build.yml

name: Build and Package SFTPSync

on:
  push:
    branches:
      - master
  pull_request:

jobs:
  build:
    runs-on: windows-latest

    env:
      Configuration: Release
      OutputDir: ${{ github.workspace }}/artifacts

    steps:
    - name: Checkout source (with full history and submodules)
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
        submodules: 'recursive'

    - name: Setup .NET 8 SDK
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '8.x'

    - name: Install AzureSignTool
      run: dotnet tool install --global AzureSignTool

    - name: Restore NuGet packages
      run: dotnet restore

    - name: Build solution
      run: dotnet build --configuration Release --no-restore

    - name: Publish SFTPSync
      run: |
        dotnet publish SFTPSync/SFTPSync.csproj `
          --configuration Release `
          --runtime win-x64 `
          --self-contained true `
          --output SFTPSync/bin/Release/net8.0-windows `
          /p:PublishSingleFile=true `
          /p:PublishReadyToRun=true

    - name: Publish SFTPSyncStop
      run: |
        dotnet publish SFTPSyncStop/SFTPSyncStop.csproj `
          --configuration Release `
          --runtime win-x64 `
          --self-contained true `
          --output SFTPSyncStop/bin/Release/net8.0-windows `
          /p:PublishSingleFile=true `
          /p:PublishReadyToRun=true

    - name: Publish SFTPSyncUI
      run: |
        dotnet publish SFTPSyncUI/SFTPSyncUI.csproj `
          --configuration Release `
          --runtime win-x64 `
          --self-contained true `
          --output SFTPSyncUI/bin/Release/net8.0-windows `
          /p:PublishSingleFile=true `
          /p:PublishReadyToRun=true

    - name: Sign executables
      env:
        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        AZURE_APPLICATION_ID: ${{ secrets.AZURE_APPLICATION_ID }}
        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
        AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
        AZURE_KEY_VAULT_URL: ${{ secrets.AZURE_KEY_VAULT_URL }}
        AZURE_CERT_NAME: ${{ secrets.AZURE_CERT_NAME }}
      shell: pwsh
      run: |
        $solutionPath = "SFTPSync.sln"
        $projectPaths = @()
        $projectMatches = Select-String -Path $solutionPath -Pattern 'Project\(\".*\"\)\s=\s\".*\",\s\"(?<path>[^\"]+\.csproj)\"'
        foreach ($match in $projectMatches) {
          $projectPaths += $match.Matches[0].Groups["path"].Value
        }

        $targets = @()
        foreach ($projectPath in $projectPaths) {
          if (!(Test-Path $projectPath)) {
            Write-Host "Project not found: $projectPath"
            continue
          }

          [xml]$projXml = Get-Content $projectPath
          $assemblyName = ($projXml.Project.PropertyGroup | Where-Object { $_.AssemblyName } | Select-Object -First 1).AssemblyName
          if ([string]::IsNullOrWhiteSpace($assemblyName)) {
            $assemblyName = [System.IO.Path]::GetFileNameWithoutExtension($projectPath)
          }

          $outputType = ($projXml.Project.PropertyGroup | Where-Object { $_.OutputType } | Select-Object -First 1).OutputType
          $extension = if ($outputType -in @("Exe", "WinExe")) { ".exe" } else { ".dll" }

          $projectDir = Split-Path $projectPath -Parent
          $releaseDir = Join-Path $projectDir "bin/Release"
          if (!(Test-Path $releaseDir)) {
            Write-Host "Release output not found: $releaseDir"
            continue
          }

          $targets += Get-ChildItem -Path $releaseDir -Recurse -Filter "$assemblyName$extension"
        }

        $targets = $targets | Sort-Object -Property FullName -Unique
        foreach ($file in $targets) {
          Write-Host "Signing $($file.FullName)"
          AzureSignTool sign `
            -kvu $env:AZURE_KEY_VAULT_URL `
            -kvi $env:AZURE_APPLICATION_ID `
            -kvs $env:AZURE_CLIENT_SECRET `
            -kvt $env:AZURE_TENANT_ID `
            -kvc $env:AZURE_CERT_NAME `
            -tr http://timestamp.digicert.com `
            -fd sha256 `
            -td sha256 `
            $file.FullName
        }

    - name: Add WiX Toolset to PATH
      run: echo "C:\Program Files (x86)\WiX Toolset v3.14\bin" >> $env:GITHUB_PATH

    - name: Find MSBuild path
      id: find-msbuild
      run: |
        $msbuild = "${env:ProgramFiles}\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin\MSBuild.exe"
        if (!(Test-Path $msbuild)) {
          $msbuild = "${env:ProgramFiles}\Microsoft Visual Studio\2022\Professional\MSBuild\Current\Bin\MSBuild.exe"
        }
        if (!(Test-Path $msbuild)) {
          $msbuild = "${env:ProgramFiles}\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\MSBuild.exe"
        }
        "path=$msbuild" >> $env:GITHUB_OUTPUT
      shell: pwsh

    - name: Build WiX Setup Project
      run: |
        & "${{ steps.find-msbuild.outputs.path }}" "SFTPSyncSetup\SFTPSyncSetup.wixproj" /p:Configuration=Release
      shell: pwsh

    - name: Sign MSI
      env:
        AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        AZURE_APPLICATION_ID: ${{ secrets.AZURE_APPLICATION_ID }}
        AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
        AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
        AZURE_KEY_VAULT_URL: ${{ secrets.AZURE_KEY_VAULT_URL }}
        AZURE_CERT_NAME: ${{ secrets.AZURE_CERT_NAME }}
      shell: pwsh
      run: |
        $msiFiles = Get-ChildItem -Path . -Recurse -Include *.msi
        foreach ($msi in $msiFiles) {
          Write-Host "Signing MSI: $($msi.FullName)"
          AzureSignTool sign `
            -kvu $env:AZURE_KEY_VAULT_URL `
            -kvi $env:AZURE_APPLICATION_ID `
            -kvs $env:AZURE_CLIENT_SECRET `
            -kvt $env:AZURE_TENANT_ID `
            -kvc $env:AZURE_CERT_NAME `
            -tr http://timestamp.digicert.com `
            -fd sha256 `
            -td sha256 `
            $msi.FullName
        }

    - name: Upload MSI artifact
      uses: actions/upload-artifact@v4
      with:
        name: MSI
        path: |
          **\*.msi