git-artifacts.yml

name: git-artifacts
run-name: Build git-artifacts (${{ inputs.artifacts != '' && format('{0} ', inputs.artifacts) || '' }}${{ inputs.architecture }})

on:
  workflow_dispatch:
    inputs:
      artifacts:
        description: 'Optionally restrict what artifacts to build (portable, installer, etc.). Separate artifacts with spaces'
        required: false
      architecture:
        type: choice
        description: 'Architecture to build'
        required: true
        options:
        - x86_64
        - i686
        - aarch64
        - ucrt64
      tag_git_workflow_run_id:
        description: 'Workflow run ID of the tag-git pipeline'
        required: false
      existing_git_tag:
        description: 'Existing tag to build from. Requires tag_git_workflow_run_id to be empty'
        required: false
      build_extra_rev_for_existing_git_tag:
        description: 'build-extra revision to use if building from an existing Git tag. Required if existing_git_tag is non-empty'
        required: false

env:
  GPG_OPTIONS: "--batch --yes --no-tty --list-options no-show-photos --verify-options no-show-photos --pinentry-mode loopback"
  HOME: "${{github.workspace}}\\home"
  USERPROFILE: "${{github.workspace}}\\home"
  ARTIFACTS_TO_BUILD: "${{github.event.inputs.artifacts}}"
  ARCHITECTURE: "${{github.event.inputs.architecture}}"
  OWNER: git-for-windows
  REPO: git
  TAG_GIT_WORKFLOW_RUN_ID: "${{github.event.inputs.tag_git_workflow_run_id}}"
  EXISTING_GIT_TAG: "${{github.event.inputs.existing_git_tag}}"
  BUILD_EXTRA_REV_FOR_EXISTING_GIT_TAG: "${{github.event.inputs.build_extra_rev_for_existing_git_tag}}"
  # Rust became opt-out (NO_RUST) in Git's Makefile as of v2.55.0-rc0
  # (git.git commit 32d5b905909e, "Enable Rust by default"), and the
  # Git for Windows SDK does not yet ship a default Rust toolchain
  # that `make` can drive. Match upstream's own Windows CI (see
  # `ci/lib.sh`'s `windows-*) export NO_RUST=UnfortunatelyYes`) and
  # opt out here until cargo is wired into the SDK. The variable is
  # consumed directly by GNU make's `ifdef NO_RUST`, so exporting it
  # in the workflow environment suffices; no `config.mak` is needed.
  NO_RUST: UnfortunatelyYes

defaults:
  run:
    shell: bash

jobs:
  pkg:
    runs-on: ${{ github.event.inputs.architecture == 'aarch64' && 'windows-11-arm' || 'windows-latest' }}
    permissions:
      id-token: write
      contents: read
      actions: read
    outputs:
      artifact_matrix: ${{ steps.artifact-build-matrix.outputs.result }}
      msystem: ${{steps.configure-environment.outputs.MSYSTEM}}
      mingw-prefix: ${{steps.configure-environment.outputs.MINGW_PREFIX}}
      mingw_package_prefix: ${{steps.configure-environment.outputs.MINGW_PACKAGE_PREFIX}}
      sdk_repo_arch: ${{steps.configure-environment.outputs.SDK_REPO_ARCH}}
      check-run-state: ${{steps.check-run-state.outputs.check-run-state}}
    steps:
      - name: clone git-for-windows-automation
        uses: actions/checkout@v6
      - name: Construct bundle-artifacts from existing tag
        if: env.EXISTING_GIT_TAG != ''
        run: |
          die () {
            echo "$*" >&2
            exit 1
          }

          set -x
          test -z "$TAG_GIT_WORKFLOW_RUN_ID" ||
          die 'existing_git_tag cannot be used with tag_git_workflow_run_id!'

          test -n "$BUILD_EXTRA_REV_FOR_EXISTING_GIT_TAG" ||
          die 'existing_git_tag needs build_extra_rev_for_existing_git_tag!'

