ov_build_release_shared.yaml

name: OV Build Shared

on:
  workflow_call:
    inputs:
      client_target:
        required: true
        type: string
  workflow_dispatch:
    inputs:
      client_target:
        required: true
        type: choice
        # These should also be updated in the version_rev map below when adding new targets
        options:
        - live
        - test
        - emu-rof2
        - emu-tob
        - beta-emu-rof2
        - beta-emu-tob

env:
  platform: "${{ contains(inputs.client_target, 'rof2') && 'Win32' || 'x64' }}"
  # Version revision map -- update this when adding new client targets
  version_rev: >-
    ${{ fromJSON('{
      "live":          52471,
      "test":          52472,
      "beta-emu-rof2": 52473,
      "emu-rof2":      52474,
      "beta-emu-tob":  52475,
      "emu-tob":       52476
    }')[inputs.client_target] }}
  # Default ini profile for the target client
  mq_default_ini_profile: >-
    ${{ fromJSON('{
      "live":          "live",
      "test":          "live",
      "emu-rof2":      "emu-rof2",
      "beta-emu-rof2": "emu-rof2",
      "emu-tob":       "live",
      "beta-emu-tob":  "live"
    }')[inputs.client_target] }}
  gh_release_flag: ${{ contains(fromJSON('["live","test","emu-rof2"]'), inputs.client_target) && '--latest' || '--prerelease' }}
  # VeryVanilla publishes the following versions:
  vv_enabled: ${{ contains(fromJSON('["live","test","emu-rof2"]'), inputs.client_target) }}
  vv_resource_id: >-
    ${{ fromJSON('{
      "live":     "1974",
      "test":     "2218",
      "emu-rof2": "60"
    }')[inputs.client_target] }}
  # Bundled in VeryVanilla.zip but symbols go to SPECIAL_SYM_PATH.
  vv_bundled_restricted: '["MQ2GroundSpawns","MQ2CWTNBuffs","CWTNCommons", "MQ2BuffMe", "MQNearby"]'
  # Standalone plugins
  vv_standalone_map: >-
    {
      "MQ2Bst":       "1499",
      "MQ2Eskay":     "1153",
      "MQ2Monk":      "1287",
      "MQ2Rogue":     "1084",
      "MQ2War":       "1254",
      "MQ2Berzerker": "1018",
      "MQ2Cleric":    "1498",
      "MQ2Shaman":    "1724",
      "MQ2Enchanter": "1612",
      "MQ2Grind":     "1967",
      "MQ2Mage":      "2134",
      "MQ2Paladin":   "2586",
      "MQ2Necro":     "2585",
      "MQ2Druid":     "2587",
      "MQ2Wizard":    "2932",
      "MQ2Ranger":    "2909",
      "MQ2Bard":      "3162"
    }

jobs:
  build:
    if: github.repository == 'redguides/openvanilla'
    runs-on: [fast, self-hosted, Windows, X64]
    env:
      GIT_CONFIG_COUNT: ${{ contains(fromJSON('["live","test","emu-rof2"]'), inputs.client_target) && '1' || '0' }}
      GIT_CONFIG_KEY_0: url.https://x-access-token:${{ secrets.VV_SYNC_PAT }}@github.com/.insteadOf
      GIT_CONFIG_VALUE_0: https://github.com/
    steps:
      - name: "[Setup] Validate version revision"
        if: env.version_rev == ''
        run: |
          echo "::error:: Target '${{ inputs.client_target }}' has no version_rev defined. Update the version revision map in the env block."
          exit 1

      - name: "[Setup] Install and cache PowerShell modules"
        uses: potatoqualitee/psmodulecache@v6.2.1
        with:
          modules-to-cache: powershell-yaml

      - name: "[Source] Checkout code"
        uses: actions/checkout@v6

      - name: "[Source] Reset eqlib"
        run: git -C src/eqlib reset --hard
        continue-on-error: true

      - name: "[Source] Sync submodule URLs"
        run: git submodule sync --recursive

      - name: "[Source] Update builtin submodules"
        run: git submodule update --init --recursive --depth=1

      - name: "[Source] Select MacroQuest_default.ini for release profile"
        shell: pwsh
        run: |
          $src = "data/config/MacroQuest_default.${{ env.mq_default_ini_profile }}.ini"
          $dest = "data/config/MacroQuest_default.ini"
          Copy-Item -LiteralPath $src -Destination $dest -Force
          $ct = "${{ inputs.client_target }}"
          $suffix = ($ct -split '-' | Where-Object { $_ } | ForEach-Object {
            $s = $_.ToLowerInvariant()
            [char]::ToUpperInvariant($s[0]) + $s.Substring(1)
          }) -join ''
          $class = "__MacroQuestTray$suffix"
          $name = "MacroQuest$suffix"
          $lines = Get-Content -LiteralPath $dest
          $lines = $lines | ForEach-Object {
            if ($_ -match '^\s*MacroQuestWinClassName\s*=') { "MacroQuestWinClassName=$class" }
            elseif ($_ -match '^\s*MacroQuestWinName\s*=') { "MacroQuestWinName=$name" }
            else { $_ }
          }
          Set-Content -LiteralPath $dest -Value $lines -Encoding utf8NoBOM

