release.yml

name: Build and Release

on:
  push:
    branches:
      - master
    tags:
      - "v*"
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - 'LICENSE'
      - '.gitignore'
  pull_request:
    branches:
      - master
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - 'LICENSE'
      - '.gitignore'
  workflow_dispatch:
    inputs:
      create_release:
        description: "Create a GitHub release from this run"
        required: true
        default: false
        type: boolean
      tag_name:
        description: "Release tag name for manual releases, for example v1.0.0"
        required: false
        type: string

permissions:
  contents: write

env:
  BUILD_CONFIGURATION: Release
  BUILD_PLATFORM: x64
  DIST_DIR: dist/Q1View-windows-x64
  INSTALLER_BASENAME: Q1ViewSetup-x64
  INSTALLER_FILE: Q1ViewSetup-x64.exe

jobs:
  build:
    name: Build Windows x64
    runs-on: windows-2022

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Add MSBuild to PATH
        uses: microsoft/setup-msbuild@v3

      - name: Resolve release metadata
        id: release_info
        shell: pwsh
        run: |
          if ("${{ startsWith(github.ref, 'refs/tags/') }}" -eq "true") {
            $releaseTag = "${{ github.ref_name }}"
          } elseif ("${{ inputs.tag_name }}" -ne "") {
            $releaseTag = "${{ inputs.tag_name }}"
          } else {
            $releaseTag = "manual-${{ github.run_number }}"
          }

          $appVersion = $releaseTag
          if ($appVersion.StartsWith("v")) {
            $appVersion = $appVersion.Substring(1)
          }
          if ($appVersion -match '^(\d+)\.(\d+)\.(\d+)(?:\.\d+)?$') {
            $appVersion = "$($Matches[1]).$($Matches[2]).$($Matches[3])"
            $displayVersion = $appVersion
          } elseif ($appVersion -match '^(\d+)\.(\d+)$') {
            $appVersion = "$($Matches[1]).$($Matches[2]).0"
            $displayVersion = $appVersion
          } else {
            $appVersion = "0.0.0"
            $displayVersion = "0.0.0-dev"
          }

          "release_tag=$releaseTag" | Out-File $env:GITHUB_OUTPUT -Encoding utf8 -Append
          "app_version=$appVersion" | Out-File $env:GITHUB_OUTPUT -Encoding utf8 -Append
          "display_version=$displayVersion" | Out-File $env:GITHUB_OUTPUT -Encoding utf8 -Append

      - name: Generate application version header
        shell: pwsh
        run: .\build\Write-Q1ViewVersion.ps1 -Version "${{ steps.release_info.outputs.display_version }}"

      - name: Build and run core regression tests
        run: |
          msbuild Tests\CoreRegressionTests.vcxproj /m /p:Configuration=$env:BUILD_CONFIGURATION /p:Platform=$env:BUILD_PLATFORM /p:PlatformToolset=v143
          & ".\Tests\bin\$env:BUILD_PLATFORM\$env:BUILD_CONFIGURATION\CoreRegressionTests.exe"

      - name: Build Viewer
        run: msbuild Viewer\Viewer.sln /m /restore /p:Configuration=$env:BUILD_CONFIGURATION /p:Platform=$env:BUILD_PLATFORM /p:PlatformToolset=v143

      - name: Build Comparator
        run: msbuild Comparator\Comparator.sln /m /restore /p:Configuration=$env:BUILD_CONFIGURATION /p:Platform=$env:BUILD_PLATFORM /p:PlatformToolset=v143

      - name: Stage package files
        shell: pwsh
        run: |
          Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
          .\build\Package-Q1View.ps1 -Configuration $env:BUILD_CONFIGURATION -Platform $env:BUILD_PLATFORM -OutputDir $env:DIST_DIR

      - name: Prepare release notes
        shell: pwsh
        run: |
          $head = git rev-parse --short HEAD
          $tag = "${{ steps.release_info.outputs.release_tag }}"
          $version = $tag -replace '^v', ''

          # Pull the matching section out of the curated CHANGELOG.md so the
          # GitHub release body is the hand-written "What's New" rather than a
          # raw commit dump. Sections look like: "## [2.1.0] - YYYY-MM-DD".
          $notes = @()
          if (Test-Path CHANGELOG.md) {
            $inSection = $false
            foreach ($line in (Get-Content CHANGELOG.md -Encoding utf8)) {
              if ($line -match '^##\s') {
                if ($inSection) { break }                       # next version section
                if ($line -match "^##\s+\[?$([regex]::Escape($version))\]?(\s|$)") {
                  $inSection = $true
                  continue
                }
              }
              if ($inSection -and $line -notmatch '^---\s*$') { $notes += $line }
            }
          }