          set -o pipefail &&

          mkdir -p bundle-artifacts &&
          echo "$EXISTING_GIT_TAG" >bundle-artifacts/next_version &&
          echo "$EXISTING_GIT_TAG" |
          sed -n '/^v[0-9]\+\.[0-9]\+\.[0-9]\+\(-rc[0-9]\+\)\?\.windows\.[0-9]\+$/{s/^v//;s/\.windows\.1//;s/\.windows\.\(.*\)/(\1)/;p}' \
            >bundle-artifacts/display_version &&
          sed 's/(\(.*\))$/.\1/' <bundle-artifacts/display_version >bundle-artifacts/ver &&
          ver="$(cat bundle-artifacts/ver)" &&
          test -n "$ver" &&
          echo "GIT_VERSION=$EXISTING_GIT_TAG" >> $GITHUB_ENV &&
          git fetch --depth 1 --filter blob:none https://github.com/$OWNER/$REPO "refs/tags/$EXISTING_GIT_TAG:refs/tags/$EXISTING_GIT_TAG" &&
          echo "GIT_REV=$(git rev-parse --verify "refs/tags/$EXISTING_GIT_TAG"^0)" >>$GITHUB_ENV
      - name: wait if workflow run has not finished yet
        if: env.TAG_GIT_WORKFLOW_RUN_ID != ''
        uses: actions/github-script@v9
        with:
          script: |
            const { waitForWorkflowRunToFinish } = require('./workflow-runs')
            await waitForWorkflowRunToFinish(
              console,
              '${{ secrets.GITHUB_TOKEN }}',
              context.repo.owner,
              context.repo.repo,
              process.env.TAG_GIT_WORKFLOW_RUN_ID
            )
      - name: Get bundle-artifacts download URL
        uses: actions/github-script@v9
        if: env.TAG_GIT_WORKFLOW_RUN_ID != ''
        id: get-bundle-artifacts-url
        with:
          script: |
            if (process.env.EXISTING_GIT_TAG || process.env.BUILD_EXTRA_REV_FOR_EXISTING_GIT_TAG) {
              throw new Error('tag_git_workflow_run_id cannot be used with existing_git_tag or build_extra_rev_for_existing_git_tag!')
            }
            const getDownloadURL = require('./get-workflow-run-artifact')
            const workflowRunId = process.env.TAG_GIT_WORKFLOW_RUN_ID
            core.info('Getting download URL for bundle-artifacts...')
            const downloadURL = await getDownloadURL(github, context.repo.owner, context.repo.repo, workflowRunId, 'bundle-artifacts')