      - name: "[Plugins] Get extra plugins from docs site"
        shell: pwsh
        run: |
          Invoke-WebRequest -Uri "https://raw.githubusercontent.com/redbot/docs/readguides/main/plugin-quick-list.md" -OutFile "plugin-quick-list.md"

      - name: "[Plugins] Checkout plugins that work on all clients"
        shell: pwsh
        run: |
          $start = Select-String -Path plugin-quick-list.md -Pattern "^# All" -CaseSensitive
          $end = Select-String -Path plugin-quick-list.md -Pattern "^(#|``)" -CaseSensitive | Where-Object { $_.LineNumber -gt $start.LineNumber } | Select-Object -First 1
          $content = Get-Content plugin-quick-list.md | Select-Object -Index ($start.LineNumber..($end.LineNumber - 2))
          $content | ForEach-Object {
            $cmd = $_.Trim()
            if ($cmd.StartsWith("git clone")) {
              Invoke-Expression $cmd
            }
          }

      - name: "[Plugins] Checkout plugins that work on Live/Test clients"
        #if: ${{ inputs.client_target == 'live' || inputs.client_target == 'test' }}
        shell: pwsh
        run: |
          $start = Select-String -Path plugin-quick-list.md -Pattern "^# Live/Test only" -CaseSensitive
          $end = Select-String -Path plugin-quick-list.md -Pattern "^(#|``)" | Where-Object { $_.LineNumber -gt $start.LineNumber } | Select-Object -First 1
          $content = Get-Content plugin-quick-list.md | Select-Object -Index ($start.LineNumber..($end.LineNumber - 2))
          $content | ForEach-Object {
            $cmd = $_.Trim()
            if ($cmd.StartsWith("git clone")) {
              Invoke-Expression $cmd
            }
          }

      - name: "[Plugins] Checkout plugins that work on RoF2 clients"
        shell: pwsh
        run: |
          $start = Select-String -Path plugin-quick-list.md -Pattern "^# RoF2 only" -CaseSensitive
          $end = Select-String -Path plugin-quick-list.md -Pattern "^(#|``)" | Where-Object { $_.LineNumber -gt $start.LineNumber } | Select-Object -First 1
          $content = Get-Content plugin-quick-list.md | Select-Object -Index ($start.LineNumber..($end.LineNumber - 2))
          $content | ForEach-Object {
            $cmd = $_.Trim()
            if ($cmd.StartsWith("git clone")) {
              Invoke-Expression $cmd
            }
          }

      - name: "[Plugins] Checkout beta branch for plugins"
        if: contains(inputs.client_target, 'beta')
        shell: pwsh
        run: |
          Get-ChildItem plugins -Directory | ForEach-Object { Write-Host "Checking for beta branch in $($_.Name)"; git -C "$($_.FullName)" checkout beta 2>$null }
          exit 0

      - name: "[VV-Plugins] Fetch VeryVanilla manifest and solution"
        if: env.vv_enabled == 'true'
        shell: pwsh
        env:
          VV_SYNC_PAT: ${{ secrets.VV_SYNC_PAT }}
        run: |
          $headers = @{ Authorization = "token $env:VV_SYNC_PAT"; 'User-Agent' = 'openvanilla-ci' }
          Invoke-WebRequest -Headers $headers -Uri 'https://raw.githubusercontent.com/redguides/veryvanilla/main/plugin-slow-list.md' -OutFile 'plugin-slow-list.md'
          Invoke-WebRequest -Headers $headers -Uri 'https://raw.githubusercontent.com/redguides/veryvanilla/main/VVCustom.sln' -OutFile 'src/VVCustom.sln'

      - name: "[VV-Plugins] Checkout VeryVanilla plugins (All)"
        if: env.vv_enabled == 'true'
        shell: pwsh
        run: |
          $start = Select-String -Path plugin-slow-list.md -Pattern "^# All" -CaseSensitive
          $end = Select-String -Path plugin-slow-list.md -Pattern "^(#|``)" -CaseSensitive | Where-Object { $_.LineNumber -gt $start.LineNumber } | Select-Object -First 1
          $content = Get-Content plugin-slow-list.md | Select-Object -Index ($start.LineNumber..($end.LineNumber - 2))
          $content | ForEach-Object {
            $cmd = $_.Trim()
            if ($cmd.StartsWith("git clone")) {
              Invoke-Expression $cmd
            }
          }

