release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  # The gate: a tag push runs the full CI suite (format, vet, build, test)
  # before anything is packaged, and every job below needs it, so a red test
  # leaves the release unpublished instead of shipping. Reuses ci.yml rather
  # than restating its steps, so the two can't drift apart.
  test:
    uses: ./.github/workflows/ci.yml

  build-macos:
    needs: test
    strategy:
      matrix:
        include:
          - runner: macos-latest
            arch: arm64
          - runner: macos-15-intel
            arch: x86_64
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Check out code
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Install fyne CLI
        run: make install-fyne

      - name: Package macOS app
        run: make package-mac

      - name: Archive macOS app bundle
        run: |
          cd bin
          zip -r -y "picfetch-macos-$(uname -m).zip" "PicFetch.app"

      - name: Upload macOS artifact
        uses: actions/upload-artifact@v7
        with:
          name: picfetch-macos-${{ matrix.arch }}
          path: bin/picfetch-macos-*.zip
          if-no-files-found: error

  build-cross:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Install fyne-cross CLI
        run: make install-fyne-cross

      - name: Package Windows binary
        run: make package-windows

      - name: Package Linux binaries
        run: make package-linux

      - name: Archive artifacts
        run: |
          cd bin
          # The .exe inside each zip stays plain "picfetch.exe" - the archive
          # name already carries the arch, and that is what users unpacked
          # before Windows gained a second architecture.
          for arch in amd64 arm64; do
            cp "picfetch-windows-$arch.exe" "picfetch.exe"
            zip "picfetch-windows-$arch.zip" "picfetch.exe" ../LICENSE ../THIRD-PARTY-NOTICES.md ../PRIVACY.md -j
            rm "picfetch.exe"
          done
          for arch in amd64 arm64; do
            tar -czf "picfetch-linux-$arch.tar.gz" "picfetch-linux-$arch" -C "linux-$arch" . -C ../.. LICENSE THIRD-PARTY-NOTICES.md PRIVACY.md
          done

      - name: Upload unsigned Windows artifacts for signing
        uses: actions/upload-artifact@v7
        with:
          name: picfetch-windows-unsigned
          path: |
            bin/picfetch-windows-amd64.zip
            bin/picfetch-windows-arm64.zip
          if-no-files-found: error

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v7
        with:
          name: picfetch-linux
          path: |
            bin/picfetch-linux-amd64.tar.gz
            bin/picfetch-linux-arm64.tar.gz
          if-no-files-found: error

  sign-windows:
    # Keep the code-signing credentials behind the protected GitHub Environment
    # configured in docs/release-signing.md. This job signs only tag-release
    # artifacts after the test gate and must finish before publication.
    needs: build-cross
    runs-on: windows-latest
    environment: release-signing
    permissions:
      contents: read
    steps:
      - name: Download unsigned Windows artifacts
        uses: actions/download-artifact@v8
        with:
          name: picfetch-windows-unsigned
          path: dist/windows-unsigned

      - name: Download and verify Certum SimplySign Desktop
        shell: pwsh
        env:
          SIMPLYSIGN_INSTALLER_SHA256: ${{ vars.SIMPLYSIGN_INSTALLER_SHA256 }}
          SIMPLYSIGN_SIGNER_THUMBPRINT: ${{ vars.SIMPLYSIGN_SIGNER_THUMBPRINT }}
        run: |
          $installerUrl = 'https://files.certum.eu/software/SimplySignDesktop/Windows/9.4.4.92/SimplySignDesktop-9.4.4.92-64-bit-en.msi'
          Invoke-WebRequest -Uri $installerUrl -OutFile SimplySignDesktop.msi -ErrorAction Stop

          if ($env:SIMPLYSIGN_INSTALLER_SHA256 -notmatch '^[0-9A-Fa-f]{64}$') {
            throw 'SIMPLYSIGN_INSTALLER_SHA256 must be the reviewed installer SHA-256 digest.'
          }
          $actualHash = (Get-FileHash -LiteralPath SimplySignDesktop.msi -Algorithm SHA256).Hash
          if ($actualHash -ne $env:SIMPLYSIGN_INSTALLER_SHA256) {
            throw "SimplySign installer SHA-256 mismatch: $actualHash."
          }

          if ($env:SIMPLYSIGN_SIGNER_THUMBPRINT -notmatch '^[0-9A-Fa-f]{40}$') {
            throw 'SIMPLYSIGN_SIGNER_THUMBPRINT must be the reviewed signer certificate thumbprint.'
          }
          $signature = Get-AuthenticodeSignature -FilePath SimplySignDesktop.msi
          if ($signature.Status -ne 'Valid' -or
              $signature.SignerCertificate.Thumbprint -ne $env:SIMPLYSIGN_SIGNER_THUMBPRINT) {
            throw "SimplySign installer signature is not the reviewed certificate: $($signature.Status), $($signature.SignerCertificate.Thumbprint)."
          }
          Write-Host "Verified SimplySign installer SHA-256 and publisher: $($signature.SignerCertificate.Subject)"