            core.info(`Successfully got download URL. It expires after 1 minute: ${downloadURL}`)
            core.setOutput('download-url', downloadURL)
      - name: Download bundle-artifacts zip
        if: env.TAG_GIT_WORKFLOW_RUN_ID != ''
        run: |
          mkdir bundle-artifacts
          curl -o bundle-artifacts.zip "${{steps.get-bundle-artifacts-url.outputs.download-url}}"
          unzip bundle-artifacts.zip -d bundle-artifacts
          echo "GIT_VERSION=$(cat bundle-artifacts/next_version)" >> $GITHUB_ENV
          echo "GIT_REV=$(cat bundle-artifacts/git-commit-oid)" >>$GITHUB_ENV
          if test -f bundle-artifacts/snapshot
          then
            echo "IS_SNAPSHOT=$(cat bundle-artifacts/snapshot)" >>$GITHUB_ENV
          fi
      - name: Mirror Check Run to ${{ env.OWNER }}/${{ env.REPO }}
        uses: ./.github/actions/check-run-action
        with:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          owner: ${{ env.OWNER }}
          repo: ${{ env.REPO }}
          rev: ${{ env.GIT_REV }}
          check-run-name: "git-artifacts-${{ env.ARCHITECTURE }}"
          title: "Build Git ${{ env.GIT_VERSION }} artifacts"
          summary: "Build Git ${{ env.GIT_VERSION }} artifacts from commit ${{ env.GIT_REV }}${{ env.TAG_GIT_WORKFLOW_RUN_ID && format(' (tag-git run #{0})', env.TAG_GIT_WORKFLOW_RUN_ID) || '' }}"
          text: "For details, see [this run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id}})."
          details-url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id}}"
      - name: Re-publish bundle-artifacts so the next job can easily use it
        uses: actions/upload-artifact@v7
        with:
          name: bundle-artifacts
          path: bundle-artifacts
      - name: Configure environment
        id: configure-environment
        run: |
          case "$ARCHITECTURE" in
            x86_64)
              MSYSTEM=MINGW64
              MINGW_PREFIX=/mingw64
              MINGW_PACKAGE_PREFIX=mingw-w64-x86_64
              SDK_REPO_ARCH=64
              ;;
            i686)
              MSYSTEM=MINGW32
              MINGW_PREFIX=/mingw32
              MINGW_PACKAGE_PREFIX=mingw-w64-i686
              SDK_REPO_ARCH=32
              ;;
            aarch64)
              MSYSTEM=CLANGARM64
              MINGW_PREFIX=/clangarm64
              MINGW_PACKAGE_PREFIX=mingw-w64-clang-aarch64
              SDK_REPO_ARCH=arm64
              ;;
            ucrt64)
              MSYSTEM=UCRT64
              MINGW_PREFIX=/ucrt64
              MINGW_PACKAGE_PREFIX=mingw-w64-ucrt-x86_64
              SDK_REPO_ARCH=64
              ;;
            *)
              echo "Unhandled architecture: $ARCHITECTURE"
              exit 1
              ;;
          esac
          echo "MSYSTEM=$MSYSTEM" >> $GITHUB_ENV
          echo "MSYSTEM=$MSYSTEM" >> $GITHUB_OUTPUT
          echo "MINGW_PREFIX=$MINGW_PREFIX" >> $GITHUB_ENV
          echo "MINGW_PREFIX=$MINGW_PREFIX" >> $GITHUB_OUTPUT
          echo "MINGW_PACKAGE_PREFIX=$MINGW_PACKAGE_PREFIX" >> $GITHUB_ENV
          echo "MINGW_PACKAGE_PREFIX=$MINGW_PACKAGE_PREFIX" >> $GITHUB_OUTPUT
          echo "SDK_REPO_ARCH=$SDK_REPO_ARCH" >> $GITHUB_OUTPUT
          test -n "$ARTIFACTS_TO_BUILD" || {
            ARTIFACTS_TO_BUILD="mingit"
            test "$ARCHITECTURE" = i686 || ARTIFACTS_TO_BUILD="installer portable archive $ARTIFACTS_TO_BUILD"
            test "$ARCHITECTURE" = aarch64 || ARTIFACTS_TO_BUILD="$ARTIFACTS_TO_BUILD mingit-busybox"
            test "$ARCHITECTURE" != x86_64 || ARTIFACTS_TO_BUILD="$ARTIFACTS_TO_BUILD nuget"
          }
          echo "ARTIFACTS_TO_BUILD=$ARTIFACTS_TO_BUILD" >> $GITHUB_ENV
          echo "PKG_CACHE_KEY=pkg-$GIT_VERSION-$ARCHITECTURE-$TAG_GIT_WORKFLOW_RUN_ID" >> $GITHUB_ENV
      - name: Configure user
        run:
          USER_NAME="${{github.actor}}" &&
          USER_EMAIL="${{github.actor}}@users.noreply.github.com" &&
          mkdir "$HOME" &&
          git config --global user.name "$USER_NAME" &&
          git config --global user.email "$USER_EMAIL" &&
          echo "PACKAGER=$USER_NAME <$USER_EMAIL>" >> $GITHUB_ENV
      - uses: git-for-windows/setup-git-for-windows-sdk@v2
        with:
          flavor: build-installers
          architecture: ${{env.architecture}}
      - name: Create artifact build matrix
        uses: actions/github-script@v9
        id: artifact-build-matrix
        with:
          script: |
            core.info('Preparing artifact build matrix...')
            const createArtifactsMatrix = require('./create-artifacts-matrix')
            try {
              const output = createArtifactsMatrix(process.env.ARTIFACTS_TO_BUILD, process.env.ARCHITECTURE)
              core.info(`Will be using the following matrix: ${JSON.stringify(output)}`)
              return output
            } catch (e) {
              core.setFailed(e.message)
            }
      - name: Restore ${{env.MINGW_PACKAGE_PREFIX}}-git, if cached
        id: restore-cached-git-pkg
        uses: actions/cache/restore@v5
        with:
          path: artifacts
          key: ${{ env.PKG_CACHE_KEY }}
      - name: Clone and update build-extra