      - name: "[VV-Plugins] Checkout VeryVanilla plugins (Live/Test only)"
        if: env.vv_enabled == 'true' && (inputs.client_target == 'live' || inputs.client_target == 'test')
        shell: pwsh
        run: |
          $start = Select-String -Path plugin-slow-list.md -Pattern "^# Live/Test only" -CaseSensitive
          $end = Select-String -Path plugin-slow-list.md -Pattern "^(#|``)" | Where-Object { $_.LineNumber -gt $start.LineNumber } | Select-Object -First 1
          $content = Get-Content plugin-slow-list.md | Select-Object -Index ($start.LineNumber..($end.LineNumber - 2))
          $content | ForEach-Object {
            $cmd = $_.Trim()
            if ($cmd.StartsWith("git clone")) {
              Invoke-Expression $cmd
            }
          }

      - name: "[VV-Plugins] Checkout VeryVanilla plugins (RoF2 only)"
        if: env.vv_enabled == 'true' && inputs.client_target == 'emu-rof2'
        shell: pwsh
        run: |
          $start = Select-String -Path plugin-slow-list.md -Pattern "^# RoF2 only" -CaseSensitive
          $end = Select-String -Path plugin-slow-list.md -Pattern "^(#|``)" | Where-Object { $_.LineNumber -gt $start.LineNumber } | Select-Object -First 1
          $content = Get-Content plugin-slow-list.md | Select-Object -Index ($start.LineNumber..($end.LineNumber - 2))
          $content | ForEach-Object {
            $cmd = $_.Trim()
            if ($cmd.StartsWith("git clone")) {
              Invoke-Expression $cmd
            }
          }

      - name: "[Plugins] Update Plugin Submodules"
        shell: pwsh
        run: |
          Get-ChildItem plugins -Directory | ForEach-Object { Write-Host "$($_.Name)"; git -C "$($_.FullName)" submodule update --init --recursive --depth=1 }

      - name: "[Plugins] Validate Plugin Projects"
        shell: pwsh
        run: |
          $result = & "${{ github.workspace }}/tools/build_scripts/Validate_Plugin_Projects.ps1" -PluginsDirectory "${{ github.workspace }}/plugins" -Whitelist @("MQ2Nav", "CWTN")
          $exitCode = $LASTEXITCODE
          $discordMessage = ($result -join "`n")
          if ($discordMessage.Length -gt 4000) {
            $discordMessage = $discordMessage.Substring(0, 4000)
          }
          if ($exitCode -ne 0) {
            Write-Warning $discordMessage
            [System.Collections.ArrayList]$embedArray = @()
            $embedObject = [PSCustomObject]@{
                color = "15548997"
                title = "Plugin validation failed (${{ github.ref_name }})"
                description = $discordMessage
            }
            $embedArray.Add($embedObject) | Out-Null
            $discordPayload = [PSCustomObject]@{
                embeds = $embedArray
            } | ConvertTo-Json
            # Invoke-RestMethod -Uri '${{ secrets.MQDISCORD_DEV_WEBHOOK }}' -Method Post -Body $discordPayload -ContentType 'application/json'  # disabled while iterating
            exit 1
          }

      - name: "[Source] Get SLN file from docs site"
        shell: pwsh
        run: |
          Invoke-WebRequest -Uri "https://raw.githubusercontent.com/redbot/docs/readguides/uploads/MacroQuestCustom.sln" -OutFile "src/MacroQuestCustom.sln"

      - name: "[Configure] Create crashpad.h"
        shell: pwsh
        env:
          CRASHPAD_URL: ${{ secrets.CRASHPAD_URL }}
        run: |
          $crashpadTemplate = "${{ github.workspace }}\include\config\crashpad.h.example"
          $crashpadConfig = "${{ github.workspace }}\include\config\crashpad.h"
          Copy-Item -Path $crashpadTemplate -Destination $crashpadConfig -Force
          $content = Get-Content -Path $crashpadConfig
          $content = $content -replace '^\s*//\s*#define\s+CRASHPAD_SUBMISSION_ENVIRONMENT\s+".*"$', '#define CRASHPAD_SUBMISSION_ENVIRONMENT "RedGuides"'
          $content = $content -replace '^\s*#define\s+CRASHPAD_SUBMISSIONS_URL\s+".*"$', "#define CRASHPAD_SUBMISSIONS_URL `"$env:CRASHPAD_URL`""
          Set-Content -Path $crashpadConfig -Value $content

