WIP: Base build CD

Author: jasonleenaylor

.github/workflows/CD.yml .github/workflows/Base-CD.yml.github/workflows/CD.yml renamed to .github/workflows/Base-CD.yml

@@ -24,10 +24,6 @@ on:
         description: 'Commit-ish for liblcm repository'
         required: false
         default: 'master'
-      s3_copy:
-        description: 'Copy this build result to S3'
-        required: false
-        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -38,6 +34,7 @@ jobs:
     env:
       CROWDIN_API_KEY: ${{ secrets.FLEX_CROWDIN_API }}
       LcmRootDir: ${{ github.workspace }}/Localizations/LCM
+      FILESTOSIGNLATER: ./signExternally
     name: Build Debug and run Tests
     runs-on: windows-latest
     steps:
@@ -99,10 +96,19 @@ jobs:
             2.1.x
             3.1.x
             5.0.x
+
       - name: Install Overcrowdin
         shell: cmd
         run: |
           dotnet tool update -g overcrowdin || dotnet tool install -g overcrowdin
+
+      - name: Downgrade Wix Toolset - remove when runner has 3.14.2
+        run: |
+          choco uninstall wixtoolset
+          choco install wixtoolset --version 3.11.2 --allow-downgrade --force
+          echo "C:\Program Files (x86)\WiX Toolset v3.11\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+        if: github.event_name != 'pull_request'
+        
       - name: Prepare for build
         shell: cmd
         working-directory: Build
@@ -113,7 +119,7 @@ jobs:
         shell: powershell
         run: |
           cd Build
-          .\build64.bat /t:BuildBaseInstaller /property:config=release;action=test;desktopNotAvailable=true /v:d /bl ^| tee-object -FilePath build.log
+          .\build64.bat /t:BuildBaseInstaller "/property:config=release;action=test;desktopNotAvailable=true" /v:d /bl ^| tee-object -FilePath build.log
           cd ..
           cd BuildDir
           md5sum *.exe > md5.txt
@@ -143,22 +149,57 @@ jobs:
         with:
           log-path: Build/test-results.log
           token: ${{ secrets.GITHUB_TOKEN }}
-          
-      - name: Copy to S3
-        if: ${{ github.event.inputs.s3_copy }}
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_REGION: us-east-1
-          S3_BUCKET: flex-updates
-          S3_KEY: base-build/artifact.tar.gz
+
+      - name: Extract burn engines
+        id: extract_engines
+        if: github.event_name != 'pull_request'
+        working-directory: BuildDir
+        shell: cmd
+        run: |
+          insignia -ib FieldWorks_Offline.exe -o offline-engine.exe
+          insignia -ib FieldWorks_Online.exe -o online-engine.exe
+
+      - name: Sign Engines
+        if: github.event_name != 'pull_request'
+        uses: sillsdev/codesign/trusted-signing-action@v3
+        with:
+          credentials: ${{ secrets.TRUSTED_SIGNING_CREDENTIALS }}
+          files-folder: BuildDir
+          files-folder-filter: '*-engine.exe'
+          description:  'FieldWorks Installer'
+          description-url: 'https://software.sil.org/fieldworks/'
+        
+      - name: Reattach Engines
+        if: github.event_name != 'pull_request'
+        working-directory: BuildDir
+        shell: cmd
         run: |
-          tar -czf artifact.tar.gz BuildDir
-          aws s3 cp artifact.tar.gz s3://$S3_BUCKET/$S3_KEY
-            
-      - uses: actions/upload-artifact@v4
+          insignia -ab online-engine.exe FlexBridge_Online.exe -o FlexBridge_Online.exe
+          insignia -ab offline-engine.exe FlexBridge_Offline.exe -o FlexBridge_Offline.exe
+
+      - name: Sign Bundles
+        if: github.event_name != 'pull_request'
+        uses: sillsdev/codesign/trusted-signing-action@v3
+        with:
+          credentials: ${{ secrets.TRUSTED_SIGNING_CREDENTIALS }}
+          files-folder: BuildDir
+          files-folder-filter: FieldWorks_*.exe
+          description:  'FieldWorks Installer'
+          description-url: 'https://software.sil.org/fieldworks/'
+                    
+      - name: Upload Signed Installers
+        uses: actions/upload-artifact@v4
+        if: github.event_name != 'pull_request'
+        with:
+          name: FieldWorks-Installers
+          path: BuildDir/FieldWorks_*.exe
+          if-no-files-found: warn
+
+      - name: Upload Build Logs
+        uses: actions/upload-artifact@v4
+        if: always()
         with:
           name: build-logs
           path: |
             Build/*.log
-            Build/*.binlog
+            Build/*.binlog