picard/.github/workflows/package-windows.yml

name: Package and release

on: [workflow_call]

permissions: {}

jobs:
  package-windows:
    runs-on: windows-2019
    strategy:
      matrix:
        type:
        - store-app
        - signed-app
        - installer
        - portable
      fail-fast: false
    env:
      CODESIGN: 0
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Fetch entire history, needed for setting the build number
    - run: git fetch --depth=1 origin +refs/tags/release-*:refs/tags/release-*
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: 3.12
    - name: Setup Windows build environment
      run: |
        & .\scripts\package\win-setup.ps1 `
          -DiscidVersion $Env:DISCID_VERSION -DiscidSha256Sum $Env:DISCID_SHA256SUM `
          -FpcalcVersion $Env:FPCALC_VERSION -FpcalcSha256Sum $Env:FPCALC_SHA256SUM
        Add-Content $env:GITHUB_PATH "C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x64"
        $ReleaseTag = $(git describe --match "release-*" --abbrev=0 --always HEAD)
        $BuildNumber = $(git rev-list --count "$ReleaseTag..HEAD")
        Add-Content $env:GITHUB_ENV "BUILD_NUMBER=$BuildNumber"
        New-Item -Name .\artifacts -ItemType Directory
      env:
        DISCID_VERSION: 0.6.4
        DISCID_SHA256SUM: 330199495d71f71251e91eb0b4e3103b6c663fea09ffc9fd3e5108d48e0452c8
        FPCALC_VERSION: 1.5.1
        FPCALC_SHA256SUM: 36b478e16aa69f757f376645db0d436073a42c0097b6bb2677109e7835b59bbc
    - name: Install gettext
      run: |
        & .\scripts\package\win-setup-gettext.ps1 `
          -GettextVersion $Env:GETTEXT_VERSION -GettextSha256Sum $Env:GETTEXT_SHA256SUM
        Add-Content $env:GITHUB_PATH (Join-Path -Path (Resolve-Path .) -ChildPath gettext\bin)
      env:
        GETTEXT_VERSION: 0.22.4
        GETTEXT_SHA256SUM: 220068ac0b9e7aedda03534a3088e584640ac1e639800b3a0baa9410aa6d012a
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements-build.txt
        pip install -r requirements-win.txt
    - name: Patch build version
      if: startsWith(github.ref, 'refs/tags/') != true
      run: |
        python setup.py patch_version --platform=$Env:BUILD_NUMBER.$(git rev-parse --short HEAD)
    - name: Run tests
      timeout-minutes: 30
      run: python setup.py test
    - name: Prepare code signing certificate
      if: matrix.type != 'store-app'
      run: |
        If ($Env:CODESIGN_P12_URL -And $Env:AWS_ACCESS_KEY_ID) {
          pip install awscli
          aws s3 cp "$Env:CODESIGN_P12_URL" .\codesign.pfx
          Add-Content $env:GITHUB_ENV "CODESIGN=1"
        } Else {
          Write-Output "::warning::No code signing certificate available, skipping code signing."
        }
      env:
        AWS_DEFAULT_REGION: eu-central-1
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        CODESIGN_P12_URL: ${{ secrets.CODESIGN_P12_URL }}
    - name: Build Windows 10 store app package
      if: matrix.type == 'store-app'
      run: |
        & .\scripts\package\win-package-appx.ps1 -BuildNumber $Env:BUILD_NUMBER
        Move-Item .\dist\*.msix .\artifacts
      env:
        PICARD_APPX_PUBLISHER: CN=0A9169B7-05A3-4ED9-8876-830F17846709
    - name: Build Windows 10 signed app package
      if: matrix.type == 'signed-app' && env.CODESIGN == '1'
      run: |
        $CertificateFile = ".\codesign.pfx"
        $CertificatePassword = ConvertTo-SecureString -String $Env:CODESIGN_P12_PASSWORD -Force -AsPlainText
        & .\scripts\package\win-package-appx.ps1 -BuildNumber $Env:BUILD_NUMBER `
          -CertificateFile $CertificateFile -CertificatePassword $CertificatePassword
        Move-Item .\dist\*.msix .\artifacts
      env:
        CODESIGN_P12_PASSWORD: ${{ secrets.CODESIGN_P12_PASSWORD }}
    - name: Build Windows installer
      if: matrix.type == 'installer'
      run: |
        # choco install nsis
        If ($Env:CODESIGN -eq "1") {
          $CertificateFile = ".\codesign.pfx"
          $CertificatePassword = ConvertTo-SecureString -String $Env:CODESIGN_P12_PASSWORD -Force -AsPlainText
        } Else {
          $CertificateFile = $null
          $CertificatePassword = $null
        }
        & .\scripts\package\win-package-installer.ps1 -BuildNumber $Env:BUILD_NUMBER `
          -CertificateFile $CertificateFile -CertificatePassword $CertificatePassword
        Move-Item .\installer\*.exe .\artifacts
        dist\picard\_internal\fpcalc -version
      env:
        CODESIGN_P12_PASSWORD: ${{ secrets.CODESIGN_P12_PASSWORD }}
    - name: Build Windows portable app
      if: matrix.type == 'portable'
      run: |
        If ($Env:CODESIGN -eq "1") {
          $CertificateFile = ".\codesign.pfx"
          $CertificatePassword = ConvertTo-SecureString -String $Env:CODESIGN_P12_PASSWORD -Force -AsPlainText
        } Else {
          $CertificateFile = $null
          $CertificatePassword = $null
        }
        & .\scripts\package\win-package-portable.ps1 -BuildNumber $Env:BUILD_NUMBER `
          -CertificateFile $CertificateFile -CertificatePassword $CertificatePassword
        Move-Item .\dist\*.exe .\artifacts
      env:
        CODESIGN_P12_PASSWORD: ${{ secrets.CODESIGN_P12_PASSWORD }}
    - name: Cleanup
      if: env.CODESIGN == '1'
      run: Remove-Item .\codesign.pfx
    - name: Archive production artifacts
      uses: actions/upload-artifact@v4
      if: matrix.type != 'signed-app' || env.CODESIGN == '1'
      with:
        name: windows-${{ matrix.type }}
        path: artifacts/