release.yml

name: Release

# Triggered when a tag of the form vX.Y.Z is pushed. Builds the signed
# launcher, runs the user-side verifier, and attaches the release
# artifacts to the GitHub Release that the tag implicitly creates.
#
# This workflow expects ONE of the following sets of secrets to be
# configured at the repository or organization level:
#
#   (A) PFX-based signing (simpler, fine for standard OV certs)
#       CODESIGN_PFX_BASE64    — Base64-encoded .pfx file body
#       CODESIGN_PFX_PASSWORD  — Plaintext password for the .pfx
#
#   (B) Azure Trusted Signing (recommended for EV certs in HSM)
#       AZURE_TENANT_ID
#       AZURE_CLIENT_ID
#       AZURE_CLIENT_SECRET
#       AZURE_TRUSTED_SIGNING_ENDPOINT
#       AZURE_TRUSTED_SIGNING_ACCOUNT
#       AZURE_TRUSTED_SIGNING_CERT_PROFILE
#
# The workflow auto-detects which set is configured and uses that path.

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-*'
  workflow_dispatch:
    inputs:
      ref:
        description: 'Ref to build (tag or sha)'
        required: true
        default: 'main'

permissions:
  contents: write   # needed to create the GitHub Release
  id-token: write   # needed for Azure Trusted Signing's OIDC flow

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Build signed release (Windows)
    runs-on: windows-latest
    timeout-minutes: 25
    environment: release

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.inputs.ref || github.ref }}
          persist-credentials: false

      - name: Resolve tag / version
        id: ver
        shell: pwsh
        run: |
          $tag = if ($env:GITHUB_REF -like 'refs/tags/*') {
            $env:GITHUB_REF.Substring('refs/tags/'.Length)
          } else {
            "dev-$(git rev-parse --short HEAD)"
          }
          $version = $tag -replace '^v',''
          "tag=$tag"         | Add-Content -Path $env:GITHUB_OUTPUT
          "version=$version" | Add-Content -Path $env:GITHUB_OUTPUT
          Write-Host "tag=$tag version=$version"

      - name: Verify CHANGELOG mentions this version
        shell: pwsh
        run: |
          $version = '${{ steps.ver.outputs.version }}'
          if (-not (Select-String -Path CHANGELOG.md -Pattern "## \[$([Regex]::Escape($version))\]" -Quiet)) {
            throw "CHANGELOG.md has no '## [$version]' section."
          }

      - name: Install Pester 5
        shell: pwsh
        run: |
          if (-not (Get-Module -ListAvailable -Name Pester | Where-Object { $_.Version.Major -ge 5 })) {
            Install-Module -Name Pester -MinimumVersion 5.5.0 -Scope CurrentUser -Force -SkipPublisherCheck
          }

      - name: Detect signing mode
        id: signmode
        shell: pwsh
        run: |
          $hasPfx = -not [string]::IsNullOrEmpty($env:CODESIGN_PFX_BASE64)
          $hasAzure = -not [string]::IsNullOrEmpty($env:AZURE_TENANT_ID)
          if ($hasAzure) {
            "mode=azure" | Add-Content -Path $env:GITHUB_OUTPUT
          } elseif ($hasPfx) {
            "mode=pfx"   | Add-Content -Path $env:GITHUB_OUTPUT
          } else {
            "mode=none"  | Add-Content -Path $env:GITHUB_OUTPUT
            Write-Warning "No signing secrets configured. Will produce an UNSIGNED release."
          }
        env:
          CODESIGN_PFX_BASE64: ${{ secrets.CODESIGN_PFX_BASE64 }}
          AZURE_TENANT_ID:     ${{ secrets.AZURE_TENANT_ID }}

      - name: Materialize PFX from secret
        if: steps.signmode.outputs.mode == 'pfx'
        shell: pwsh
        run: |
          $bytes = [Convert]::FromBase64String($env:CODESIGN_PFX_BASE64)
          $pfxPath = Join-Path $env:RUNNER_TEMP 'codesign.pfx'
          [IO.File]::WriteAllBytes($pfxPath, $bytes)
          "PFX_PATH=$pfxPath" | Add-Content -Path $env:GITHUB_ENV
        env:
          CODESIGN_PFX_BASE64: ${{ secrets.CODESIGN_PFX_BASE64 }}