          # Fallback to a git-log summary if there is no curated section
          # (e.g. an untagged manual run).
          if (-not ($notes -join "`n").Trim()) {
            $previousTag = git describe --tags --match "v[0-9]*" --abbrev=0 HEAD^ 2>$null
            $range = if ($previousTag) { "$previousTag..HEAD" } else { "HEAD" }
            $notes = @("## Git history", "")
            $notes += (git log --pretty=format:"- %h %s (%an, %ad)" --date=short $range)
          }

          $body = ($notes -join "`n").Trim()
          $full = "https://github.com/${{ github.repository }}/blob/$tag/CHANGELOG.md"
          "# Q1View $tag`n`n$body`n`n---`n_Commit $($head). Full changelog: $($full)_`n" |
            Out-File RELEASE_NOTES.md -Encoding utf8

          # Plain-text "What's New" for the Microsoft Store listing: just the
          # curated section body (no header/footer). Store release notes are
          # capped at ~1500 characters, so trim to stay within the limit.
          $whatsNew = $body
          if ($whatsNew.Length -gt 1500) { $whatsNew = $whatsNew.Substring(0, 1500) }
          $whatsNew | Out-File STORE_WHATS_NEW.txt -Encoding utf8

          # Ship the complete curated changelog inside the package (without
          # overwriting the repo copy).
          Copy-Item CHANGELOG.md $env:DIST_DIR

      - name: Sign application binaries
        shell: pwsh
        env:
          Q1VIEW_SIGN_CERT_BASE64: ${{ secrets.Q1VIEW_SIGN_CERT_BASE64 }}
          Q1VIEW_SIGN_CERT_PASSWORD: ${{ secrets.Q1VIEW_SIGN_CERT_PASSWORD }}
          Q1VIEW_SIGN_CERT_PATH: ${{ secrets.Q1VIEW_SIGN_CERT_PATH }}
          Q1VIEW_SIGN_CERT_THUMBPRINT: ${{ secrets.Q1VIEW_SIGN_CERT_THUMBPRINT }}
        run: |
          Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
          .\build\Sign-Q1View.ps1 -Files @(
            "$env:DIST_DIR\Viewer.exe",
            "$env:DIST_DIR\Comparator.exe"
          )

      - name: Build MSIX package
        shell: pwsh
        run: |
          Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
          .\build\Package-Q1ViewMsix.ps1 `
            -SourceDir $env:DIST_DIR `
            -OutputDir "dist" `
            -AppVersion "${{ steps.release_info.outputs.app_version }}.0" `
            -Publisher "CN=A89D24B3-A271-4AE1-9B9E-BFAE414EB0C6" `
            -SkipSigning

      - name: Package zip
        shell: pwsh
        run: |
          Compress-Archive -Path "$env:DIST_DIR/*" -DestinationPath Q1View-windows-x64.zip -Force

      - name: Install Inno Setup
        shell: pwsh
        run: choco install innosetup --no-progress --yes

      - name: Build installer
        shell: pwsh
        run: |
          Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
          .\build\Build-Q1ViewInstaller.ps1 `
            -SourceDir $env:DIST_DIR `
            -OutputDir "dist" `
            -AppVersion "${{ steps.release_info.outputs.app_version }}" `
            -OutputBaseFilename $env:INSTALLER_BASENAME

      - name: Sign installer
        shell: pwsh
        env:
          Q1VIEW_SIGN_CERT_BASE64: ${{ secrets.Q1VIEW_SIGN_CERT_BASE64 }}
          Q1VIEW_SIGN_CERT_PASSWORD: ${{ secrets.Q1VIEW_SIGN_CERT_PASSWORD }}
          Q1VIEW_SIGN_CERT_PATH: ${{ secrets.Q1VIEW_SIGN_CERT_PATH }}
          Q1VIEW_SIGN_CERT_THUMBPRINT: ${{ secrets.Q1VIEW_SIGN_CERT_THUMBPRINT }}
        run: |
          Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
          .\build\Sign-Q1View.ps1 -Files "dist\$env:INSTALLER_FILE"

      - name: Upload build artifact
        uses: actions/upload-artifact@v6
        with:
          name: Q1View-windows-x64
          path: |
            Q1View-windows-x64.zip
            dist/${{ env.INSTALLER_FILE }}
            dist/Q1View-windows-x64.msix
            ${{ env.DIST_DIR }}/*

