoTargetDir" `
            -d "CargoTargetBinDir=$cargoTargetBinDir" `
            -pdbtype none `
            -culture en-us `
            -ext WixToolset.UI.wixext `
            -ext WixToolset.Util.wixext `
            -o "artifacts\koko-$target-installer.msi" `
            crates\server\wix\main.wxs

      - name: Sign Windows installer
        if: env.INPUT_PUBLISH_RELEASE == 'true' && env.INPUT_AZURE_SIGNING_ACCOUNT != ''
        uses: azure/trusted-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82  # v2.0.0
        with:
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          certificate-profile-name: ${{ env.INPUT_AZURE_SIGNING_CERT_PROFILE }}
          endpoint: ${{ env.INPUT_AZURE_SIGNING_ENDPOINT }}
          files-folder: artifacts
          files-folder-filter: msi
          files-folder-recurse: false
          signing-account-name: ${{ env.INPUT_AZURE_SIGNING_ACCOUNT }}

      - name: Upload Artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          if-no-files-found: error
          name: koko-${{ matrix.target }}
          path: artifacts