main.yml

name: pyRevitCI
on:
  # PR: opened / reopened / closed (merged close runs WIP or Release). Pushes to the PR branch do not trigger (no synchronize).
  pull_request:
    types: [opened, reopened, closed]
    branches:
      - develop
      - master
    paths:
      - 'bin/**'
      - 'dev/**'
      - 'extensions/**'
      - 'pyrevitlib/**'
      - 'release/**'
      - 'site-packages/**'
  # After merges (especially from forks), secrets are available on push but not on pull_request.
  push:
    branches:
      - develop
      - master
    paths:
      - 'bin/**'
      - 'dev/**'
      - 'extensions/**'
      - 'pyrevitlib/**'
      - 'release/**'
      - 'site-packages/**'
  workflow_dispatch:

env:
  MainRepo: "pyrevitlabs/pyRevit"
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  build:
    if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' || github.event.pull_request.merged }}
    runs-on: windows-latest
    env:
      WipRun: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.merged && github.base_ref == 'develop' }}
      ReleaseRun: ${{ (github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.merged && github.base_ref == 'master') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master') }}
    steps:
      - name: Report Context
        run: |
          echo "run: ${{ github.run_number }}"
          echo "job: ${{ github.job }}"
          echo "event_name: ${{ github.event_name }}"
          echo "event_path: ${{ github.event_path }}"
          echo "repository: ${{ github.repository }}"
          echo "ref: ${{ github.ref }}"
          echo "head_ref: ${{ github.head_ref }}"
          echo "base_ref: ${{ github.base_ref }}"
          echo "commit: ${{ github.sha }}"

      - name: Checkout Repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: recursive
          ref: ${{ github.event_name == 'pull_request' && (github.event.pull_request.merged && github.event.pull_request.merge_commit_sha || github.event.pull_request.head.sha) || github.sha }}

      - name: Prepare Python 3.14
        uses: actions/setup-python@v6
        with:
          python-version: '3.14'
          cache: 'pipenv'

      - name: Prepare pipenv
        run: |
          pip install pipenv
          pipenv install

      # needed for MahApps XamlColorSchemeGenerator
      - name: Prepare .NET SDKs
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: |
            3.1.x
            8.0.x

      - name: Cache NuGet packages
        uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/Directory.Build.props') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Prepare .NET 10.0
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Prepare msbuild
        uses: microsoft/setup-msbuild@v3

      - name: Prepare git
        if: (github.repository == env.MainRepo)
        uses: fregante/setup-git-user@v2
      
      - name: Check Build Environment
        if: (github.repository == env.MainRepo)
        run: pipenv run pyrevit check

      - name: Update Copyright Info
        if: (github.repository == env.MainRepo)
        run: |
          pipenv run pyrevit set year

      # WIP only: merged PR into develop
      - name: Update Build Info (WIP)
        if: (env.WipRun == 'true' && github.repository == env.MainRepo)
        run: |
          pipenv run pyrevit set build wip

      # RELEASE only: merged PR into master, or workflow_dispatch on master
      - name: Update Build Info (Release)
        if: (env.ReleaseRun == 'true' && github.repository == env.MainRepo)
        run: |
          pipenv run pyrevit set build release

      - name: Publish Build Info
        if: (github.repository == env.MainRepo)
        run: |
          pipenv run pyrevit set products

      - name: Build Products
        run: |
          pipenv run pyrevit build products

      - name: Verify LibGit2 native DLL in bin
        shell: pwsh
        run: |
          & "${{ github.workspace }}/release/Verify-LibGit2NativeDll.ps1"

      - name: Get Build Version
        if: (github.repository == env.MainRepo)
        id: buildversion
        uses: juliangruber/read-file-action@v1
        with:
          path: pyrevitlib/pyrevit/version

      - name: Get Install Version
        id: installversion
        uses: juliangruber/read-file-action@v1
        with:
          path: release/version

      # Only sign on merged PR runs (WIP/Release); fork PR contexts without secrets are excluded.
      - name: Require Trusted Signing secrets
        if: >
          github.repository == env.MainRepo &&
          (github.event_name != 'pull_request' ||
           github.event.pull_request.head.repo.full_name == github.repository) &&
          (env.WipRun == 'true' || env.ReleaseRun == 'true')
        shell: pwsh
        run: |
          if (-not "${{ secrets.AZURE_ENDPOINT }}") { throw "Missing secret: AZURE_ENDPOINT" }
          if (-not "${{ secrets.AZURE_TENANT_ID }}") { throw "Missing secret: AZURE_TENANT_ID" }
          if (-not "${{ secrets.AZURE_CLIENT_ID }}") { throw "Missing secret: AZURE_CLIENT_ID" }
          if (-not "${{ secrets.AZURE_CLIENT_SECRET }}") { throw "Missing secret: AZURE_CLIENT_SECRET" }
          if (-not "${{ secrets.AZURE_CODE_SIGNING_NAME }}") { throw "Missing secret: AZURE_CODE_SIGNING_NAME" }
          if (-not "${{ secrets.AZURE_CERT_PROFILE_NAME }}") { throw "Missing secret: AZURE_CERT_PROFILE_NAME" }
      