        if: steps.restore-cached-git-pkg.outputs.cache-hit != 'true'
        run: |
          d=/usr/src/build-extra &&
          if test ! -d $d/.git
          then
            git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d
          else
            git -C $d fetch https://github.com/git-for-windows/build-extra main &&
            git -C $d switch -C main FETCH_HEAD
          fi &&
          if test -z "$BUILD_EXTRA_REV_FOR_EXISTING_GIT_TAG"
          then
            git -C $d -c pull.rebase=false pull "$PWD"/bundle-artifacts/build-extra.bundle main
          else
            git -C $d fetch origin "$BUILD_EXTRA_REV_FOR_EXISTING_GIT_TAG" &&
            git -C $d reset --hard "$BUILD_EXTRA_REV_FOR_EXISTING_GIT_TAG"
          fi
      - name: Prepare git-for-windows/git clone with the tag
        if: steps.restore-cached-git-pkg.outputs.cache-hit != 'true'
        run: |
          set -x
          if test ! -d /usr/src/MINGW-packages
          then
            git clone --depth 1 --single-branch -b main \
              https://github.com/git-for-windows/MINGW-packages /usr/src/MINGW-packages
          fi &&
          cd /usr/src/MINGW-packages/mingw-w64-git &&
          if test ! -d git
          then
            git clone --bare https://github.com/git-for-windows/git.git git
          fi &&
          if test ! -d src/git
          then
            git clone --reference git https://github.com/git-for-windows/git src/git &&
            echo ../../../../git/objects >src/git/.git/objects/info/alternates
          fi &&
          cd src/git &&
          if test -n "$EXISTING_GIT_TAG"
          then
            git fetch origin "refs/tags/$EXISTING_GIT_TAG:refs/tags/$EXISTING_GIT_TAG"
          else
            git -c fetch.writeCommitGraph=false fetch --tags --no-recurse-submodules \
             "$GITHUB_WORKSPACE"/bundle-artifacts/git.bundle \
              $(cat "$GITHUB_WORKSPACE"/bundle-artifacts/next_version)
          fi &&
          git reset --hard $(cat "$GITHUB_WORKSPACE"/bundle-artifacts/next_version)
      - name: Azure Login (OIDC)
        env:
          AZURE_CLIENT_ID: ${{secrets.AZURE_CLIENT_ID}}
        if: env.AZURE_CLIENT_ID != '' && steps.restore-cached-git-pkg.outputs.cache-hit != 'true'
        uses: azure/login@v3
        with:
          client-id: ${{secrets.AZURE_CLIENT_ID}}
          tenant-id: ${{secrets.AZURE_TENANT_ID}}
          allow-no-subscriptions: true
      - name: Set up code-signing with Azure Artifact Signing
        env:
          AZURE_CLIENT_ID: ${{secrets.AZURE_CLIENT_ID}}
          AZURE_SIGNING_OPTS: ${{secrets.AZURE_SIGNING_OPTS}}
        if: env.AZURE_CLIENT_ID != '' && steps.restore-cached-git-pkg.outputs.cache-hit != 'true'
        run: |
          echo "AZURE_SIGNING_OPTS=$AZURE_SIGNING_OPTS" >>$GITHUB_ENV &&
          git config --global alias.signtool "!sh \"$PWD/azure-signtool.sh\""
      - name: Prepare home directory for GPG signing
        timeout-minutes: 5
        if: env.GPGKEY != '' && steps.restore-cached-git-pkg.outputs.cache-hit != 'true'
        run: |
          echo '${{secrets.PRIVGPGKEY}}' | tr % '\n' | gpg $GPG_OPTIONS --import &&
          info="$(gpg --list-keys --with-colons "${GPGKEY%% *}" | cut -d : -f 1,10 | sed -n '/^uid/{s|uid:||p;q}')" &&
          git config --global user.name "${info% <*}" &&
          git config --global user.email "<${info#*<}" &&
          echo "PACKAGER=$info" >>$GITHUB_ENV
        env:
          GPGKEY: ${{secrets.GPGKEY}}
      - name: update check-run
        if: steps.restore-cached-git-pkg.outputs.cache-hit != 'true'
        uses: ./.github/actions/check-run-action
        with:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          append-text: 'About to build the `${{env.MINGW_PACKAGE_PREFIX}}-git` package'
      - name: Build ${{env.MINGW_PACKAGE_PREFIX}}-git
        timeout-minutes: 60
        if: steps.restore-cached-git-pkg.outputs.cache-hit != 'true'
        env:
          GPGKEY: "${{secrets.GPGKEY}}"
        run: |
          set -x
          BUILD_SRC=$(test x86_64 != "$ARCHITECTURE" || echo "--build-src-pkg")
          # Make sure that there is a `/usr/bin/git` that can be used by `makepkg-mingw`
          if test ! -x /usr/bin/git
          then
            printf '#!/bin/sh\n\nexec '$MINGW_PREFIX'/bin/git.exe "$@"\n' >/usr/bin/git
          fi &&
          (
            cd /usr/src/MINGW-packages/mingw-w64-git/src/git &&
            /usr/src/build-extra/please.sh build-mingw-w64-git --reset-pkgrel --only-$ARCHITECTURE $BUILD_SRC \
              -o "$GITHUB_WORKSPACE"/artifacts HEAD
          ) &&
          cp bundle-artifacts/ver artifacts/ &&
          if test -n "$GPGKEY"
          then
            for tar in artifacts/*.tar*
            do
              /usr/src/build-extra/gnupg-with-gpgkey.sh --detach-sign --no-armor $tar
            done
          fi &&
          b=$PWD/artifacts &&
          version=$(cat bundle-artifacts/next_version) &&
          (cd /usr/src/MINGW-packages/mingw-w64-git &&
          cp PKGBUILD.$version PKGBUILD &&
          if test -z "$EXISTING_GIT_TAG"
          then
            git commit -s -m "mingw-w64-git: new version ($version)" PKGBUILD &&

