build.yml

name: Build

on:
  push:
    branches: [main]
  pull_request:
    branches: [main, dev]
  release:
    types: [created, published]

permissions:
  contents: write
  id-token: write
  actions: read

jobs:
  build:
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET 8.0
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 8.0.x

      - name: Restore dependencies
        run: |
          dotnet restore Dashboard/Dashboard.csproj
          dotnet restore Lite/PerformanceMonitorLite.csproj
          dotnet restore Installer/PerformanceMonitorInstaller.csproj

      - name: Get version
        id: version
        shell: pwsh
        run: |
          $version = ([xml](Get-Content Dashboard/Dashboard.csproj)).Project.PropertyGroup.Version | Where-Object { $_ }
          echo "VERSION=$version" >> $env:GITHUB_OUTPUT

      - name: Publish Dashboard
        run: dotnet publish Dashboard/Dashboard.csproj -c Release -o publish/Dashboard

      - name: Publish Dashboard (self-contained for Velopack)
        if: github.event_name == 'release'
        run: dotnet publish Dashboard/Dashboard.csproj -c Release -r win-x64 --self-contained -o publish/Dashboard-velopack

      - name: Publish Lite
        run: dotnet publish Lite/PerformanceMonitorLite.csproj -c Release -o publish/Lite

      - name: Publish Lite (self-contained for Velopack)
        if: github.event_name == 'release'
        run: dotnet publish Lite/PerformanceMonitorLite.csproj -c Release -r win-x64 --self-contained -o publish/Lite-velopack

      - name: Publish CLI Installer
        run: dotnet publish Installer/PerformanceMonitorInstaller.csproj -c Release

      - name: Package release artifacts
        if: github.event_name == 'release'
        shell: pwsh
        run: |
          $version = "${{ steps.version.outputs.VERSION }}"
          New-Item -ItemType Directory -Force -Path releases

          # Dashboard ZIP
          Compress-Archive -Path 'publish/Dashboard/*' -DestinationPath "releases/PerformanceMonitorDashboard-$version.zip" -Force

          # Lite ZIP
          Compress-Archive -Path 'publish/Lite/*' -DestinationPath "releases/PerformanceMonitorLite-$version.zip" -Force

          # Installer ZIP (CLI + SQL scripts)
          $instDir = 'publish/Installer'
          New-Item -ItemType Directory -Force -Path $instDir
          New-Item -ItemType Directory -Force -Path "$instDir/install"
          New-Item -ItemType Directory -Force -Path "$instDir/upgrades"

          Copy-Item 'Installer/bin/Release/net8.0/win-x64/publish/PerformanceMonitorInstaller.exe' $instDir
          Copy-Item 'install/*.sql' "$instDir/install/"
          if (Test-Path 'upgrades') { Copy-Item 'upgrades/*' "$instDir/upgrades/" -Recurse -ErrorAction SilentlyContinue }
          if (Test-Path 'README.md') { Copy-Item 'README.md' $instDir }
          if (Test-Path 'LICENSE') { Copy-Item 'LICENSE' $instDir }
          if (Test-Path 'THIRD_PARTY_NOTICES.md') { Copy-Item 'THIRD_PARTY_NOTICES.md' $instDir }

          Compress-Archive -Path 'publish/Installer/*' -DestinationPath "releases/PerformanceMonitorInstaller-$version.zip" -Force

      - name: Upload Dashboard for signing
        if: github.event_name == 'release'
        id: upload-dashboard
        uses: actions/upload-artifact@v4
        with:
          name: Dashboard-unsigned
          path: publish/Dashboard/

      - name: Upload Lite for signing
        if: github.event_name == 'release'
        id: upload-lite
        uses: actions/upload-artifact@v4
        with:
          name: Lite-unsigned
          path: publish/Lite/

      - name: Upload Installer for signing
        if: github.event_name == 'release'
        id: upload-installer
        uses: actions/upload-artifact@v4
        with:
          name: Installer-unsigned
          path: publish/Installer/

      - name: Sign Dashboard
        if: github.event_name == 'release'
        uses: signpath/github-action-submit-signing-request@v1
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '7969f8b6-d946-4a74-9bac-a55856d8b8e0'
          project-slug: 'PerformanceMonitor'
          signing-policy-slug: 'test-signing'
          artifact-configuration-slug: 'Dashboard'
          github-artifact-id: '${{ steps.upload-dashboard.outputs.artifact-id }}'
          wait-for-completion: true
          output-artifact-directory: 'signed/Dashboard'

