name: Windows build

on:
  push:
    branches: ['**']
  pull_request:

permissions:
  contents: read

jobs:
  build:
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up .NET 10
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68  # v6.0.0
        with:
          dotnet-version: 10.0.x

      - name: Restore
        run: dotnet restore src/ServerMonitorManager.Desktop/ServerMonitorManager.Desktop.csproj -p:Platform=x64 -p:PublishReadyToRun=true -p:RestoreLockedMode=true

      - name: Build x64 Release
        run: dotnet build src/ServerMonitorManager.Desktop/ServerMonitorManager.Desktop.csproj --configuration Release -p:Platform=x64 -p:PublishReadyToRun=true -r win-x64 --no-restore

      - name: Verify formatting
        run: |
          dotnet format whitespace src/ServerMonitorManager.Desktop/ServerMonitorManager.Desktop.csproj --verify-no-changes --no-restore
          dotnet format style src/ServerMonitorManager.Desktop/ServerMonitorManager.Desktop.csproj --verify-no-changes --no-restore

      - name: Verify Windows desktop contracts
        shell: pwsh
        run: ./tests/windows/Test-DesktopContracts.ps1

      - name: Test Desktop security
        run: dotnet test tests/ServerMonitorManager.Desktop.Security.Tests/ServerMonitorManager.Desktop.Security.Tests.csproj --configuration Release -p:RestoreLockedMode=true --filter Category!=LiveRelease

      - name: Test Desktop security (live release)
        env:
          SMM_TEST_RELEASE_TAG: ${{ vars.SMM_TEST_RELEASE_TAG || 'v0.1.0-alpha.20' }}
        run: dotnet test tests/ServerMonitorManager.Desktop.Security.Tests/ServerMonitorManager.Desktop.Security.Tests.csproj --configuration Release -p:RestoreLockedMode=true --filter Category=LiveRelease

      - name: Build test-signed MSIX installer
        shell: pwsh
        run: |
          $directory = Join-Path $env:RUNNER_TEMP 'smm-test-signing'
          $password = [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(24))
          Write-Output "::add-mask::$password"
          ./build/windows/New-TestSigningCertificate.ps1 -OutputDirectory $directory -Password $password
          ./build/windows/Build-Installer.ps1 `
            -CertificatePath (Join-Path $directory 'server-monitor-manager-test-signing.pfx') `
            -CertificatePassword $password
          Copy-Item `
            -LiteralPath (Join-Path $directory 'server-monitor-manager-test-signing.cer') `
            -Destination artifacts/windows-installer/ServerMonitorManager-test-signing.cer

      - name: Upload test installer
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: ServerMonitorManager-win-x64-test
          path: |
            artifacts/windows-installer/ServerMonitorManager-win-x64.msix
            artifacts/windows-installer/ServerMonitorManager-test-signing.cer
            artifacts/windows-installer/SHA256SUMS
          if-no-files-found: error