            # Create MSYS2 sync branch: based on msys2/master with our mingw-w64-git/ content
            # See https://github.com/msys2/MINGW-packages/pull/26470
            msys2_sync_branch="msys2-sync-$version" &&
            git fetch --depth 1 https://github.com/msys2/MINGW-packages master &&
            git worktree add -b "$msys2_sync_branch" --no-checkout msys2-sync FETCH_HEAD &&
            git -C msys2-sync sparse-checkout set mingw-w64-git &&
            git -C msys2-sync checkout main -- mingw-w64-git &&
            git -C msys2-sync commit -F - -- mingw-w64-git <<COMMIT_MSG &&
          mingw-w64-git: upgrade to Git for Windows $version

          This commit was created by:
          $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID

          See https://github.com/git-for-windows/git/releases/tag/$version for details.
          COMMIT_MSG
            echo "::notice::Created MSYS2 sync branch $msys2_sync_branch at $(git -C msys2-sync rev-parse HEAD)" &&
            git worktree remove -f msys2-sync &&

            git bundle create "$b"/MINGW-packages.bundle origin/main..main FETCH_HEAD.."$msys2_sync_branch"
          elif ! git update-index --ignore-submodules --refresh ||
            ! git diff-files --ignore-submodules ||
            ! git diff-index --cached --ignore-submodules HEAD
          then
            echo "::warning::Uncommitted changes after build!" >&2 &&
            git diff >&2 &&
            git commit -s -m "mingw-w64-git: new version ($version)" PKGBUILD &&
            git bundle create "$b"/MINGW-packages.bundle main^..main
          fi)
      - name: Cache ${{env.MINGW_PACKAGE_PREFIX}}-git
        if: steps.restore-cached-git-pkg.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        with:
          path: artifacts
          key: ${{ env.PKG_CACHE_KEY }}
      - name: update check-run
        uses: ./.github/actions/check-run-action
        with:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          append-text: 'The `${{env.MINGW_PACKAGE_PREFIX}}-git` package was built successfully'
      - name: Publish ${{env.MINGW_PACKAGE_PREFIX}}-git
        uses: actions/upload-artifact@v7
        with:
          name: pkg-${{env.ARCHITECTURE}}
          path: artifacts
      - name: make check-run state available to other jobs
        id: check-run-state
        run: |
          echo "check-run-state=$(base64 -w 0 <"$RUNNER_TEMP/check-run.state")" >>$GITHUB_OUTPUT
      - name: update check-run if failed or canceled
        if: failure() || cancelled()
        uses: ./.github/actions/check-run-action
        with:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          append-text: "${{ format('Completed: {0}', job.status) }}."
          conclusion: ${{ job.status }}
  artifacts:
    runs-on: ${{ github.event.inputs.architecture == 'aarch64' && 'windows-11-arm' || 'windows-latest' }}
    needs: pkg
    permissions:
      id-token: write
      contents: read
      actions: read
    env:
      MSYSTEM: ${{ needs.pkg.outputs.msystem }}
      MINGW_PREFIX: ${{ needs.pkg.outputs.mingw-prefix }}
      MINGW_PACKAGE_PREFIX: ${{ needs.pkg.outputs.mingw_package_prefix }}
      SDK_REPO_ARCH: ${{ needs.pkg.outputs.sdk_repo_arch }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.pkg.outputs.artifact_matrix) }}
    outputs:
      sha256sum-installer: ${{ steps.build.outputs.sha256sum-installer }}
      sha256sum-portable: ${{ steps.build.outputs.sha256sum-portable }}
      sha256sum-archive: ${{ steps.build.outputs.sha256sum-archive }}
      sha256sum-mingit: ${{ steps.build.outputs.sha256sum-mingit }}
      sha256sum-mingit-busybox: ${{ steps.build.outputs.sha256sum-mingit-busybox }}
      sha256sum-nuget: ${{ steps.build.outputs.sha256sum-nuget }}
    steps:
      - name: clone git-for-windows-automation
        if: needs.pkg.outputs.check-run-state != '' && always()
        uses: actions/checkout@v6
      - name: Download pkg-${{env.ARCHITECTURE}}
        uses: actions/download-artifact@v8
        with:
          name: pkg-${{env.ARCHITECTURE}}
          path: pkg-${{env.ARCHITECTURE}}
      - name: Download bundle-artifacts
        uses: actions/download-artifact@v8
        with:
          name: bundle-artifacts
          path: bundle-artifacts
      - uses: git-for-windows/setup-git-for-windows-sdk@v2
        with:
          flavor: build-installers
          architecture: ${{env.ARCHITECTURE}}
      - name: Configure user
        run:
          USER_NAME="${{github.actor}}" &&
          USER_EMAIL="${{github.actor}}@users.noreply.github.com" &&
          mkdir "$HOME" &&
          git config --global user.name "$USER_NAME" &&
          git config --global user.email "$USER_EMAIL"
      - name: Clone and update build-extra
        id: build-extra
        run: |
          d=/usr/src/build-extra &&
          if test ! -d $d/.git
          then
            git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d
          else
            git -C $d fetch https://github.com/git-for-windows/build-extra main &&
            git -C $d switch -C main FETCH_HEAD
          fi &&