      - name: Sign Lite
        if: github.event_name == 'release'
        uses: signpath/github-action-submit-signing-request@v1
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '7969f8b6-d946-4a74-9bac-a55856d8b8e0'
          project-slug: 'PerformanceMonitor'
          signing-policy-slug: 'test-signing'
          artifact-configuration-slug: 'Lite'
          github-artifact-id: '${{ steps.upload-lite.outputs.artifact-id }}'
          wait-for-completion: true
          output-artifact-directory: 'signed/Lite'

      - name: Sign Installer
        if: github.event_name == 'release'
        uses: signpath/github-action-submit-signing-request@v1
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '7969f8b6-d946-4a74-9bac-a55856d8b8e0'
          project-slug: 'PerformanceMonitor'
          signing-policy-slug: 'test-signing'
          artifact-configuration-slug: 'Installers'
          github-artifact-id: '${{ steps.upload-installer.outputs.artifact-id }}'
          wait-for-completion: true
          output-artifact-directory: 'signed/Installer'

      - name: Replace with signed artifacts
        if: github.event_name == 'release'
        shell: pwsh
        run: |
          $version = "${{ steps.version.outputs.VERSION }}"
          # Re-zip signed files into release archives
          Remove-Item "releases/PerformanceMonitorDashboard-$version.zip" -ErrorAction SilentlyContinue
          Compress-Archive -Path 'signed/Dashboard/*' -DestinationPath "releases/PerformanceMonitorDashboard-$version.zip" -Force
          Remove-Item "releases/PerformanceMonitorLite-$version.zip" -ErrorAction SilentlyContinue
          Compress-Archive -Path 'signed/Lite/*' -DestinationPath "releases/PerformanceMonitorLite-$version.zip" -Force
          Remove-Item "releases/PerformanceMonitorInstaller-$version.zip" -ErrorAction SilentlyContinue
          Compress-Archive -Path 'signed/Installer/*' -DestinationPath "releases/PerformanceMonitorInstaller-$version.zip" -Force

      - name: Create Velopack release (Dashboard)
        if: github.event_name == 'release'
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          dotnet tool install -g vpk
          New-Item -ItemType Directory -Force -Path releases/velopack-dashboard
          New-Item -ItemType Directory -Force -Path releases/velopack-lite

          # Dashboard: download previous + pack
          vpk download github --repoUrl https://github.com/${{ github.repository }} --channel dashboard -o releases/velopack-dashboard --token $env:GH_TOKEN
          vpk pack -u PerformanceMonitorDashboard -v $env:VERSION -p publish/Dashboard-velopack -e PerformanceMonitorDashboard.exe -o releases/velopack-dashboard --channel dashboard

          # Lite: download previous + pack
          vpk download github --repoUrl https://github.com/${{ github.repository }} --channel lite -o releases/velopack-lite --token $env:GH_TOKEN
          vpk pack -u PerformanceMonitorLite -v $env:VERSION -p publish/Lite-velopack -e PerformanceMonitorLite.exe -o releases/velopack-lite --channel lite

      - name: Generate checksums
        if: github.event_name == 'release'
        shell: pwsh
        run: |
          $checksums = Get-ChildItem releases/*.zip | ForEach-Object {
            $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            "$hash  $($_.Name)"
          }
          $checksums | Out-File -FilePath releases/SHA256SUMS.txt -Encoding utf8
          Write-Host "Checksums:"
          $checksums | ForEach-Object { Write-Host $_ }

      - name: Upload release assets
        if: github.event_name == 'release'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ github.event.release.tag_name }} releases/*.zip releases/SHA256SUMS.txt --clobber

      - name: Upload Dashboard Velopack artifacts
        if: github.event_name == 'release'
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          vpk upload github --repoUrl https://github.com/${{ github.repository }} --channel dashboard -o releases/velopack-dashboard --releaseName "v$env:VERSION" --tag "v$env:VERSION" --merge --token $env:GH_TOKEN

      - name: Upload Lite Velopack artifacts
        if: github.event_name == 'release'
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          vpk upload github --repoUrl https://github.com/${{ github.repository }} --channel lite -o releases/velopack-lite --releaseName "v$env:VERSION" --tag "v$env:VERSION" --merge --token $env:GH_TOKEN