      - name: Build (PFX signing)
        if: steps.signmode.outputs.mode == 'pfx'
        shell: pwsh
        run: |
          $sec = ConvertTo-SecureString -String $env:PFX_PWD -AsPlainText -Force
          .\build.ps1 -Clean -CertPath $env:PFX_PATH -CertPassword $sec
        env:
          PFX_PWD: ${{ secrets.CODESIGN_PFX_PASSWORD }}

      - name: Build (Azure Trusted Signing)
        if: steps.signmode.outputs.mode == 'azure'
        shell: pwsh
        run: |
          # Build unsigned first; Azure action signs as a post-step.
          .\build.ps1 -SkipTests -Clean
        # The actual Azure signing step follows.

      - name: Sign with Azure Trusted Signing
        if: steps.signmode.outputs.mode == 'azure'
        uses: azure/trusted-signing-action@v2
        with:
          azure-tenant-id:        ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id:        ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret:    ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint:               ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
          trusted-signing-account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT }}
          certificate-profile-name:     ${{ secrets.AZURE_TRUSTED_SIGNING_CERT_PROFILE }}
          files-folder:           ${{ github.workspace }}\release\dist
          files-folder-filter:    exe
          file-digest:            SHA256
          timestamp-rfc3161:      http://timestamp.acs.microsoft.com
          timestamp-digest:       SHA256

      - name: Recompute SHA256SUMS after Azure signing
        if: steps.signmode.outputs.mode == 'azure'
        shell: pwsh
        run: |
          Push-Location release/dist
          $files = @('claude-code-install-manager.exe', 'claude-code-install-manager.cmd')
          $lines = foreach ($f in $files) {
            $h = (Get-FileHash -LiteralPath $f -Algorithm SHA256).Hash.ToLower()
            "$h  $f"
          }
          $lines | Set-Content SHA256SUMS -Encoding ascii
          Pop-Location

      - name: Build (unsigned fallback)
        if: steps.signmode.outputs.mode == 'none'
        shell: pwsh
        run: .\build.ps1 -SkipTests -Clean

      - name: Verify signed release
        if: steps.signmode.outputs.mode != 'none'
        shell: pwsh
        run: |
          .\scripts\verify-release.ps1 -ReleaseDir .\release\dist
          if ($LASTEXITCODE -ne 0) { throw "verify-release reported failure." }

      - name: Verify unsigned release (relaxed)
        if: steps.signmode.outputs.mode == 'none'
        shell: pwsh
        run: |
          .\scripts\verify-release.ps1 -ReleaseDir .\release\dist -AllowUnsigned
          if ($LASTEXITCODE -ne 0) { throw "verify-release reported failure." }

      - name: Create release archive
        id: zip
        shell: pwsh
        run: |
          $tag  = '${{ steps.ver.outputs.tag }}'
          $name = "claude-code-install-manager-$tag-windows.zip"
          $zip  = Join-Path 'release' $name
          Compress-Archive -Path 'release/dist/*' -DestinationPath $zip -Force
          "zip=$zip"   | Add-Content -Path $env:GITHUB_OUTPUT
          "name=$name" | Add-Content -Path $env:GITHUB_OUTPUT

      - name: Upload artifacts to workflow run
        uses: actions/upload-artifact@v7
        with:
          name: ${{ steps.zip.outputs.name }}
          path: ${{ steps.zip.outputs.zip }}
          if-no-files-found: error

      - name: Create / update GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.ver.outputs.tag }}
          name:     "Claude Code Install Manager ${{ steps.ver.outputs.version }}"
          body_path: .github/RELEASE_NOTES_TEMPLATE.md
          files: |
            ${{ steps.zip.outputs.zip }}
            release/dist/claude-code-install-manager.exe
            release/dist/claude-code-install-manager.cmd
            release/dist/SHA256SUMS
          fail_on_unmatched_files: true
          generate_release_notes: true