          echo "result=$(cygpath -am "$d")" >> $GITHUB_OUTPUT &&
          if test -z "$BUILD_EXTRA_REV_FOR_EXISTING_GIT_TAG"
          then
            git -C $d -c pull.rebase=false pull "$PWD"/bundle-artifacts/build-extra.bundle main
          else
            git -C $d fetch origin "$BUILD_EXTRA_REV_FOR_EXISTING_GIT_TAG" &&
            git -C $d reset --hard "$BUILD_EXTRA_REV_FOR_EXISTING_GIT_TAG"
          fi
      - name: Prepare some command-line options
        run: |
          # Build the `--pkg=<pkg>` list
          printf 'PKG_OPTS=%s\n' \
            "$(ls pkg-$ARCHITECTURE/$MINGW_PACKAGE_PREFIX-*.tar.* |
              sed '/\.sig$/d;/archimport/d;/cvs/d;/p4/d;/gitweb/d;s/^/--pkg=/' |
              tr '\n' ' ')" >>$GITHUB_ENV &&
          echo "VERSION_OPT=--version=$(cat pkg-"$ARCHITECTURE"/ver)" >>$GITHUB_ENV
      - name: Azure Login (OIDC)
        env:
          AZURE_CLIENT_ID: ${{secrets.AZURE_CLIENT_ID}}
        if: (matrix.artifact.name == 'installer' || matrix.artifact.name == 'portable') && env.AZURE_CLIENT_ID != ''
        uses: azure/login@v3
        with:
          client-id: ${{secrets.AZURE_CLIENT_ID}}
          tenant-id: ${{secrets.AZURE_TENANT_ID}}
          allow-no-subscriptions: true
      - name: Set up code-signing with Azure Artifact Signing
        env:
          AZURE_CLIENT_ID: ${{secrets.AZURE_CLIENT_ID}}
          AZURE_SIGNING_OPTS: ${{secrets.AZURE_SIGNING_OPTS}}
        if: (matrix.artifact.name == 'installer' || matrix.artifact.name == 'portable') && env.AZURE_CLIENT_ID != ''
        run: |
          echo "AZURE_SIGNING_OPTS=$AZURE_SIGNING_OPTS" >>$GITHUB_ENV &&
          git config --global alias.signtool "!sh \"$PWD/azure-signtool.sh\""
      - name: Build ${{env.ARCHITECTURE}} ${{matrix.artifact.name}}-mingit
        if: matrix.artifact.name == 'nuget'
        run: |
          set -x
          eval /usr/src/build-extra/please.sh \
            make_installers_from_mingw_w64_git \
            $VERSION_OPT \
            -o artifacts \
            --${{matrix.artifact.name}}-mingit \
            $PKG_OPTS
      - name: Build ${{env.ARCHITECTURE}} ${{matrix.artifact.name}}
        id: build
        run: |
          set -x
          if test mingit-busybox = ${{matrix.artifact.name}}
          then
            VERSION_OPT="$VERSION_OPT-busybox"
          fi &&
          eval /usr/src/build-extra/please.sh \
            make_installers_from_mingw_w64_git \
            $VERSION_OPT \
            -o artifacts \
            --${{matrix.artifact.name}} \
            $PKG_OPTS &&
          if test portable = '${{matrix.artifact.name}}' && test -n "$(git config alias.signtool)"
          then
            git signtool artifacts/PortableGit-*.exe
          fi &&
          (
            cd artifacts &&
            openssl dgst -sha256 -r ${{matrix.artifact.fileprefix}}*.${{matrix.artifact.fileextension}} >sha256sums.txt
          ) &&
          echo "sha256sum-${{ matrix.artifact.name}}<<EOF" >>$GITHUB_OUTPUT &&
          cat artifacts/sha256sums.txt >>$GITHUB_OUTPUT &&
          echo EOF >>$GITHUB_OUTPUT
      - name: Copy package-versions and pdbs (installer)
        if: matrix.artifact.name == 'installer'
        env:
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
        run: |
          cp /usr/src/build-extra/installer/package-versions.txt artifacts/ &&
          a=$PWD/artifacts &&
          p=$PWD/pkg-$ARCHITECTURE &&
          (cd /usr/src/build-extra &&
          mkdir -p cached-source-packages &&
          cp "$p"/*-pdb* cached-source-packages/ &&
          GIT_CONFIG_PARAMETERS="'windows.sdk$SDK_REPO_ARCH.path='" ./please.sh bundle_pdbs --arch=$ARCHITECTURE --directory="$a" installer/package-versions.txt)
      - name: Copy package-versions (MinGit)
        if: matrix.artifact.name == 'mingit'
        run: |
          cp /usr/src/build-extra/mingit/root/etc/package-versions.txt artifacts/
      - name: Publish ${{matrix.artifact.name}}-${{env.ARCHITECTURE}}
        uses: actions/upload-artifact@v7
        id: upload-artifact
        with:
          name: ${{matrix.artifact.name}}-${{env.ARCHITECTURE}}
          path: artifacts
      - uses: actions/create-github-app-token@v3
        if: (matrix.artifact.name == 'installer' || (matrix.artifact.name == 'portable' && env.IS_SNAPSHOT == 'true')) && github.event.inputs.architecture != 'i686'
        id: pr-comment-token
        with:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          owner: ${{ env.OWNER }}
          repositories: ${{ env.REPO }}
      - name: Add a PR comment suggesting to validate the installer manually
        if: matrix.artifact.name == 'installer' && github.event.inputs.architecture == 'x86_64' && env.IS_SNAPSHOT != 'true'
        uses: actions/github-script@v9
        with:
          github-token: ${{ steps.pr-comment-token.outputs.token }}
          script: |
            const installerURL = ${{ toJSON(steps.upload-artifact.outputs.artifact-url) }}
            const preFlightChecklistURL = 'https://github.com/git-for-windows/build-extra/blob/HEAD/installer/checklist.txt'
            const body = `## Validate the installer manually

