release.yml

# Release workflow.
#
# Triggers on tags of the form v* (e.g. v1.0.0). Builds a self-contained
# single-file Windows x64 executable, optionally signs it via SSL.com
# CodeSignTool when SSL_COM_* secrets are present, computes SHA-256, and
# uploads as a GitHub Release asset.
name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build:
    name: Build, sign, and publish
    runs-on: windows-2022

    steps:
      - uses: actions/checkout@v4

      - name: Set up .NET 10
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore ETDucky.NetPath.csproj

      - name: Publish (self-contained single file)
        run: |
          dotnet publish ETDucky.NetPath.csproj `
            -c Release `
            -r win-x64 `
            -p:SelfContained=true `
            -p:PublishSingleFile=true `
            -p:IncludeNativeLibrariesForSelfExtract=true `
            -p:EnableCompressionInSingleFile=true `
            -p:DebugType=none `
            -p:DebugSymbols=false `
            -o publish

      - name: Sign binary (if SSL.com secrets present)
        if: ${{ env.SSL_COM_USERNAME != '' }}
        env:
          SSL_COM_USERNAME:      ${{ secrets.SSL_COM_USERNAME }}
          SSL_COM_PASSWORD:      ${{ secrets.SSL_COM_PASSWORD }}
          SSL_COM_CREDENTIAL_ID: ${{ secrets.SSL_COM_CREDENTIAL_ID }}
          SSL_COM_TOTP_SECRET:   ${{ secrets.SSL_COM_TOTP_SECRET }}
        run: |
          $url = 'https://www.ssl.com/download/codesigntool-for-windows/'
          Invoke-WebRequest -Uri $url -OutFile codesigntool.zip
          Expand-Archive codesigntool.zip -DestinationPath CodeSignTool
          cd CodeSignTool
          .\CodeSignTool.bat sign `
            -username="$env:SSL_COM_USERNAME" `
            -password="$env:SSL_COM_PASSWORD" `
            -credential_id="$env:SSL_COM_CREDENTIAL_ID" `
            -totp_secret="$env:SSL_COM_TOTP_SECRET" `
            -input_file_path="..\publish\ETDucky.NetPath.exe" `
            -override="true"

      - name: Compute SHA-256
        run: |
          $hash = (Get-FileHash publish\ETDucky.NetPath.exe -Algorithm SHA256).Hash.ToLower()
          "$hash  ETDucky.NetPath.exe" | Out-File publish\SHA256SUMS.txt -Encoding ascii
          Write-Host "SHA-256: $hash"

      - name: Create GitHub release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            publish/ETDucky.NetPath.exe
            publish/SHA256SUMS.txt
          generate_release_notes: true
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}