      - name: "[Configure] Set Versioning for MQMain"
        shell: pwsh
        run: |
          $versionFile = "src/main/MQVersionInfo.h"
          $versionInfo = Get-Content $versionFile
          $versionInfo = $versionInfo -replace '#define MQMAIN_VERSION_REV\s+\d+', "#define MQMAIN_VERSION_REV   ${{ env.version_rev }}"
          $versionInfo = $versionInfo -replace '#define MQMAIN_VERSION_BUILD (\d+)', "#define MQMAIN_VERSION_BUILD ${{ github.run_number }}"
          $versionInfo = $versionInfo -replace '#define MQMAIN_GIT_HASH "(.*)"', "#define MQMAIN_GIT_HASH `"$(git rev-parse --short HEAD)`""
          $versionInfo | Set-Content $versionFile

          # Export the full MAJOR.MINOR.REV.BUILD string for downstream steps.
          $joined = $versionInfo -join "`n"
          if ($joined -match '#define MQMAIN_VERSION_MAJOR\s+(\d+)') { $major = $matches[1] } else { $major = '?' }
          if ($joined -match '#define MQMAIN_VERSION_MINOR\s+(\d+)') { $minor = $matches[1] } else { $minor = '?' }
          $fullVersion = "$major.$minor.${{ env.version_rev }}.${{ github.run_number }}"
          echo "MQ_FULL_VERSION=$fullVersion" >> $env:GITHUB_ENV

      - name: "[Configure] Set Versioning for eqlib"
        shell: pwsh
        run: |
          $versionFile = "src/eqlib/src/eqlibVersionInfo.h"
          $versionInfo = Get-Content $versionFile
          $versionInfo = $versionInfo -replace '#define EQLIB_GIT_HASH "(.*)"', "#define EQLIB_GIT_HASH `"$eqlibCommitHash`""
          $versionInfo | Set-Content $versionFile

      - name: "[Build] Setup MSBuild"
        uses: microsoft/setup-msbuild@v3
        with:
          msbuild-architecture: x64

      - name: "[Build] Setup NuGet"
        uses: nuget/setup-nuget@v3

      - name: "[Build] Restore NuGet packages"
        run: |
          nuget restore src/MacroQuestCustom.sln

      - name: "[Build] Restore VeryVanilla NuGet packages"
        if: env.vv_enabled == 'true'
        run: |
          nuget restore src/VVCustom.sln

      - name: "[Build] Check vcpkg Installation"
        id: check_vcpkg
        shell: pwsh
        run: |
          $installedPath = "${{ github.workspace }}/contrib/vcpkg/installed"
          if ((Test-Path $installedPath) -and (Get-ChildItem $installedPath -Directory | Measure-Object).Count -gt 0) {
            echo "vcpkg_installed=true" >> $env:GITHUB_OUTPUT
          } else {
            echo "vcpkg_installed=false" >> $env:GITHUB_OUTPUT
          }

      - name: "[Build] Restore vcpkg Cache"
        if: steps.check_vcpkg.outputs.vcpkg_installed != 'true'
        uses: actions/cache@v5
        with:
          path: |
            contrib/vcpkg/buildtrees
            contrib/vcpkg/downloads
            contrib/vcpkg/installed
            contrib/vcpkg/packages
            contrib/vcpkg/vcpkg.exe
            contrib/vcpkg/vcpkg_mq_last_bootstrap*.txt
          key: ${{ runner.os }}-vcpkg-${{ env.platform }}-${{ github.run_id }}
          restore-keys: |
            ${{ runner.os }}-vcpkg-${{ env.platform }}-
            ${{ runner.os }}-vcpkg-

      - name: "[Build] Build MQ2Main:${{ env.platform }} Release for ${{ inputs.client_target }}"
        run: msbuild src/MacroQuestCustom.sln /NoLogo /Verbosity:minimal /p:Configuration=Release /p:Platform=${{ env.platform }} /m /t:core\MQ2Main /p:PreferredToolArchitecture=x64

      - name: "[Build] Build ${{ env.platform }} Release for ${{ inputs.client_target }}"
        run: msbuild src/MacroQuestCustom.sln /NoLogo /Verbosity:minimal /p:Configuration=Release /p:Platform=${{ env.platform }} /m /p:PreferredToolArchitecture=x64

      - name: "[Build] Snapshot MacroQuest release tree"
        if: env.vv_enabled == 'true'
        shell: pwsh
        run: |
          $ReleasePath = "${{ github.workspace }}\build\bin\Release"
          New-Item -Path "${{ github.workspace }}\build\manifests" -ItemType Directory -Force | Out-Null
          $rel = Get-ChildItem -LiteralPath $ReleasePath -Recurse -File | ForEach-Object {
            $_.FullName.Substring($ReleasePath.Length).TrimStart('\')
          }
          $rel | Sort-Object | Out-File -Encoding ascii "${{ github.workspace }}\build\manifests\mq_baseline.txt"