            The [installer](${installerURL}) was built successfully;
            Please download, install, and run through [the pre-flight check-list](${preFlightChecklistURL}).`

            const fs = require('fs')
            const gitSHA = fs.readFileSync('bundle-artifacts/git-commit-oid')
            const q = `repo:${process.env.OWNER}/${process.env.REPO}+is:pr+is:open+${gitSHA}`
            const { data } = await github.rest.search.issuesAndPullRequests({ q })
            if (data.items.length !== 1) {
              core.warning(`${data.items.length} PRs found for ${gitSHA}, not posting a comment, would have posted:\n${body}`)
            } else {
              const req = {
                owner: process.env.OWNER,
                repo: process.env.REPO,
                issue_number: data.items[0].number,
                body: `${body}\n@${data.items[0].user.login} ☝️`,
              }

              await github.rest.issues.createComment(req)
            }
      - name: Add a PR comment with snapshot artifact links
        if: (matrix.artifact.name == 'installer' || matrix.artifact.name == 'portable') && github.event.inputs.architecture != 'i686' && env.IS_SNAPSHOT == 'true'
        uses: actions/github-script@v9
        with:
          github-token: ${{ steps.pr-comment-token.outputs.token }}
          script: |
            const artifactName = '${{ matrix.artifact.name }}'
            const artifactURL = ${{ toJSON(steps.upload-artifact.outputs.artifact-url) }}
            const arch = process.env.ARCHITECTURE
            const version = process.env.GIT_VERSION
            const label = artifactName === 'installer' ? 'Installer' : 'Portable Git'
            const line = `[${label}](${artifactURL}) (${version}, ${arch})`

            const fs = require('fs')
            const gitSHA = fs.readFileSync('bundle-artifacts/git-commit-oid').toString().trim()
            const q = `repo:${process.env.OWNER}/${process.env.REPO}+is:pr+is:open+${gitSHA}`
            const { data } = await github.rest.search.issuesAndPullRequests({ q })
            if (data.items.length !== 1) {
              core.warning(`${data.items.length} PRs found for ${gitSHA}, skipping PR comment`)
              return
            }

            const prNumber = data.items[0].number
            const { data: comments } = await github.rest.issues.listComments({
              owner: process.env.OWNER,
              repo: process.env.REPO,
              issue_number: prNumber,
            })

            const appLogin = (await github.rest.apps.getAuthenticated()).data.slug + '[bot]'
            let existing = null
            comments.forEach(c => {
              if (c.body.startsWith('/snapshot')) {
                existing = null
              } else if (c.user.login === appLogin &&
                         c.body.includes('## Snapshot artifacts')) {
                existing = c
              }
            })

