release.yml

name: DetourModKit - Build and Release

permissions:
  contents: write
  actions: read

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (e.g., 1.0.0, 0.2.1-beta)"
        required: true
        type: string
      release_title:
        description: "Title for the release (e.g., 'Feature Update X')"
        required: false
        type: string
      changelog:
        description: "Changelog for this release (Markdown format)"
        required: false
        type: string
        default: "- Initial release or bug fixes."
      prerelease:
        description: "Mark as a pre-release?"
        required: true
        type: boolean
        default: false

jobs:
  validate-version:
    name: Validate release version matches CMake
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # Read-only checkout: this job only greps the sources, so the token must not persist in .git/config after
          # checkout. Only create-release keeps credentials (it pushes the release tag).
          persist-credentials: false

      - name: Compare release input against project(VERSION) in CMakeLists.txt
        run: |
          # Single-source the release version from CMakeLists.txt project(VERSION ...): the shipped
          # DetourModKitConfigVersion.cmake and the DMK_VERSION_* macros are generated from that number, so a tag
          # whose version disagrees with it would publish a package whose find_package check contradicts the tag.
          # Fail closed here rather than shipping the mismatch.
          INPUT_VERSION="${{ github.event.inputs.version }}"
          # Strip any pre-release / build suffix (e.g. 3.7.0-beta -> 3.7.0); CMake project() is numeric MAJOR.MINOR.PATCH.
          INPUT_CORE="${INPUT_VERSION%%-*}"
          PROJECT_VERSION="$(grep -oP 'project\(DetourModKit\s+VERSION\s+\K[0-9]+\.[0-9]+\.[0-9]+' CMakeLists.txt)"
          echo "Release input version : ${INPUT_VERSION} (core: ${INPUT_CORE})"
          echo "CMakeLists project ver: ${PROJECT_VERSION}"
          if [ -z "${PROJECT_VERSION}" ]; then
            echo "::error::Could not parse project(VERSION ...) from CMakeLists.txt"
            exit 1
          fi
          if [ "${INPUT_CORE}" != "${PROJECT_VERSION}" ]; then
            echo "::error::Release version '${INPUT_VERSION}' does not match CMakeLists.txt project(VERSION) '${PROJECT_VERSION}'. Bump project(VERSION) first so the shipped ConfigVersion and DMK_VERSION_* macros match the tag."
            exit 1
          fi
          # Cross-check the one literal version assertion in the test suite (VersionTest.MacrosMatchProjectVersion) against
          # project(VERSION). project(VERSION) drives the generated DMK_VERSION_* macros, but the test pins them with a
          # hand-written literal that a bump must touch separately; without this gate a bump that updates CMakeLists but
          # forgets tests/test_version.cpp still tags and only fails later at ctest. Fail closed here at validate time.
          # grep -m1 (first match) rather than piping to head, and `|| true` so a no-match yields an empty string
          # instead of aborting the step: this job runs under GitHub Actions' default `bash -eo pipefail`, where a
          # `grep ... | head` pipeline propagates grep's non-zero exit and `set -e` would kill the step before the
          # empty-value guard below could emit its diagnostic. With this form a missing literal reaches that guard.
          TEST_MAJOR="$(grep -m1 -oP 'DMK_VERSION_MAJOR,\s*\K[0-9]+' tests/test_version.cpp || true)"
          TEST_MINOR="$(grep -m1 -oP 'DMK_VERSION_MINOR,\s*\K[0-9]+' tests/test_version.cpp || true)"
          TEST_PATCH="$(grep -m1 -oP 'DMK_VERSION_PATCH,\s*\K[0-9]+' tests/test_version.cpp || true)"
          TEST_VERSION="${TEST_MAJOR}.${TEST_MINOR}.${TEST_PATCH}"
          echo "test_version.cpp literal: ${TEST_VERSION}"
          if [ -z "${TEST_MAJOR}" ] || [ -z "${TEST_MINOR}" ] || [ -z "${TEST_PATCH}" ]; then
            echo "::error::Could not parse the DMK_VERSION_* literals from tests/test_version.cpp"
            exit 1
          fi
          if [ "${TEST_VERSION}" != "${PROJECT_VERSION}" ]; then
            echo "::error::tests/test_version.cpp literal '${TEST_VERSION}' does not match CMakeLists.txt project(VERSION) '${PROJECT_VERSION}'. Update the VersionTest.MacrosMatchProjectVersion literals so the pinned assertion tracks the bump."
            exit 1
          fi
          echo "Version check passed."
        shell: bash

  build-mingw:
    name: Build for MinGW (g++)
    runs-on: windows-latest
    needs: validate-version
    outputs:
      artifact_name: ${{ steps.determine-artifact-name-mingw.outputs.ARTIFACT_NAME }}
      artifact_zip_filename: ${{ steps.determine-artifact-name-mingw.outputs.ARTIFACT_NAME }}