      - name: "[Build] Build VeryVanilla ${{ env.platform }} Release for ${{ inputs.client_target }}"
        if: env.vv_enabled == 'true'
        run: msbuild src/VVCustom.sln /NoLogo /Verbosity:minimal /p:Configuration=Release /p:Platform=${{ env.platform }} /m /p:PreferredToolArchitecture=x64

      - name: "[Notify] Discord build SHAs"
        if: success()
        shell: pwsh
        env:
          MQDISCORD_BUILD_SHA_WEBHOOK: ${{ secrets.MQDISCORD_BUILD_SHA_WEBHOOK }}
        run: |
          $shaVV = git rev-parse --short HEAD
          $shaEqlib = git -C src/eqlib rev-parse --short HEAD
          $shaCWTN = if (Test-Path plugins/CWTN) { git -C plugins/CWTN rev-parse --short HEAD } else { 'n/a' }
          $desc = "**eqlib** $shaEqlib`n**vv** $shaVV`n**cwtn** $shaCWTN"
          $embed = [PSCustomObject]@{
            title       = "${{ inputs.client_target }} build $env:MQ_FULL_VERSION"
            description = $desc
          }
          $payload = [PSCustomObject]@{ embeds = @($embed) } | ConvertTo-Json -Depth 6
          Invoke-RestMethod -Uri $env:MQDISCORD_BUILD_SHA_WEBHOOK -Method Post -Body $payload -ContentType 'application/json'
        continue-on-error: true

      - name: "[Symbols] Update Symbol Server"
        shell: pwsh
        run: |
          $ProjectTitle = $($env:GITHUB_REPOSITORY).Split("/")[1]
          $SymbolDir = "${{ secrets.SYMBOL_SRV_PATH }}"
          $ReleasePath = "${{ github.workspace }}\build\bin\Release"
          $symstore = (Get-ChildItem -Recurse "${ENV:ProgramFiles(x86)}\Windows Kits" -Filter symstore.exe | Where-Object { $_.FullName -notmatch 'arm' } | Sort-Object LastWriteTime | Select-Object -last 1).FullName

          # Plugins outside of normal symstore.
          $excludeNames = New-Object System.Collections.Generic.HashSet[string] ([System.StringComparer]::OrdinalIgnoreCase)
          if ('${{ env.vv_enabled }}' -eq 'true') {
            (ConvertFrom-Json '${{ env.vv_bundled_restricted }}') | ForEach-Object { [void]$excludeNames.Add($_) }
            (ConvertFrom-Json '${{ env.vv_standalone_map }}').PSObject.Properties.Name | ForEach-Object { [void]$excludeNames.Add($_) }
          }

          $files = Get-ChildItem -LiteralPath $ReleasePath -Recurse -File -Include *.dll, *.exe, *.pdb |
            Where-Object { -not $excludeNames.Contains($_.BaseName) }

          $listFile = "${{ github.workspace }}\build\manifests\public_symbols.txt"
          New-Item -Path (Split-Path $listFile) -ItemType Directory -Force | Out-Null
          $files | ForEach-Object { $_.FullName } | Out-File -Encoding ascii $listFile

          $LASTEXITCODE = 0
          & $symstore add /f "@$listFile" /s $SymbolDir /t "$ProjectTitle" /compress | Out-Null
          if ($LASTEXITCODE -ne 0) {
            throw "Failed to update symbol server"
          }
          $agestore = (Get-ChildItem -Recurse "${ENV:ProgramFiles(x86)}\Windows Kits" -Filter agestore.exe | Where-Object { $_.FullName -notmatch 'arm' } | Sort-Object LastWriteTime | Select-Object -last 1).FullName
          & $agestore $SymbolDir /days=60 /s /y  | Out-Null
          if ($LASTEXITCODE -ne 0) {
            throw "Failed to age symbol server"
          }

      - name: "[Symbols] Update Special Symbol Server"
        if: env.vv_enabled == 'true'
        shell: pwsh
        run: |
          $ProjectTitle = $($env:GITHUB_REPOSITORY).Split("/")[1]
          $SymbolDir = "${{ secrets.SPECIAL_SYM_PATH }}"
          $ReleasePath = "${{ github.workspace }}\build\bin\Release"
          $symstore = (Get-ChildItem -Recurse "${ENV:ProgramFiles(x86)}\Windows Kits" -Filter symstore.exe | Where-Object { $_.FullName -notmatch 'arm' } | Sort-Object LastWriteTime | Select-Object -last 1).FullName

          $includeNames = New-Object System.Collections.Generic.HashSet[string] ([System.StringComparer]::OrdinalIgnoreCase)
          (ConvertFrom-Json '${{ env.vv_bundled_restricted }}') | ForEach-Object { [void]$includeNames.Add($_) }
          (ConvertFrom-Json '${{ env.vv_standalone_map }}').PSObject.Properties.Name | ForEach-Object { [void]$includeNames.Add($_) }