            if (existing) {
              await github.rest.issues.updateComment({
                owner: process.env.OWNER,
                repo: process.env.REPO,
                comment_id: existing.id,
                body: `${existing.body}\n${line}`,
              })
            } else {
              await github.rest.issues.createComment({
                owner: process.env.OWNER,
                repo: process.env.REPO,
                issue_number: prNumber,
                body: `## Snapshot artifacts\n\n${line}`,
              })
            }
      - name: restore check-run state
        if: needs.pkg.outputs.check-run-state != '' && always()
        id: check-run-state
        run: |
          base64 -d <(echo "${{ needs.pkg.outputs.check-run-state }}") >"$RUNNER_TEMP/check-run.state"
      - name: update check-run
        if: needs.pkg.outputs.check-run-state != ''
        uses: ./.github/actions/check-run-action
        with:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          append-text: 'Built ${{ matrix.artifact.name }}'
      - name: Run the installer
        if: matrix.artifact.name == 'installer'
        shell: pwsh
        run: |
          $exePath = Get-ChildItem -Path artifacts/*.exe | %{$_.FullName}
          $installer = Start-Process -PassThru -Wait -FilePath "$exePath" -ArgumentList "/SILENT /VERYSILENT /NORESTART /SUPPRESSMSGBOXES /ALLOWDOWNGRADE=1 /LOG=installer.log"
          $exitCode = $installer.ExitCode
          if ($exitCode -ne 0) {
            Write-Host "::error::Installer failed with exit code $exitCode!"
            exit 1
          }
          "$env:ProgramFiles\Git\usr\bin" | Out-File -Encoding ascii -Append $env:GITHUB_PATH
          "$env:ProgramFiles\Git\${{env.MINGW_PREFIX}}\bin" | Out-File -Encoding ascii -Append $env:GITHUB_PATH
      - name: Publish installer log
        if: matrix.artifact.name == 'installer' && (failure() || success())
        uses: actions/upload-artifact@v7
        with:
          name: installer.log
          path: installer.log
      - name: Validate installer
        if: matrix.artifact.name == 'installer'
        shell: bash
        run: |
          set -x &&
          grep 'Installation process succeeded' installer.log &&
          ! grep -iw failed installer.log &&
          cygpath -aw / &&
          git.exe version --build-options >version &&
          cat version &&
          grep "$(sed -e 's|^v||' -e 's|-|.|g' <bundle-artifacts/next_version)" version &&
          checklist=${{ toJSON(steps.build-extra.outputs.result) }}/installer/run-checklist.sh &&
          # cannot test SSH keys in read-only mode, skip test for now
          sed -i 's|git@ssh.dev.azure.com:v3/git-for-windows/git/git|https://github.com/git/git|' $checklist &&
          sh -x $checklist
      - name: update check-run
        if: needs.pkg.outputs.check-run-state != '' && matrix.artifact.name == 'installer'
        uses: ./.github/actions/check-run-action
        with:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          append-text: 'Validated the installer'
      - name: update check-run if failed or canceled
        if: needs.pkg.outputs.check-run-state != '' && (failure() || cancelled())
        uses: ./.github/actions/check-run-action
        with:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          append-text: "${{ format('Completed: {0}', job.status) }}."
          conclusion: ${{ job.status }}
  sha256sums:
    runs-on: ubuntu-latest
    needs: ['pkg', 'artifacts']
    steps:
      - name: gather all SHA-256 checksums
        uses: actions/github-script@v9
        env:
          SHA256SUMS: ${{ toJSON(needs.artifacts.outputs) }}
        with:
          script: |
            const fs = require('fs')
            fs.mkdirSync('sha256sums')
            fs.writeFileSync('sha256sums/sha256sums.txt', Object.values(JSON.parse(process.env.SHA256SUMS)).join('\n'))
      - name: publish SHA-256 checksums
        uses: actions/upload-artifact@v7
        with:
          name: sha256sums
          path: sha256sums
      - name: clone git-for-windows-automation
        if: needs.pkg.outputs.check-run-state != '' && always()
        uses: actions/checkout@v6
      - name: restore check-run state
        if: needs.pkg.outputs.check-run-state != '' && always()
        id: check-run-state
        run: |
          base64 -d <(echo "${{ needs.pkg.outputs.check-run-state }}") >"$RUNNER_TEMP/check-run.state"
      - name: update check-run
        if: needs.pkg.outputs.check-run-state != '' && always()
        uses: ./.github/actions/check-run-action
        with:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          append-text: "${{ job.status == 'success' && 'Done!' || format('Completed: {0}', job.status) }}."
          conclusion: ${{ job.status }}