bambuddy/.github/workflows/windows-installer.yml

name: Windows Installer

# Build the Windows installer .exe.
#
# Triggers:
#   - Tag push matching v* (release builds, uploaded as a release asset)
#   - Manual dispatch (for testing the build pipeline)
#
# The installer is unsigned until SignPath OSS approval lands. Once it
# does, add the SignPath GitHub Action between the ISCC step and the
# upload step.

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

# Least-privilege per CodeQL actions/missing-workflow-permissions.
# contents: write is required by softprops/action-gh-release to attach
# the .exe to a tag release; the manual-dispatch path doesn't trigger
# that step and could run with read-only, but a single workflow-level
# block keeps the surface auditable in one place.
permissions:
  contents: write

jobs:
  build:
    runs-on: windows-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.13'

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      # Inno Setup 6.x is pre-installed on windows-latest runners (under
      # C:\Program Files (x86)\Inno Setup 6\). No install step needed.

      - name: Stage installer artifacts
        working-directory: installers/windows
        run: python build.py
        shell: pwsh

      - name: Compile installer (ISCC)
        working-directory: installers/windows
        run: |
          & "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" bambuddy.iss
        shell: pwsh

      # Stable + beta tag releases (e.g. v0.2.5b1, v0.3.0) get an unversioned
      # copy alongside the versioned filename so external surfaces (website,
      # wiki, newsletters) can link to a stable URL that survives version
      # bumps:
      #
      #   https://github.com/maziggy/bambuddy/releases/latest/download/bambuddy-windows-x64-setup.exe
      #
      # GitHub's `latest` redirect excludes prereleases, so this URL always
      # points at whatever was released as a full release. Daily prereleases
      # are excluded from the alias because (a) the unversioned name would be
      # semantically confusing next to the date-stamped versioned name on a
      # daily prerelease page, and (b) there's no stable "latest daily" URL
      # anyway (`latest` skips prereleases), so the alias adds no value there.
      - name: Create unversioned alias (non-daily tags only)
        if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-daily.')
        shell: pwsh
        working-directory: installers/windows/build/output
        run: |
          $versioned = Get-ChildItem -Filter "bambuddy-*-windows-x64-setup.exe" | Select-Object -First 1
          if (-not $versioned) { throw "no versioned installer .exe found" }
          Copy-Item $versioned.FullName "bambuddy-windows-x64-setup.exe"
          Write-Host "alias: bambuddy-windows-x64-setup.exe -> $($versioned.Name)"

      - name: Upload installer artifact
        uses: actions/upload-artifact@v4
        with:
          name: bambuddy-windows-installer
          path: installers/windows/build/output/*.exe
          if-no-files-found: error

      - name: Attach installer to release
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v2
        with:
          files: installers/windows/build/output/*.exe
          fail_on_unmatched_files: true