          $files = Get-ChildItem -LiteralPath $ReleasePath -Recurse -File -Include *.dll, *.pdb |
            Where-Object { $includeNames.Contains($_.BaseName) }

          if ($files.Count -eq 0) {
            Write-Host "No restricted files present; nothing to add to the special symbol server."
            exit 0
          }

          $listFile = "${{ github.workspace }}\build\manifests\special_symbols.txt"
          New-Item -Path (Split-Path $listFile) -ItemType Directory -Force | Out-Null
          $files | ForEach-Object { $_.FullName } | Out-File -Encoding ascii $listFile

          $LASTEXITCODE = 0
          & $symstore add /f "@$listFile" /s $SymbolDir /t "$ProjectTitle" /compress | Out-Null
          if ($LASTEXITCODE -ne 0) {
            throw "Failed to update special symbol server"
          }
          $agestore = (Get-ChildItem -Recurse "${ENV:ProgramFiles(x86)}\Windows Kits" -Filter agestore.exe | Where-Object { $_.FullName -notmatch 'arm' } | Sort-Object LastWriteTime | Select-Object -last 1).FullName
          & $agestore $SymbolDir /days=60 /s /y | Out-Null
          if ($LASTEXITCODE -ne 0) {
            throw "Failed to age special symbol server"
          }

      - name: "[Package] Remove Build Artifacts"
        shell: pwsh
        run: |
          Get-ChildItem build/bin/Release -Include *.pdb -Recurse | Remove-Item -Force
          Get-ChildItem build/bin/Release -Include *.lib -Recurse | Remove-Item -Force
          Get-ChildItem build/bin/Release -Include *.exp -Recurse | Remove-Item -Force

      - name: "[Package] Sign Code"
        shell: pwsh
        env:
          KMS_KEY: projects/code-signing-rg/locations/global/keyRings/redkeys/cryptoKeys/rgkey/cryptoKeyVersions/1
          SIGNING_CERT: ${{ secrets.SIGNING_CERT }}
          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
        run: |
          # Fail fast if the kmscng CSP isn't installed on the runner. Otherwise signtool fails with a generic error.
          if (-not (Test-Path "$env:SystemRoot\System32\kmscng.dll")) {
            throw "Google Cloud KMS Provider (kmscng) is not installed on this runner. Install the MSI from https://github.com/GoogleCloudPlatform/kms-integrations/releases?q=cng&expanded=true and re-run."
          }
          $CertFile = "${{ github.workspace }}\build\bin\user.crt"
          $KeyFile = "${{ github.workspace }}\build\bin\gcp-sa.json"
          [IO.File]::WriteAllBytes($CertFile, [Convert]::FromBase64String($env:SIGNING_CERT))
          [IO.File]::WriteAllText($KeyFile, $env:GCP_SA_KEY)
          $env:GOOGLE_APPLICATION_CREDENTIALS = $KeyFile
          $FileList = Get-ChildItem -Path "build/bin/release" -Recurse -Include *.exe, *.dll |
            Where-Object { $_.Name -ne "D3DX9_43.dll" }
          $signtool = (Get-ChildItem -Recurse "${ENV:ProgramFiles(x86)}\Windows Kits" -Filter signtool.exe |
            Where-Object { $_.FullName -notmatch 'arm' } | Sort-Object LastWriteTime | Select-Object -last 1).FullName
          $tsaServers = @('http://timestamp.digicert.com', 'http://timestamp.sectigo.com')
          $tsaIndex = 0
          $maxAttempts = 5
          ForEach ($file in $FileList) {
            for ($attempt = 1; $attempt -le $maxAttempts; $attempt++) {
              $tsa = $tsaServers[$tsaIndex]
              & $signtool sign /fd SHA256 /f $CertFile /csp "Google Cloud KMS Provider" /kc $env:KMS_KEY /tr $tsa /td sha256 "$file"
              if ($LASTEXITCODE -eq 0) { break }
              if ($attempt -eq $maxAttempts) { throw "Signing failed for $file after $maxAttempts attempts" }
              Write-Host "Signing attempt $attempt failed for $file (TSA: $tsa), switching TSA and retrying in 2s..."
              $tsaIndex = ($tsaIndex + 1) % $tsaServers.Length
              Start-Sleep -Seconds 2
            }
          }
          Remove-Item -Force $CertFile, $KeyFile