      - name: Create GitHub release
        if: startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && inputs.create_release)
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.release_info.outputs.release_tag }}
          target_commitish: ${{ github.sha }}
          name: Q1View ${{ steps.release_info.outputs.release_tag }}
          body_path: RELEASE_NOTES.md
          files: |
            dist/${{ env.INSTALLER_FILE }}
            Q1View-windows-x64.zip
            dist/Q1View-windows-x64.msix

      - name: Remove redundant assets from application releases
        if: startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && inputs.create_release)
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $headers = @{
            Authorization = "Bearer $env:GH_TOKEN"
            Accept = "application/vnd.github+json"
            "X-GitHub-Api-Version" = "2022-11-28"
          }
          $page = 1
          do {
            $releases = Invoke-RestMethod `
              -Headers $headers `
              -Uri "https://api.github.com/repos/${{ github.repository }}/releases?per_page=100&page=$page"
            foreach ($release in $releases) {
              if ($release.tag_name -notmatch '^v\d') {
                continue
              }
              foreach ($asset in $release.assets) {
                if ($asset.name -in @("Viewer.exe", "Comparator.exe") -or
                    $asset.name -match '\.dll$') {
                  Invoke-RestMethod -Method Delete -Headers $headers -Uri $asset.url
                  Write-Host "Removed $($release.tag_name)/$($asset.name)"
                }
              }
            }
            $page++
          } while ($releases.Count -eq 100)

      # --- Microsoft Store submission (CD) -------------------------------------
      # Tag pushes only. Submits the Store-ready MSIX (built with the Store
      # publisher identity and intentionally unsigned, so the Store re-signs it)
      # to Partner Center via the Microsoft Store Developer CLI. Microsoft
      # certification still runs afterwards before the update goes live, so a
      # green run here means "submitted", not "published".
      - name: Set up Microsoft Store Developer CLI
        if: startsWith(github.ref, 'refs/tags/')
        shell: pwsh
        run: |
          $toolRoot = Join-Path $env:RUNNER_TEMP "msstorecli"
          $zipPath = Join-Path $env:RUNNER_TEMP "MSStoreCLI-win-x64.zip"
          $hashPath = Join-Path $env:RUNNER_TEMP "MSStoreCLI-win-x64.zip.sha256.txt"
          $baseUri = "https://github.com/microsoft/msstore-cli/releases/latest/download"

          Invoke-WebRequest "$baseUri/MSStoreCLI-win-x64.zip" -OutFile $zipPath
          Invoke-WebRequest "$baseUri/MSStoreCLI-win-x64.zip.sha256.txt" -OutFile $hashPath

          $expectedHash = ((Get-Content -LiteralPath $hashPath -Raw) -split '\s+')[0].Trim().ToUpperInvariant()
          $actualHash = (Get-FileHash -LiteralPath $zipPath -Algorithm SHA256).Hash.ToUpperInvariant()
          if ($actualHash -ne $expectedHash) {
            throw "MSStore CLI checksum mismatch. Expected $expectedHash, got $actualHash."
          }

          $hasDotNet9 = dotnet --list-runtimes 2>$null | Select-String -Quiet '^Microsoft\.NETCore\.App 9\.'
          if (-not $hasDotNet9) {
            $dotnetRoot = Join-Path $env:RUNNER_TEMP "dotnet"
            $dotnetInstall = Join-Path $env:RUNNER_TEMP "dotnet-install.ps1"
            Invoke-WebRequest "https://dot.net/v1/dotnet-install.ps1" -OutFile $dotnetInstall
            & $dotnetInstall -Runtime dotnet -Channel 9.0 -InstallDir $dotnetRoot -NoPath
            if ($LASTEXITCODE -ne 0) {
              throw "dotnet-install.ps1 failed with exit code $LASTEXITCODE"
            }

            $env:DOTNET_ROOT = $dotnetRoot
            $env:DOTNET_ROOT_X64 = $dotnetRoot
            $env:PATH = "$dotnetRoot;$env:PATH"
            "DOTNET_ROOT=$dotnetRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
            "DOTNET_ROOT_X64=$dotnetRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
            "$dotnetRoot" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          }

          New-Item -ItemType Directory -Force -Path $toolRoot | Out-Null
          Expand-Archive -LiteralPath $zipPath -DestinationPath $toolRoot -Force
          "$toolRoot" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          & (Join-Path $toolRoot "msstore.exe") --version

      - name: Configure Store CLI credentials
        if: startsWith(github.ref, 'refs/tags/')
        shell: pwsh
        run: |
          msstore reconfigure `
            --tenantId ${{ secrets.AZURE_AD_TENANT_ID }} `
            --sellerId ${{ secrets.SELLER_ID }} `
            --clientId ${{ secrets.AZURE_AD_APPLICATION_CLIENT_ID }} `
            --clientSecret ${{ secrets.AZURE_AD_APPLICATION_SECRET }}