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: "recursive"
          # Build-only checkout: no authenticated git operation runs here, so do not persist the token in .git/config.
          persist-credentials: false

      - name: Cache MinGW
        id: cache-mingw
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: C:\ProgramData\chocolatey\lib\mingw
          key: ${{ runner.os }}-mingw-13.2.0-v2

      - name: Install MinGW (if not cached)
        if: steps.cache-mingw.outputs.cache-hit != 'true'
        run: choco install mingw --version=13.2.0 --yes --force --no-progress
        shell: powershell

      - name: Add MinGW to PATH
        run: echo "C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
        shell: powershell

      - name: Install Ninja and CMake
        run: choco install ninja cmake --installargs 'ADD_CMAKE_TO_PATH=System' --yes --force --no-progress
        shell: powershell

      - name: Verify Tools (MinGW context)
        run: |
          echo "--- Verifying g++ (MinGW) ---" && g++ --version
          echo "--- Verifying ninja ---" && ninja --version
          echo "--- Verifying cmake ---" && cmake --version
        shell: bash

      - name: Configure DetourModKit (MinGW Debug + Tests)
        run: cmake --preset mingw-debug -DDMK_WARNINGS_AS_ERRORS=ON
        shell: bash

      - name: Build DetourModKit (MinGW Debug + Tests)
        run: cmake --build --preset mingw-debug --parallel
        shell: bash

      - name: Run DetourModKit Tests (MinGW Debug)
        run: ctest --preset mingw-debug --output-on-failure
        shell: bash

      - name: Configure DetourModKit (MinGW Release)
        run: cmake --preset mingw-release -DDMK_WARNINGS_AS_ERRORS=ON -DDMK_BUILD_TESTS=ON -DCMAKE_INSTALL_PREFIX="${{ github.workspace }}/install_package/mingw"
        shell: bash

      - name: Build DetourModKit (MinGW Release)
        run: cmake --build --preset mingw-release --parallel
        shell: bash

      - name: Run DetourModKit Tests (MinGW Release)
        # Exercise the Release binaries -- the exact objects that produce the shipped archive -- before packaging, not
        # only the Debug config above. The test target is not part of the install set, so building it into this tree
        # does not change the installed prefix (asserted by the install-prefix hygiene step below).
        run: ctest --test-dir build/mingw-release --output-on-failure
        shell: bash

      - name: Install DetourModKit (MinGW Release)
        run: cmake --install build/mingw-release
        shell: bash

      - name: Verify Install Directory (MinGW)
        run: |
          $installDir = Join-Path -Path "${{ github.workspace }}" -ChildPath "install_package/mingw"
          if (-not (Test-Path $installDir -PathType Container)) {
            Write-Error "Install directory '$installDir' does not exist after cmake --install!"
            exit 1
          }
          Write-Output "Contents of '${installDir}':"
          Get-ChildItem -Path $installDir -Recurse | ForEach-Object { Write-Output $_.FullName }
          if (-not (Get-ChildItem -Path $installDir)) {
            Write-Warning "Install directory '${installDir}' is empty!"
          }
        shell: pwsh

      - name: Assert Install-Prefix Hygiene (MinGW)
        run: |
          # Prove the installed artifact upholds the v4 encapsulation contract: the SafetyHook backend stays hidden
          # (no include/safetyhook*, no lib/cmake/safetyhook), no deleted legacy public header or private engine ships,
          # and the archives + package config + public umbrella that a find_package consumer needs are all present.
          python scripts/check_install_prefix.py "${{ github.workspace }}/install_package/mingw"
        shell: bash

      - name: Smoke Test Installed Package (MinGW)
        run: |
          cmake -S tests/package_smoke -B build/package-smoke-mingw -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DDetourModKit_DIR="${{ github.workspace }}/install_package/mingw/lib/cmake/DetourModKit" \
            -DCMAKE_CXX_COMPILER=g++
          cmake --build build/package-smoke-mingw --parallel
          ctest --test-dir build/package-smoke-mingw --output-on-failure
        shell: bash