      - name: "[Package] Create MacroQuest Archive"
        shell: pwsh
        run: |
          Push-Location build/bin/Release
          if ('${{ env.vv_enabled }}' -eq 'true') {
            # Only include files that existed before the VeryVanilla build.
            $baseline = "${{ github.workspace }}\build\manifests\mq_baseline.txt"
            $existing = Get-ChildItem -Recurse -File | ForEach-Object {
              $_.FullName.Substring((Get-Location).Path.Length).TrimStart('\')
            } | Sort-Object -Unique
            $baselineSet = New-Object System.Collections.Generic.HashSet[string] ([System.StringComparer]::OrdinalIgnoreCase)
            Get-Content $baseline | ForEach-Object { [void]$baselineSet.Add($_) }
            $include = $existing | Where-Object { $baselineSet.Contains($_) }
            $listFile = "${{ github.workspace }}\build\manifests\macroquest_zip.txt"
            $include | Out-File -Encoding ascii $listFile
            7z a -tzip ../MacroQuest.zip "@$listFile"
          } else {
            7z a -tzip -r ../MacroQuest.zip *
          }
          Pop-Location

      - name: "[Package] Create VeryVanilla Archive"
        if: env.vv_enabled == 'true'
        shell: pwsh
        run: |
          Push-Location build/bin/Release
          $standaloneNames = (ConvertFrom-Json '${{ env.vv_standalone_map }}').PSObject.Properties.Name
          $excludeArgs = @()
          if ('${{ inputs.client_target }}' -ne 'test') {
            # Standalone plugins ship as their own resources on live/emu-rof2.
            foreach ($name in $standaloneNames) {
              $excludeArgs += "-xr!plugins\$name.dll"
            }
          }
          7z a -tzip -r ../VeryVanilla.zip * @excludeArgs
          Pop-Location

      - name: "[Package] Create Standalone Plugin Archives"
        if: env.vv_enabled == 'true' && inputs.client_target != 'test'
        shell: pwsh
        run: |
          $stagingDir = "${{ github.workspace }}\build\bin\standalone"
          New-Item -Path $stagingDir -ItemType Directory -Force | Out-Null
          $releaseRoot = "${{ github.workspace }}\build\bin\Release"
          $standaloneNames = (ConvertFrom-Json '${{ env.vv_standalone_map }}').PSObject.Properties.Name
          foreach ($name in $standaloneNames) {
            $dll = Join-Path $releaseRoot "plugins\$name.dll"
            if (-not (Test-Path $dll)) {
              $dll = Join-Path $releaseRoot "$name.dll"
            }
            if (Test-Path $dll) {
              $zip = Join-Path $stagingDir "$name.zip"
              if (Test-Path $zip) { Remove-Item $zip -Force }
              7z a -tzip $zip $dll | Out-Null
            } else {
              Write-Host "Skipping $name (DLL not found under $releaseRoot\plugins or $releaseRoot)"
            }
          }

      - name: "[Release] Get Version Information"
        shell: pwsh
        run: echo "MQVERSION_INFO=$((Get-Item build/bin/release/MQ2Main.dll).VersionInfo.FileVersion)" >> $env:GITHUB_ENV

      - name: "[Release] Restore Last Changelog"
        uses: actions/cache@v5
        with:
          path: ${{ github.workspace }}/build/changelog/CHANGELOG.md
          key: changelog-${{ env.platform }}-${{ inputs.client_target }}-${{ github.run_id }}
          restore-keys: |
            changelog-${{ env.platform }}-${{ inputs.client_target }}

      - name: "[Release] Diff Changelog"
        id: diff_changelog
        shell: pwsh
        run: |
          $ReleaseDescription = "Automated release for ${{ inputs.client_target }}"
          if (Test-Path "${{ github.workspace }}/build/changelog/CHANGELOG.md")
          {
            $FileDiff = (Compare-Object (Get-Content "${{ github.workspace }}/data/resources/CHANGELOG.md") (Get-Content "${{ github.workspace }}/build/changelog/CHANGELOG.md"))
            if ($FileDiff.Count -gt 0)
            {
                if ($FileDiff[0].SideIndicator -eq '<=')
                {
                    $ReleaseDescription = "Change Log:`r`n-----------`r`n"
                    $ReleaseDescription += $FileDiff.InputObject -join "`r`n`r`n"
                }
            }
          }
          else
          {
            New-Item -Path "${{ github.workspace }}/build/changelog" -ItemType Directory -ErrorAction SilentlyContinue
          }
          Copy-Item -Path "${{ github.workspace }}/data/resources/CHANGELOG.md" -Destination "${{ github.workspace }}/build/changelog/CHANGELOG.md" -Force
          Remove-Item -Force "${{ github.workspace }}/build/ReleaseNotes.md" -ErrorAction SilentlyContinue
          $ReleaseDescription | Out-File "${{ github.workspace }}/build/ReleaseNotes.md"