      - name: Sign files with Trusted Signing (DLLs and EXEs)
        if: >
          github.repository == env.MainRepo &&
          (github.event_name != 'pull_request' ||
           github.event.pull_request.head.repo.full_name == github.repository) &&
          (env.WipRun == 'true' || env.ReleaseRun == 'true')
        uses: azure/trusted-signing-action@v1.2.0
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: ${{ secrets.AZURE_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_NAME }}

          files-folder: bin/
          files-folder-filter: pyrevit*.exe,pyrevit*.dll,pyRevit*.dll
          files-folder-recurse: true
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256
      
      - name: Build Installers
        run: |
          pipenv run pyrevit build installers

      - name: Sign files with Trusted Signing (installers)
        if: >
          github.repository == env.MainRepo &&
          (github.event_name != 'pull_request' ||
           github.event.pull_request.head.repo.full_name == github.repository) &&
          (env.WipRun == 'true' || env.ReleaseRun == 'true')
        uses: azure/trusted-signing-action@v1.2.0
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: ${{ secrets.AZURE_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_NAME }}

          # Sign all exes inside the folder
          files-folder: dist/
          files-folder-filter: exe,msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256
      
      - name: Upload Installers
        if: >
          github.repository == env.MainRepo &&
          (github.event_name != 'pull_request' ||
           github.event.pull_request.head.repo.full_name == github.repository) &&
          (env.WipRun == 'true' || env.ReleaseRun == 'true')
        uses: actions/upload-artifact@v7
        with:
          name: pyrevit-installers
          path: |
            dist/pyRevit_${{ steps.installversion.outputs.content }}_signed.exe
            dist/pyRevit_${{ steps.installversion.outputs.content }}_admin_signed.exe
            dist/pyRevit_CLI_${{ steps.installversion.outputs.content }}_signed.exe
            dist/pyRevit_CLI_${{ steps.installversion.outputs.content }}_admin_signed.exe
            dist/pyRevit_CLI_${{ steps.installversion.outputs.content }}_admin_signed.msi
            dist/pyrevit-cli.${{ steps.installversion.outputs.content }}.nupkg
      - name: Generate Release Notes (Release)
        if: (env.ReleaseRun == 'true' && github.repository == env.MainRepo)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          pipenv run pyrevit report releasenotes > release_notes.md

      - name: Commit & Tag Changes (Release)
        if: (env.ReleaseRun == 'true' && github.repository == env.MainRepo)
        # configure git and commit changes
        run: |
          pipenv run pyrevit build commit
          git push
          git push --tags

      - name: Publish Release (Release)
        id: publish_release
        if: >
          env.ReleaseRun == 'true' &&
          github.repository == env.MainRepo &&
          (github.event_name != 'pull_request' ||
           github.event.pull_request.head.repo.full_name == github.repository)
        uses: softprops/action-gh-release@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: v${{ steps.buildversion.outputs.content }}
          name: pyRevit v${{ steps.installversion.outputs.content }}
          body_path: release_notes.md
          draft: true
          prerelease: false
          files: |
            dist/pyRevit_${{ steps.installversion.outputs.content }}_signed.exe
            dist/pyRevit_${{ steps.installversion.outputs.content }}_admin_signed.exe
            dist/pyRevit_CLI_${{ steps.installversion.outputs.content }}_signed.exe
            dist/pyRevit_CLI_${{ steps.installversion.outputs.content }}_admin_signed.exe
            dist/pyRevit_CLI_${{ steps.installversion.outputs.content }}_admin_signed.msi
            dist/pyrevit-cli.${{ steps.installversion.outputs.content }}.nupkg

      - name: Publish Choco Packages (Release)
        if: (env.ReleaseRun == 'true' && github.repository == env.MainRepo)
        run: |
          choco apikey --key ${{ secrets.CHOCO_TOKEN}} --source https://push.chocolatey.org/
          choco push dist/pyrevit-cli.${{ steps.installversion.outputs.content }}.nupkg -s https://push.chocolatey.org/

      - name: Notify Issue Threads (WIP)
        if: (env.WipRun == 'true' && github.repository == env.MainRepo)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          pipenv run pyrevit notify wip https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

      - name: Notify Issue Threads (Release)
        if: (env.ReleaseRun == 'true' && github.repository == env.MainRepo)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          pipenv run pyrevit notify release ${{ steps.publish_release.outputs.url }}

      - name: Increment Version & Commit (Release)
        if: (env.ReleaseRun == 'true' && github.repository == env.MainRepo)
        shell: bash
        run: |
          set -e
          git checkout develop
          git pull --rebase origin develop || { echo "Rebase failed — resolve conflicts on develop manually and re-run or bump version locally."; exit 1; }
          pipenv run pyrevit set next-version
          git push origin develop