      - name: Publish MSIX to Microsoft Store
        if: startsWith(github.ref, 'refs/tags/')
        shell: pwsh
        run: |
          $productId = "${{ vars.STORE_PRODUCT_ID }}"

          # 1. Stage the new package into a draft submission without committing,
          #    so the "What's New" notes can be attached to the same submission.
          msstore publish "dist/Q1View-windows-x64.msix" -id $productId --noCommit
          if ($LASTEXITCODE -ne 0) { throw "msstore publish (staging) failed with exit code $LASTEXITCODE" }

          # 2. Inject the curated What's New text (from CHANGELOG, prepared above)
          #    and keep listing copy pinned to docs/STORE_LISTING.md. updateMetadata
          #    submits the whole listing JSON, so rewrite the canonical text fields
          #    too; otherwise stale hard-wrapped Partner Center metadata can be
          #    re-committed while we only meant to update release notes.
          $notes = ""
          if (Test-Path STORE_WHATS_NEW.txt) { $notes = (Get-Content STORE_WHATS_NEW.txt -Raw).Trim() }
          if ($notes) {
            try {
              function Get-StoreListingBlock($headingPattern) {
                if (-not (Test-Path docs/STORE_LISTING.md)) { return "" }
                $lines = Get-Content docs/STORE_LISTING.md -Encoding utf8
                $inSection = $false
                $inFence = $false
                $block = New-Object System.Collections.Generic.List[string]
                foreach ($line in $lines) {
                  if (-not $inSection) {
                    if ($line -match $headingPattern) { $inSection = $true }
                    continue
                  }
                  if ($line -match '^```') {
                    if ($inFence) { break }
                    $inFence = $true
                    continue
                  }
                  if ($inFence) { $block.Add($line) }
                }
                return (($block -join "`n").Trim())
              }

              $storeDescription = Get-StoreListingBlock '^## Description '
              $storeShortDescription = Get-StoreListingBlock '^## Short description '

              # msstore can interleave informational lines with the JSON on
              # stdout, so slice from the first '{' to the last '}' before parsing.
              $raw = (msstore submission get $productId | Out-String)
              $open = $raw.IndexOf('{'); $close = $raw.LastIndexOf('}')
              if ($open -lt 0 -or $close -lt $open) { throw "submission get returned no JSON object" }
              $json = $raw.Substring($open, $close - $open + 1) | ConvertFrom-Json
              $script:releaseNotesUpdated = 0
              $script:descriptionUpdated = 0
              $script:shortDescriptionUpdated = 0
              function Set-ListingText($node, $releaseNotes, $description, $shortDescription) {
                if ($null -eq $node) { return }
                if ($node -is [pscustomobject]) {
                  foreach ($p in $node.PSObject.Properties) {
                    if ($p.Name -eq 'releaseNotes') { $p.Value = $releaseNotes; $script:releaseNotesUpdated++ }
                    elseif ($description -and $p.Name -eq 'description') { $p.Value = $description; $script:descriptionUpdated++ }
                    elseif ($shortDescription -and $p.Name -eq 'shortDescription') { $p.Value = $shortDescription; $script:shortDescriptionUpdated++ }
                    else { Set-ListingText $p.Value $releaseNotes $description $shortDescription }
                  }
                } elseif ($node -is [System.Collections.IEnumerable] -and $node -isnot [string]) {
                  foreach ($item in $node) { Set-ListingText $item $releaseNotes $description $shortDescription }
                }
              }
              Set-ListingText $json $notes $storeDescription $storeShortDescription
              if ($script:releaseNotesUpdated -gt 0) {
                msstore submission updateMetadata $productId ($json | ConvertTo-Json -Depth 50 -Compress)
                Write-Host "Updated What's New in $($script:releaseNotesUpdated) listing(s)."
                Write-Host "Updated Store description in $($script:descriptionUpdated) listing(s)."
                Write-Host "Updated Store short description in $($script:shortDescriptionUpdated) listing(s)."
              } else {
                Write-Host "::warning::No 'releaseNotes' field found in submission metadata; What's New left unchanged."
              }
            } catch {
              Write-Host "::warning::What's New update failed (package still submitted): $($_.Exception.Message)"
            }
          }

          # 3. Commit / submit the draft for certification.
          msstore submission publish $productId
          if ($LASTEXITCODE -ne 0) { throw "msstore submission publish failed with exit code $LASTEXITCODE" }