eagle0/.github/workflows/installer_build.yml

name: Installer Build

on:
  push:
    branches: [ "main" ]
    paths:
      - ".github/workflows/installer_build.yml"
      - "src/main/csharp/net/eagle0/clients/win/installer/**"
  pull_request:
    paths:
      - ".github/workflows/installer_build.yml"
      - "src/main/csharp/net/eagle0/clients/win/installer/**"
  workflow_dispatch:

permissions:
  contents: read
  actions: write  # Required to delete artifacts after deploy

jobs:
  build-installer:
    runs-on: [self-hosted, bazel]

    steps:
      - uses: actions/checkout@v4
        with:
          lfs: false
          clean: false

      - name: Setup .NET 8
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'

      - name: Inject manifest public key
        env:
          MANIFEST_PUBLIC_KEY: ${{ secrets.MANIFEST_PUBLIC_KEY }}
        run: |
          if [ -n "$MANIFEST_PUBLIC_KEY" ]; then
            CONFIG_FILE="src/main/csharp/net/eagle0/clients/win/installer/EagleInstaller/configuration.txt"
            echo "manifest_public_key = $MANIFEST_PUBLIC_KEY" >> "$CONFIG_FILE"
            echo "Injected manifest public key into configuration.txt"
            cat "$CONFIG_FILE"
          else
            echo "MANIFEST_PUBLIC_KEY not set, skipping injection"
          fi

      - name: Restore dependencies
        run: dotnet restore src/main/csharp/net/eagle0/clients/win/installer/EagleInstaller/EagleInstaller.csproj

      - name: Build installer
        run: dotnet publish src/main/csharp/net/eagle0/clients/win/installer/EagleInstaller/EagleInstaller.csproj -c Release -r win-x64 --self-contained true --output ./installer-output

      - name: Archive installer binary
        if: success() || failure()
        uses: actions/upload-artifact@v4
        with:
          name: eagle-installer
          path: ./installer-output/EagleInstaller.exe
          retention-days: 1

      - name: Verify installer exists
        if: success()
        run: |
          if [ ! -f "./installer-output/EagleInstaller.exe" ]; then
            echo "ERROR: EagleInstaller.exe not found at expected location"
            echo "Directory contents:"
            ls -la ./installer-output/
            exit 1
          fi
          echo "Installer found at correct location"

      - name: Deploy installer
        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
        env:
          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
          SECRET_KEY: ${{ secrets.SECRET_KEY }}
        run: |
          INSTALLER_PATH="$(pwd)/installer-output/EagleInstaller.exe"
          echo "Using absolute path: $INSTALLER_PATH"
          bazel run //src/main/go/net/eagle0/build/installer_build_handler:installer_build_handler -- "$INSTALLER_PATH"

      - name: Update unified manifest
        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
        env:
          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
          SECRET_KEY: ${{ secrets.SECRET_KEY }}
          MANIFEST_SIGNING_KEY: ${{ secrets.MANIFEST_SIGNING_KEY }}
        run: |
          # Create installer manifest content
          INSTALLER_SHA=$(sha256sum ./installer-output/EagleInstaller.exe | cut -d' ' -f1)
          echo "installer_version=$INSTALLER_SHA" > /tmp/installer_manifest.txt
          echo "installer_url=installer/EagleInstaller.exe" >> /tmp/installer_manifest.txt

          echo "=== Installer manifest content ==="
          cat /tmp/installer_manifest.txt
          echo "=================================="

          # Write signing key to temp file (if available)
          SIGNING_ARGS=""
          if [ -n "$MANIFEST_SIGNING_KEY" ]; then
            echo "$MANIFEST_SIGNING_KEY" > /tmp/manifest_signing_key
            chmod 600 /tmp/manifest_signing_key
            SIGNING_ARGS="/tmp/manifest_signing_key"
            echo "Manifest signing key available"
          else
            echo "Warning: MANIFEST_SIGNING_KEY not set, manifest will be unsigned"
          fi

          # Update the unified manifest (with optional signing)
          bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- installer /tmp/installer_manifest.txt $SIGNING_ARGS

          # Cleanup
          rm -f /tmp/manifest_signing_key

      - name: Delete all installer artifacts
        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Delete ALL eagle-installer artifacts to free up storage
          # The installer is deployed to S3, so artifacts are redundant
          echo "Fetching all eagle-installer artifacts..."
          artifact_ids=$(gh api "repos/${{ github.repository }}/actions/artifacts" \
            --paginate -q '.artifacts[] | select(.name == "eagle-installer") | .id')
          for id in $artifact_ids; do
            echo "Deleting artifact ID: $id"
            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id" || true
          done
          echo "Cleanup complete"