      - name: Authenticate Certum SimplySign
        # This commit is the reviewed v1 release of the third-party action.
        # Do not replace it with a floating tag: it receives the TOTP secret.
        uses: dismine/windows-app-signing-setup-action@89ae3b032d4bc7a5b98d1a42a34e61ecb6faad64 # v1
        with:
          certum-username: ${{ secrets.CERTUM_USERNAME }}
          certum-otp-uri: ${{ secrets.CERTUM_OTP_URI }}
          certum-key-id: ${{ secrets.CERTUM_CERT_THUMBPRINT }}
          # The pinned action installs the verified local MSI and skips downloading.
          # Fail if it is missing instead of downloading a fallback.
          simplysign-url: https://simplysign-installer.invalid/SimplySignDesktop.msi

      - name: Sign, timestamp, and verify Windows executables
        shell: pwsh
        env:
          CERTUM_CERT_THUMBPRINT: ${{ secrets.CERTUM_CERT_THUMBPRINT }}
        run: |
          $signtool = Get-ChildItem -Path 'C:\Program Files (x86)\Windows Kits\10\bin' -Filter signtool.exe -Recurse |
            Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } |
            Select-Object -First 1
          if ($null -eq $signtool) {
            throw 'SignTool.exe was not found in the Windows SDK.'
          }

          $archives = @(Get-ChildItem -Path dist/windows-unsigned -Filter 'picfetch-windows-*.zip' -File)
          if ($archives.Count -ne 2) {
            throw "Expected exactly two Windows archives, found $($archives.Count)."
          }

          New-Item -ItemType Directory -Force -Path dist/windows-signed | Out-Null
          foreach ($archive in $archives) {
            $unpacked = Join-Path dist/unpacked $archive.BaseName
            Expand-Archive -Path $archive.FullName -DestinationPath $unpacked -Force
            $executable = Join-Path $unpacked 'picfetch.exe'
            if (-not (Test-Path -LiteralPath $executable -PathType Leaf)) {
              throw "Expected executable is missing from $($archive.Name)."
            }

            & $signtool.FullName sign /fd sha256 /tr http://time.certum.pl /td sha256 /sha1 $env:CERTUM_CERT_THUMBPRINT /v $executable
            if ($LASTEXITCODE -ne 0) {
              throw "Signing failed for $($archive.Name)."
            }
            & $signtool.FullName verify /pa /all /v /tw $executable
            if ($LASTEXITCODE -ne 0) {
              throw "Signature verification failed for $($archive.Name)."
            }

            $packageFiles = @($executable)
            foreach ($name in @('LICENSE', 'THIRD-PARTY-NOTICES.md', 'PRIVACY.md')) {
              $notice = Join-Path $unpacked $name
              if (-not (Test-Path -LiteralPath $notice -PathType Leaf)) {
                throw "Required notice $name is missing from $($archive.Name)."
              }
              $packageFiles += $notice
            }
            Compress-Archive -Path $packageFiles -DestinationPath (Join-Path dist/windows-signed $archive.Name) -Force
          }

      - name: Upload verified signed Windows artifacts
        uses: actions/upload-artifact@v7
        with:
          name: picfetch-windows-signed
          path: dist/windows-signed/picfetch-windows-*.zip
          if-no-files-found: error

  release:
    needs: [build-macos, build-cross, sign-windows]
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Download macOS artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: picfetch-macos-arm64
          path: dist

      - name: Download Intel macOS artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: picfetch-macos-x86_64
          path: dist

      - name: Download Linux artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: picfetch-linux
          path: dist

      - name: Download signed Windows artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: picfetch-windows-signed
          path: dist

      - name: Set up Go for final notice inspection
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Inspect notices in every final release archive
        run: |
          go run ./scripts/updaternotices -artifact dist/picfetch-macos-arm64.zip -artifact dist/picfetch-macos-x86_64.zip
          go run ./scripts/updaternotices -artifact dist/picfetch-windows-amd64.zip -artifact dist/picfetch-windows-arm64.zip
          go run ./scripts/updaternotices -artifact dist/picfetch-linux-amd64.tar.gz -artifact dist/picfetch-linux-arm64.tar.gz

      - name: Create GitHub release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          # Both inputs are declared in this pinned action's action.yml.
          # noinspection UndefinedParamsPresent
          files: dist/*
          # noinspection UndefinedParamsPresent
          body_path: .github/release-notes.md