syshelper/.gitea/workflows/ci.yml

# Windows builds run on Debian: cross-compilation plus Inno Setup under Wine.
name: CI

on:
  push:
    branches: ["**"]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

env:
  TARGET: x86_64-pc-windows-msvc
  # Update source baked into the binary. Taken from Gitea itself, so moving the
  # instance needs no code change. Uses the `github` context rather than
  # `gitea`: Gitea Actions fills it in for compatibility and every version
  # supports it.
  SYSHELPER_UPDATE_BASE: ${{ github.server_url }}

jobs:
  build:
    name: Windows x64
    runs-on: ubuntu-latest
    # Debian with node: Gitea Actions needs node inside the container to run
    # JavaScript actions such as actions/checkout.
    container:
      image: node:20-bookworm

    steps:
      - uses: actions/checkout@v4

      # Cross-compilation toolchain:
      #   clang/lld    - compiler and linker for the MSVC target;
      #   llvm         - provides llvm-lib, without which ring fails to build:
      #                  it compiles its own C code and needs an archiver;
      #   wine + i386  - runs ISCC.exe, the Inno Setup compiler, which is 32-bit;
      #   xvfb + xauth - Wine touches X even when it shows no window, and
      #                  xvfb-run refuses to start without xauth.
      - name: System dependencies
        run: |
          set -eux
          dpkg --add-architecture i386
          apt-get update -qq
          apt-get install -y -qq --no-install-recommends \
            ca-certificates curl jq file \
            clang lld llvm \
            wine wine32:i386 wine64 xvfb xauth

      - name: Rust and cargo-xwin
        run: |
          set -eux
          # The minimal profile omits clippy; without the explicit component
          # the lint step below fails.
          curl -fsSL https://sh.rustup.rs | sh -s -- -y \
            --profile minimal --component clippy --default-toolchain stable
          . "$HOME/.cargo/env"
          rustup target add "$TARGET"
          cargo install cargo-xwin --locked
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Resolve version
        id: meta
        run: |
          set -eu
          manifest=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2)
          version="$manifest"

          # A tag that disagrees with Cargo.toml must never ship. The installer
          # is named after the tag, but the binary reports env!("CARGO_PKG_VERSION")
          # — so a mismatch leaves every installed copy seeing the release as
          # newer than itself forever, reinstalling every few hours.
          case "$GITHUB_REF" in
            refs/tags/v*)
              version="${GITHUB_REF#refs/tags/v}"
              if [ "$version" != "$manifest" ]; then
                echo "tag v$version does not match Cargo.toml version $manifest" >&2
                echo "bump the version in Cargo.toml and retag" >&2
                exit 1
              fi
              ;;
          esac

          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "version: $version"

      # Linted against the Windows target on purpose: most of the code - the
      # service and the process handling - sits behind cfg(windows) and would
      # go unchecked on a Linux target.
      - name: Clippy
        run: cargo xwin clippy --release --locked --target "$TARGET" -- -D warnings

      - name: Build
        run: cargo xwin build --release --locked --target "$TARGET"

      # ISCC.exe is a 32-bit Windows application, hence Wine. The version is
      # pinned: the script needs at least 6.1 (SaveStringsToUTF8File) and 6.3
      # (ArchitecturesAllowed=x64compatible). Downloaded from GitHub because
      # jrsoftware.org/download.php serves an HTML page rather than the file,
      # and files.jrsoftware.org publishes signatures only.
      - name: Install Inno Setup under Wine
        env:
          WINEPREFIX: /tmp/wine
          WINEDEBUG: "-all"
          INNO_URL: https://github.com/jrsoftware/issrc/releases/download/is-6_7_3/innosetup-6.7.3.exe
        run: |
          set -eux
          xvfb-run -a wineboot --init
          curl -fsSL -o /tmp/innosetup.exe "$INNO_URL"
          xvfb-run -a wine /tmp/innosetup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
          ls "$WINEPREFIX/drive_c/Program Files (x86)/Inno Setup 6/ISCC.exe"

      - name: Build installer
        env:
          WINEPREFIX: /tmp/wine
          WINEDEBUG: "-all"
        run: |
          set -eux
          mkdir -p dist
          xvfb-run -a wine "$WINEPREFIX/drive_c/Program Files (x86)/Inno Setup 6/ISCC.exe" \
            "/DAppVersion=${{ steps.meta.outputs.version }}" \
            "/DExeSource=..\\target\\$TARGET\\release\\syshelper.exe" \
            installer/setup.iss
          ls -la dist

      # Tags only: branch and pull request runs are there to prove the build
      # still works, and keeping an installer from each of them is just clutter.
      # v3 rather than v4: not every Gitea version accepts v4 artifacts.
      - uses: actions/upload-artifact@v3
        if: startsWith(github.ref, 'refs/tags/v')
        with:
          name: syshelper-${{ steps.meta.outputs.version }}-windows-x64
          path: dist/*.exe
          # Fail loudly rather than store an empty artifact if the installer
          # was somehow not produced.
          if-no-files-found: error

      # Releases go through the Gitea API directly: it is GitHub-compatible in
      # shape, but a self-hosted instance may not have ready-made actions.
      #
      # The step is written to be repeatable. Creating a release in the Gitea
      # web UI also creates the tag, so by the time this runs the release
      # usually exists already and a blind POST would fail with 409. The same
      # goes for re-running a build over a tag whose assets are in place.
      #
      # Keep it POSIX: the runner executes steps with dash, so no `pipefail`.
      # curl calls therefore stay out of pipelines — under `set -e` a failed
      # command substitution aborts the step, which is what pipefail bought us.
      # No -x anywhere here: these commands carry the token.
      - name: Publish release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
          TAG: ${{ github.ref_name }}
        run: |
          set -eu
          auth="Authorization: token $TOKEN"

          # Reuse the release if it is already there, create it otherwise.
          existing=$(curl -sS -o /tmp/release.json -w '%{http_code}' \
            -H "$auth" "$API/releases/tags/$TAG")

          if [ "$existing" = "200" ]; then
            echo "release $TAG already exists, attaching assets to it"
          else
            echo "creating release $TAG"
            curl -fsS -o /tmp/release.json -X POST "$API/releases" \
              -H "$auth" -H "Content-Type: application/json" \
              -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\"}"
          fi

          id=$(jq -r '.id // empty' /tmp/release.json)
          if [ -z "$id" ]; then
            echo "could not resolve release id for $TAG:" >&2
            cat /tmp/release.json >&2
            exit 1
          fi

          for file in dist/*.exe; do
            name=$(basename "$file")

            # Replace an asset of the same name rather than ending up with two.
            curl -fsS -o /tmp/assets.json -H "$auth" "$API/releases/$id/assets"
            for old in $(jq -r --arg n "$name" '.[] | select(.name==$n) | .id' /tmp/assets.json); do
              echo "removing previous $name (asset $old)"
              curl -fsS -X DELETE -H "$auth" "$API/releases/$id/assets/$old" > /dev/null
            done

            echo "uploading $name"
            curl -fsS -X POST "$API/releases/$id/assets?name=$name" \
              -H "$auth" -F "attachment=@$file" > /dev/null
          done

          echo "release $TAG (id $id) is ready"