build-windows.yml

name: build-windows
on:
    workflow_call:
        inputs:
            dry:
                default: false
                description: Prevent signing and upload
                required: false
                type: boolean
        secrets:
            TAURI_PRIVATE_KEY:
                required: false
            TAURI_KEY_PASSWORD:
                required: false
            SIGNPATH_API_TOKEN:
                required: false
            SIGNPATH_ORG_ID:
                required: false
            SIGNPATH_PROJECT_SLUG:
                required: false
            SIGNPATH_POLICY_SLUG:
                required: false

permissions:
    contents: read

jobs:
    build-windows:
        runs-on: windows-latest
        steps:
            - uses: actions/checkout@v4

            - uses: actions/setup-node@v4
              with:
                  node-version: lts/*

            - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7

            - uses: swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5
              with:
                  workspaces: |
                      ./src-tauri -> target
                      ./hotkeys -> target

            - name: Install pnpm
              run: npm install -g pnpm@11.8.0
              shell: pwsh

            - name: Download & extract ONNX model (Windows)
              if: ${{ inputs.dry == false }}
              shell: pwsh
              run: .\.github\scripts\download-parakeet-model.ps1 -Destination resources

            - name: Build hotkey daemon
              run: cargo build --release --manifest-path hotkeys/Cargo.toml
              shell: pwsh

            - name: Install frontend deps
              run: pnpm install
              shell: pwsh

            - name: Build
              run: pnpm tauri build ${{ inputs.dry && '--no-bundle' || '' }}
              shell: pwsh

            - name: Verify CUDA provider packaging
              if: ${{ inputs.dry == false }}
              shell: pwsh
              run: |
                  $installer = Get-ChildItem -Path "src-tauri/target/release/bundle/nsis" -Filter *.exe | Select-Object -First 1
                  if (!$installer) { throw "NSIS installer not found" }
                  $sevenZip = "C:\Program Files\7-Zip\7z.exe"
                  if (!(Test-Path $sevenZip)) { throw "7-Zip not found on runner" }
                  $listing = & $sevenZip l $installer.FullName | Out-String
                  foreach ($required in @("onnxruntime_providers_cuda.dll", "onnxruntime_providers_shared.dll")) {
                      if ($listing -notmatch [regex]::Escape($required)) {
                          throw "Windows installer is missing $required"
                      }
                  }

            - name: Prepare unsigned artifacts
              if: ${{ inputs.dry == false }}
              shell: pwsh
              run: |
                  New-Item -ItemType Directory -Force -Path "unsigned_artifacts" | Out-Null
                  $msiDir = "src-tauri/target/release/bundle/msi"
                  if (Test-Path $msiDir) {
                      $msi = Get-ChildItem -Path $msiDir -Filter *.msi | Select-Object -First 1
                      if ($msi) { Copy-Item $msi.FullName -Destination "unsigned_artifacts/HyperYap_x64.msi" }
                  }
                  $exe = Get-ChildItem -Path "src-tauri/target/release/bundle/nsis" -Filter *.exe | Select-Object -First 1
                  Copy-Item $exe.FullName -Destination "unsigned_artifacts/HyperYap_x64-setup.exe"

            - name: Upload unsigned artifact
              if: ${{ inputs.dry == false }}
              id: upload-unsigned-artifact
              uses: actions/upload-artifact@v4
              with:
                  name: unsigned-binaries
                  path: unsigned_artifacts
                  retention-days: 1
                  if-no-files-found: error

            - name: SignPath Sign
              if: ${{ inputs.dry == false }}
              id: signpath
              continue-on-error: true
              uses: signpath/github-action-submit-signing-request@v2
              with:
                  api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
                  organization-id: '${{ secrets.SIGNPATH_ORG_ID }}'
                  project-slug: '${{ secrets.SIGNPATH_PROJECT_SLUG }}'
                  signing-policy-slug: '${{ secrets.SIGNPATH_POLICY_SLUG }}'
                  github-artifact-id: '${{ steps.upload-unsigned-artifact.outputs.artifact-id }}'
                  wait-for-completion: true
                  output-artifact-directory: 'signed_artifacts'

            - name: Restore Tauri signing key
              if: ${{ inputs.dry == false && steps.signpath.outcome == 'success' }}
              env:
                  TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
              run: |
                  [System.IO.File]::WriteAllBytes("tauri.key", [Convert]::FromBase64String($env:TAURI_PRIVATE_KEY))
              shell: pwsh

            - name: Sign & Package
              if: ${{ inputs.dry == false && steps.signpath.outcome == 'success' }}
              env:
                  TAURI_PRIVATE_KEY_PATH: tauri.key
                  TAURI_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
              shell: pwsh
              run: |
                  $releaseDir = "release-bundle"
                  if (Test-Path $releaseDir) { Remove-Item $releaseDir -Recurse -Force }
                  New-Item -ItemType Directory -Force -Path $releaseDir | Out-Null

                  # MSI
                  $msi = Get-ChildItem -Path "signed_artifacts" -Filter *.msi -ErrorAction SilentlyContinue | Select-Object -First 1
                  if ($msi) {
                      $finalMsi = Join-Path $releaseDir "HyperYap_x64.msi"
                      Copy-Item $msi.FullName -Destination $finalMsi -Force
                      pnpm tauri signer sign $finalMsi
                  }

                  # EXE
                  $exe = Get-ChildItem -Path "signed_artifacts" -Filter *.exe -ErrorAction SilentlyContinue | Select-Object -First 1
                  if ($exe) {
                      $finalExe = Join-Path $releaseDir "HyperYap_x64-setup.exe"
                      Copy-Item $exe.FullName -Destination $finalExe -Force
                      pnpm tauri signer sign $finalExe
                  }

            - name: Prepare release bundle (unsigned fallback)
              if: ${{ inputs.dry == false && steps.signpath.outcome != 'success' }}
              shell: pwsh
              run: |
                  $releaseDir = "release-bundle"
                  if (Test-Path $releaseDir) { Remove-Item $releaseDir -Recurse -Force }
                  New-Item -ItemType Directory -Force -Path $releaseDir | Out-Null
                  Copy-Item "unsigned_artifacts/*" -Destination $releaseDir -Force
                  Write-Host "Using unsigned artifacts (SignPath not configured or failed)"

            - name: Upload artifact (1 day)
              if: ${{ inputs.dry == false }}
              uses: actions/upload-artifact@v4
              with:
                  name: hyperyap-windows-x64
                  path: release-bundle
                  retention-days: 1