      - name: Determine Artifact Name (MinGW)
        id: determine-artifact-name-mingw
        run: |
          $version_tag_safe = "${{ github.event.inputs.version }}".Replace("+", "_plus_")
          $artifact_name = "DetourModKit_MinGW_v${version_tag_safe}.zip"
          echo "ARTIFACT_NAME=$artifact_name" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
        shell: pwsh

      - name: Create ZIP archive (MinGW)
        run: |
          $sourcePath = Join-Path -Path "${{ github.workspace }}" -ChildPath "install_package/mingw"
          Compress-Archive -Path $sourcePath\* -DestinationPath ${{ steps.determine-artifact-name-mingw.outputs.ARTIFACT_NAME }} -Force
        shell: pwsh

      - name: Upload MinGW Artifact for Release
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mingw-package
          path: ${{ steps.determine-artifact-name-mingw.outputs.ARTIFACT_NAME }}

  build-msvc:
    name: Build for MSVC (Visual Studio)
    runs-on: windows-latest
    needs: validate-version
    outputs:
      artifact_name: ${{ steps.determine-artifact-name-msvc.outputs.ARTIFACT_NAME }}
      artifact_zip_filename: ${{ steps.determine-artifact-name-msvc.outputs.ARTIFACT_NAME }}

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: "recursive"
          # Build-only checkout: no authenticated git operation runs here, so do not persist the token in .git/config.
          persist-credentials: false

      - name: Install Ninja and CMake
        run: choco install ninja cmake --installargs 'ADD_CMAKE_TO_PATH=System' --yes --force --no-progress
        shell: powershell

      - name: Setup MSVC Developer Environment
        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
        with:
          arch: x64

      - name: Verify Tools (MSVC context)
        run: |
          echo "--- Verifying cl (MSVC) ---"
          cl 2>&1 | head -1
          echo "--- Verifying ninja ---"
          ninja --version
          echo "--- Verifying cmake ---"
          cmake --version
        shell: bash

      - name: Configure DetourModKit (MSVC Debug + Tests)
        run: cmake --preset msvc-debug -DDMK_WARNINGS_AS_ERRORS=ON
        shell: cmd

      - name: Build DetourModKit (MSVC Debug + Tests)
        run: cmake --build --preset msvc-debug --parallel 2
        shell: cmd

      - name: Run DetourModKit Tests (MSVC Debug)
        run: ctest --preset msvc-debug --output-on-failure
        shell: cmd

      - name: Configure DetourModKit (MSVC Release)
        run: cmake --preset msvc-release -DDMK_WARNINGS_AS_ERRORS=ON -DDMK_BUILD_TESTS=ON -DCMAKE_INSTALL_PREFIX="${{ github.workspace }}/install_package/msvc"
        shell: cmd

      - name: Build DetourModKit (MSVC Release)
        run: cmake --build --preset msvc-release --parallel 2
        shell: cmd

      - name: Run DetourModKit Tests (MSVC Release)
        # Exercise the Release binaries before packaging, mirroring the MinGW Release leg. Tests are not installed, so
        # this does not change the packaged prefix.
        run: ctest --test-dir build/msvc-release --output-on-failure
        shell: cmd

      - name: Install DetourModKit (MSVC Release)
        run: cmake --install build/msvc-release
        shell: cmd

      - name: Verify Install Directory (MSVC)
        run: |
          $installDir = Join-Path -Path "${{ github.workspace }}" -ChildPath "install_package/msvc"
          if (-not (Test-Path $installDir -PathType Container)) {
            Write-Error "Install directory '$installDir' does not exist after cmake --install!"
            exit 1
          }
          Write-Output "Contents of '${installDir}':"
          Get-ChildItem -Path $installDir -Recurse | ForEach-Object { Write-Output $_.FullName }
          if (-not (Get-ChildItem -Path $installDir)) {
            Write-Warning "Install directory '${installDir}' is empty!"
          }
        shell: pwsh

      - name: Assert Install-Prefix Hygiene (MSVC)
        run: python scripts/check_install_prefix.py "${{ github.workspace }}/install_package/msvc"
        shell: bash

      - name: Smoke Test Installed Package (MSVC)
        run: |
          cmake -S tests/package_smoke -B build/package-smoke-msvc -G Ninja ^
            -DCMAKE_BUILD_TYPE=Release ^
            -DDetourModKit_DIR="${{ github.workspace }}/install_package/msvc/lib/cmake/DetourModKit" ^
            -DCMAKE_CXX_COMPILER=cl && ^
          cmake --build build/package-smoke-msvc --parallel && ^
          ctest --test-dir build/package-smoke-msvc --output-on-failure
        shell: cmd

