bambuddy/.github/workflows/windows-installer.yml

name: Windows Installer

# Build the Windows installer .exe.
#
# Triggers:
#   - Tag push matching v* (release builds, uploaded as a release asset)
#   - Manual dispatch (for testing the build pipeline)
#
# The installer is unsigned until SignPath OSS approval lands. Once it
# does, add the SignPath GitHub Action between the ISCC step and the
# upload step.

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

# Least-privilege per CodeQL actions/missing-workflow-permissions.
# contents: write is required by softprops/action-gh-release to attach
# the .exe to a tag release; the manual-dispatch path doesn't trigger
# that step and could run with read-only, but a single workflow-level
# block keeps the surface auditable in one place.
permissions:
  contents: write

jobs:
  build:
    runs-on: windows-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.13'

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      # Inno Setup 6.x is pre-installed on windows-latest runners (under
      # C:\Program Files (x86)\Inno Setup 6\). No install step needed.

      - name: Stage installer artifacts
        working-directory: installers/windows
        run: python build.py
        shell: pwsh

      - name: Compile installer (ISCC)
        working-directory: installers/windows
        run: |
          & "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" bambuddy.iss
        shell: pwsh

      - name: Upload installer artifact
        uses: actions/upload-artifact@v4
        with:
          name: bambuddy-windows-installer
          path: installers/windows/build/output/*.exe
          if-no-files-found: error

      - name: Attach installer to release
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v2
        with:
          files: installers/windows/build/output/*.exe
          fail_on_unmatched_files: true