# Windows builds run on Debian: cross-compilation plus Inno Setup under Wine.
name: CI

on:
  push:
    branches: ["**"]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

env:
  TARGET: x86_64-pc-windows-msvc
  # Update source baked into the binary. Taken from Gitea itself, so moving the
  # instance needs no code change. Uses the `github` context rather than
  # `gitea`: Gitea Actions fills it in for compatibility and every version
  # supports it.
  SYSHELPER_UPDATE_BASE: ${{ github.server_url }}

jobs:
  build:
    name: Windows x64
    runs-on: ubuntu-latest
    # Debian with node: Gitea Actions needs node inside the container to run
    # JavaScript actions such as actions/checkout.
    container:
      image: node:20-bookworm

    steps:
      - uses: actions/checkout@v4

      # Cross-compilation toolchain:
      #   clang/lld    - compiler and linker for the MSVC target;
      #   llvm         - provides llvm-lib, without which ring fails to build:
      #                  it compiles its own C code and needs an archiver;
      #   wine + i386  - runs ISCC.exe, the Inno Setup compiler, which is 32-bit;
      #   xvfb + xauth - Wine touches X even when it shows no window, and
      #                  xvfb-run refuses to start without xauth.
      - name: System dependencies
        run: |
          set -eux
          dpkg --add-architecture i386
          apt-get update -qq
          apt-get install -y -qq --no-install-recommends \
            ca-certificates curl jq file \
            clang lld llvm \
            wine wine32:i386 wine64 xvfb xauth

      - name: Rust and cargo-xwin
        run: |
          set -eux
          # The minimal profile omits clippy; without the explicit component
          # the lint step below fails.
          curl -fsSL https://sh.rustup.rs | sh -s -- -y \
            --profile minimal --component clippy --default-toolchain stable
          . "$HOME/.cargo/env"
          rustup target add "$TARGET"
          cargo install cargo-xwin --locked
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Resolve version
        id: meta
        run: |
          set -eu
          case "$GITHUB_REF" in
            refs/tags/v*) version="${GITHUB_REF#refs/tags/v}" ;;
            *)            version=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2) ;;
          esac
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "version: $version"

      # Linted against the Windows target on purpose: most of the code - the
      # service and the process handling - sits behind cfg(windows) and would
      # go unchecked on a Linux target.
      - name: Clippy
        run: cargo xwin clippy --release --locked --target "$TARGET" -- -D warnings

      - name: Build
        run: cargo xwin build --release --locked --target "$TARGET"

      # ISCC.exe is a 32-bit Windows application, hence Wine. The version is
      # pinned: the script needs at least 6.1 (SaveStringsToUTF8File) and 6.3
      # (ArchitecturesAllowed=x64compatible). Downloaded from GitHub because
      # jrsoftware.org/download.php serves an HTML page rather than the file,
      # and files.jrsoftware.org publishes signatures only.
      - name: Install Inno Setup under Wine
        env:
          WINEPREFIX: /tmp/wine
          WINEDEBUG: "-all"
          INNO_URL: https://github.com/jrsoftware/issrc/releases/download/is-6_7_3/innosetup-6.7.3.exe
        run: |
          set -eux
          xvfb-run -a wineboot --init
          curl -fsSL -o /tmp/innosetup.exe "$INNO_URL"
          xvfb-run -a wine /tmp/innosetup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
          ls "$WINEPREFIX/drive_c/Program Files (x86)/Inno Setup 6/ISCC.exe"

      - name: Build installer
        env:
          WINEPREFIX: /tmp/wine
          WINEDEBUG: "-all"
        run: |
          set -eux
          mkdir -p dist
          xvfb-run -a wine "$WINEPREFIX/drive_c/Program Files (x86)/Inno Setup 6/ISCC.exe" \
            "/DAppVersion=${{ steps.meta.outputs.version }}" \
            "/DExeSource=..\\target\\$TARGET\\release\\syshelper.exe" \
            installer/setup.iss
          ls -la dist

      # Tags only: branch and pull request runs are there to prove the build
      # still works, and keeping an installer from each of them is just clutter.
      # v3 rather than v4: not every Gitea version accepts v4 artifacts.
      - uses: actions/upload-artifact@v3
        if: startsWith(github.ref, 'refs/tags/v')
        with:
          name: syshelper-${{ steps.meta.outputs.version }}-windows-x64
          path: dist/*.exe
          # Fail loudly rather than store an empty artifact if the installer
          # was somehow not produced.
          if-no-files-found: error

      # Releases go through the Gitea API directly: it is GitHub-compatible in
      # shape, but a self-hosted instance may not have ready-made actions.
      - name: Publish release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
          TAG: ${{ github.ref_name }}
        run: |
          # pipefail is required: without it a failing curl would be masked by
          # a successful jq, id would become null, and the assets would be
          # uploaded to a release that does not exist.
          # No -x here: the command carries the token.
          set -euo pipefail
          id=$(curl -fsS -X POST "$API/releases" \
            -H "Authorization: token $TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\"}" | jq -r .id)
          echo "release $TAG (id $id)"

          for file in dist/*.exe; do
            echo "uploading $(basename "$file")"
            curl -fsS -X POST "$API/releases/$id/assets?name=$(basename "$file")" \
              -H "Authorization: token $TOKEN" \
              -F "attachment=@$file" > /dev/null
          done