name: Desktop Windows Branch Build

on:
  workflow_dispatch:
  push:
    branches:
      - electron-app

jobs:
  build-windows:
    name: Build unsigned Windows desktop artifact
    runs-on: windows-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Typecheck
        run: npm run typecheck

      - name: Resolve artifact metadata
        id: artifact
        shell: bash
        run: |
          SAFE_REF="$(printf '%s' "${GITHUB_REF_NAME}" | tr -c 'A-Za-z0-9._-' '-')"
          echo "name=CloudCLI-windows-${SAFE_REF}-${GITHUB_RUN_NUMBER}" >> "$GITHUB_OUTPUT"
          echo "server_bundle_tag=desktop-server-${SAFE_REF}" >> "$GITHUB_OUTPUT"

      - name: Configure branch server bundle source
        shell: bash
        run: printf '{"releaseTag":"%s"}\n' "${{ steps.artifact.outputs.server_bundle_tag }}" > electron/server-bundle-config.json

      - name: Build unsigned Windows artifacts
        run: npm run desktop:dist:win -- --publish never
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"

      - name: Build branch server bundle
        run: node scripts/release/build-server-bundle.js

      - name: Publish branch server bundle
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          tag_name: ${{ steps.artifact.outputs.server_bundle_tag }}
          name: CloudCLI Desktop Server Bundle (${{ github.ref_name }})
          prerelease: true
          fail_on_unmatched_files: false
          overwrite_files: true
          files: |
            release/server-bundles/*

      - name: Verify Windows artifacts
        shell: bash
        run: |
          test -n "$(find release -maxdepth 1 -name '*.exe' -print -quit)"
          test -n "$(find release -maxdepth 1 -name '*.zip' -print -quit)"
          sha256sum release/*.{exe,zip} > release/SHASUMS256.txt
          cat release/SHASUMS256.txt

      - name: Upload branch build artifacts
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: ${{ steps.artifact.outputs.name }}
          path: |
            release/*.exe
            release/*.zip
            release/*.yml
            release/*.blockmap
            release/SHASUMS256.txt
          if-no-files-found: error
          retention-days: 14