name: Build Tool Release

on:
  push:
    branches: [main]
    paths:
      - 'Projects/BuildTool/**'
  workflow_dispatch:

jobs:
  build:
    runs-on: ${{ matrix.os }}
    name: Build (${{ matrix.rid }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            rid: win-x64
            artifact: build-tool-win-x64.exe
          - os: windows-latest
            rid: win-arm64
            artifact: build-tool-win-arm64.exe
          - os: macos-15
            rid: osx-arm64
            artifact: build-tool-osx-arm64
          - os: ubuntu-latest
            rid: linux-x64
            artifact: build-tool-linux-x64
          - os: ubuntu-24.04-arm
            rid: linux-arm64
            artifact: build-tool-linux-arm64

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0 # Full clone required for Nerdbank.GitVersioning

      - name: Install .NET
        uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      - name: Publish NativeAOT
        run: dotnet publish Projects/BuildTool/BuildTool.csproj -c Release -r ${{ matrix.rid }} -o publish/

      - name: Rename artifact (Unix)
        if: runner.os != 'Windows'
        run: mv publish/build-tool publish/${{ matrix.artifact }}

      - name: Rename artifact (Windows)
        if: runner.os == 'Windows'
        run: mv publish/build-tool.exe publish/${{ matrix.artifact }}
        shell: bash

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.artifact }}
          path: publish/${{ matrix.artifact }}

  sign:
    needs: build
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    name: Sign (${{ matrix.artifact }})
    permissions:
      actions: read
      contents: read
      id-token: write
    strategy:
      matrix:
        include:
          - artifact: build-tool-win-x64.exe
          - artifact: build-tool-win-arm64.exe

    steps:
      - name: Download unsigned artifact
        uses: actions/download-artifact@v8
        with:
          name: ${{ matrix.artifact }}
          path: unsigned/

      - name: Upload for signing
        id: upload-for-signing
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.artifact }}-unsigned
          path: unsigned/${{ matrix.artifact }}

      - name: Submit signing request
        id: submit
        uses: signpath/github-action-submit-signing-request@v2
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
          project-slug: 'modernuo'
          signing-policy-slug: 'release-signing'
          artifact-configuration-slug: 'build-tool'
          github-artifact-id: '${{ steps.upload-for-signing.outputs.artifact-id }}'
          wait-for-completion: true
          output-artifact-directory: signed/

      - name: Upload signed artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.artifact }}-signed
          path: signed/${{ matrix.artifact }}

  release:
    needs: [build, sign]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v7

      - name: Move tag to current commit
        run: |
          git tag -f build-tool-latest
          git push origin build-tool-latest --force

      - name: Download signed Windows artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: '*-signed'
          path: artifacts/
          merge-multiple: true

      - name: Download macOS artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: 'build-tool-osx-*'
          path: artifacts/
          merge-multiple: true

      - name: Download Linux artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: 'build-tool-linux-*'
          path: artifacts/
          merge-multiple: true

      - name: Generate checksums
        run: |
          cd artifacts
          sha256sum build-tool-* > checksums-sha256.txt

      - name: Create or update release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: build-tool-latest
          name: Build Tool (Latest)
          body: |
            Latest NativeAOT-compiled build tool binaries.
            These are automatically downloaded by `publish.cmd` / `publish.sh`.
          prerelease: true
          files: |
            artifacts/build-tool-*
            artifacts/checksums-sha256.txt
          make_latest: false