      - name: Determine Artifact Name (MSVC)
        id: determine-artifact-name-msvc
        run: |
          $version_tag_safe = "${{ github.event.inputs.version }}".Replace("+", "_plus_")
          $artifact_name = "DetourModKit_MSVC_v${version_tag_safe}.zip"
          echo "ARTIFACT_NAME=$artifact_name" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
        shell: pwsh

      - name: Create ZIP archive (MSVC)
        run: |
          $sourcePath = Join-Path -Path "${{ github.workspace }}" -ChildPath "install_package/msvc"
          Compress-Archive -Path $sourcePath\* -DestinationPath ${{ steps.determine-artifact-name-msvc.outputs.ARTIFACT_NAME }} -Force
        shell: pwsh

      - name: Upload MSVC Artifact for Release
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: msvc-package
          path: ${{ steps.determine-artifact-name-msvc.outputs.ARTIFACT_NAME }}

  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [build-mingw, build-msvc]

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # This job pushes the annotated release tag, so it DELIBERATELY persists RELEASE_TOKEN (the other three
          # checkouts set persist-credentials: false). Do not add persist-credentials: false here, or the
          # `git push origin <tag>` step below fails to authenticate.
          token: ${{ secrets.RELEASE_TOKEN }}

      - name: Create annotated tag
        run: |
          TITLE="${{ github.event.inputs.release_title }}"
          VERSION="v${{ github.event.inputs.version }}"
          TAG_MESSAGE="${TITLE:-DetourModKit ${VERSION}}"
          git config user.name "Quang Trinh"
          git config user.email "khacquang.trinh@gmail.com"
          git tag -a "$VERSION" -m "$TAG_MESSAGE"
          git push origin "$VERSION"

      - name: Download MinGW artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: mingw-package
          path: mingw_package_dir

      - name: Download MSVC artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: msvc-package
          path: msvc_package_dir

      - name: List downloaded artifacts for verification
        run: |
          echo "--- MinGW Package Contents ---"
          ls -R mingw_package_dir
          echo "--- MSVC Package Contents ---"
          ls -R msvc_package_dir

      - name: Prepare file list for release
        id: file_list
        run: |
          MINGW_ZIP_NAME="${{ needs.build-mingw.outputs.artifact_zip_filename }}"
          MSVC_ZIP_NAME="${{ needs.build-msvc.outputs.artifact_zip_filename }}"

          FILES_STRING="mingw_package_dir/$MINGW_ZIP_NAME,msvc_package_dir/$MSVC_ZIP_NAME"

          echo "Files to release: $FILES_STRING"
          echo "FILES_TO_RELEASE=$FILES_STRING" >> $GITHUB_OUTPUT
        shell: bash

      - name: Create GitHub Release
        # SHA-pinned (supply-chain risk mitigated). Retained over a `gh release create` run-block because it passes the
        # untrusted, user-supplied `changelog` workflow input as a parameter rather than interpolating it into a shell
        # command, so there is no shell-injection surface a run-block would have to hand-guard.
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
        with:
          files: ${{ steps.file_list.outputs.FILES_TO_RELEASE }}
          tag_name: v${{ github.event.inputs.version }}
          name: DetourModKit v${{ github.event.inputs.version }}
          body: |
            **Release Title:** ${{ github.event.inputs.release_title }}
            **Version:** ${{ github.event.inputs.version }}

            **Changelog:**
            ${{ github.event.inputs.changelog }}

            **Artifacts:**
            This release includes packages for different build environments. Both packages ensure library names are prefixed with `lib` for consistency (e.g., `libDetourModKit.a`, `libDetourModKit.lib`).

            *   `${{ needs.build-mingw.outputs.artifact_name }}`: Built with MinGW (g++). Contains `libDetourModKit.a`, `libsafetyhook.a`, `libZydis.a`, `libZycore.a`, headers, and CMake config files. `find_package` links the transitive static chain via the `DetourModKit::deps` imported target.
            *   `${{ needs.build-msvc.outputs.artifact_name }}`: Built with MSVC (Visual Studio 2022). Contains `libDetourModKit.lib`, `safetyhook.lib`, `Zydis.lib`, `Zycore.lib`, headers, and CMake config files. Same `DetourModKit::deps` wiring as the MinGW package.

            These packages are ready to be used by other CMake projects via `find_package(DetourModKit)`.
            See README for detailed usage instructions.
          draft: false
          prerelease: ${{ github.event.inputs.prerelease }}
          token: ${{ secrets.RELEASE_TOKEN }}