      - name: "[Release] Remove Release '${{ github.ref_name }}'"
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $output = gh release delete ${{ github.ref_name }} --yes 2>&1
          if (!$? -And -Not($output -like "*release not found*")) {
            throw $output
          }
          exit 0

      - name: "[Release] Create Release for ${{ inputs.client_target }}"
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create ${{ github.ref_name }} --title "MacroQuest (${{ inputs.client_target }}) v$($env:MQVERSION_INFO)" --notes-file "${{ github.workspace }}/build/ReleaseNotes.md" ${{ env.gh_release_flag }} build/bin/MacroQuest.zip

      - name: "[Release] Publish to RedGuides"
        if: env.vv_enabled == 'true'
        shell: pwsh
        env:
          REDFETCH_BASE_URL: ${{ secrets.REDFETCH_BASE_URL }}
          REDGUIDES_API_KEY: ${{ secrets.RG_API_KEY }}
          REDGUIDES_USER_ID: ${{ secrets.RG_USER_ID }}
        run: |
          $version = $env:MQVERSION_INFO
          $releaseNotes = "${{ github.workspace }}/build/ReleaseNotes.md"
          $failed = @()

          function Publish-Resource([string]$resourceId, [string]$file, [string]$label, [string]$message) {
            if (-not (Test-Path $file)) {
              Write-Host "Skipping $label (file not present: $file)"
              return
            }
            $args = @('publish', $resourceId, '--version', $version, '--file', $file)
            if ($message -and (Test-Path $message)) {
              $args += @('--message', $message)
            }
            Write-Host "Publishing $label (resource $resourceId) -> $file"
            & redfetch @args
            if ($LASTEXITCODE -ne 0) {
              Write-Warning "Publish failed for $label (exit $LASTEXITCODE)"
              $script:failed += $label
            }
          }

          Publish-Resource '${{ env.vv_resource_id }}' 'build/bin/VeryVanilla.zip' 'VeryVanilla' $releaseNotes

          if ('${{ inputs.client_target }}' -ne 'test') {
            $standaloneMap = ConvertFrom-Json '${{ env.vv_standalone_map }}'
            foreach ($prop in $standaloneMap.PSObject.Properties) {
              Publish-Resource $prop.Value "build/bin/standalone/$($prop.Name).zip" $prop.Name $null
            }
          }

          if ($failed.Count -gt 0) {
            throw "Publish failed for: $($failed -join ', ')"
          }

      - name: "[Release] Update ready manifest"
        if: success() && env.vv_enabled == 'true'
        shell: pwsh
        env:
          READY_UPDATE_ENDPOINT: ${{ secrets.READY_UPDATE_ENDPOINT }}
          READY_UPDATE_KEY: ${{ secrets.READY_UPDATE_KEY }}
        run: |
          $ct = '${{ inputs.client_target }}'
          $body = 'key=' + [uri]::EscapeDataString($env:READY_UPDATE_KEY) + '&' + $ct + '=yes'
          Invoke-WebRequest -Uri $env:READY_UPDATE_ENDPOINT -Method Post -Body $body -ContentType 'application/x-www-form-urlencoded' -TimeoutSec 60 -UseBasicParsing

      - name: "[Notify] Discord completion"
        if: success()
        shell: pwsh
        env:
          MQDISCORD_DEV_WEBHOOK: ${{ secrets.MQDISCORD_DEV_WEBHOOK }}
        run: |
          $runUrl = "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          $embed = [PSCustomObject]@{
            title       = "$env:MQ_FULL_VERSION Complete"
            description = "**${{ inputs.client_target }}** and its cargo of symbols have arrived unharmed.`n[View run]($runUrl)"
          }
          $payload = [PSCustomObject]@{ embeds = @($embed) } | ConvertTo-Json -Depth 6
          Invoke-RestMethod -Uri $env:MQDISCORD_DEV_WEBHOOK -Method Post -Body $payload -ContentType 'application/json'
        continue-on-error: true

      - name: "[Notify] Discord build failure"
        if: failure()
        shell: pwsh
        env:
          MQDISCORD_DEV_WEBHOOK: ${{ secrets.MQDISCORD_DEV_WEBHOOK }}
        run: |
          $runUrl = "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          $version = if ($env:MQ_FULL_VERSION) { $env:MQ_FULL_VERSION } else { "build ${{ github.run_number }}" }
          $embed = [PSCustomObject]@{
            color       = 15548997
            title       = "Pipeline Failed: $version"
            description = "**${{ inputs.client_target }}** isn't going to make it.`n[View run]($runUrl)"
          }
          $payload = [PSCustomObject]@{ embeds = @($embed) } | ConvertTo-Json -Depth 6
          Invoke-RestMethod -Uri $env:MQDISCORD_DEV_WEBHOOK -Method Post -Body $payload -ContentType 'application/json'
        continue-on-error: true