release.yml

name: Release to Microsoft Store

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build-and-test:
    runs-on: windows-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup .NET 10 SDK
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'
      
      - name: Extract and format version from release tag
        id: version
        shell: pwsh
        run: |
          $tag = "${{ github.ref_name }}"
          $version = $tag -replace '^v', ''
          
          # Ensure 4-part version (X.Y.Z.0)
          $parts = $version -split '\.'
          if ($parts.Length -eq 3) {
            $version = "$version.0"
          }
          
          Write-Host "Version: $version"
          echo "version=$version" >> $env:GITHUB_OUTPUT
      
      - name: Update Package.appxmanifest version
        shell: pwsh
        run: |
          $manifestPath = "WeatherExtension/Package.appxmanifest"
          $version = "${{ steps.version.outputs.version }}"
          
          [xml]$manifest = Get-Content $manifestPath
          $manifest.Package.Identity.Version = $version
          $manifest.Save($manifestPath)
          
          Write-Host "Updated Package.appxmanifest to version $version"
      
      - name: Restore dependencies
        run: |
          dotnet restore WeatherExtension/WeatherExtension.csproj -r win-x64
          dotnet restore WeatherExtension.Tests/WeatherExtension.Tests.csproj -r win-x64
      
      - name: Build x64
        run: dotnet build WeatherExtension/WeatherExtension.csproj -c Release -r win-x64 --no-restore
      
      - name: Build ARM64
        run: dotnet build WeatherExtension/WeatherExtension.csproj -c Release -r win-arm64

      - name: Build tests
        run: dotnet build WeatherExtension.Tests/WeatherExtension.Tests.csproj -c Release -r win-x64 --no-restore
      
      - name: Run tests
        run: dotnet test WeatherExtension.Tests/WeatherExtension.Tests.csproj -c Release -r win-x64 --no-build

  package:
    needs: build-and-test
    runs-on: windows-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup .NET 10 SDK
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'
      
      - name: Update Package.appxmanifest version
        shell: pwsh
        run: |
          $manifestPath = "WeatherExtension/Package.appxmanifest"
          $version = "${{ needs.build-and-test.outputs.version }}"

          [xml]$manifest = Get-Content $manifestPath
          $manifest.Package.Identity.Version = $version
          $manifest.Save($manifestPath)

          Write-Host "Updated Package.appxmanifest to version $version"

      - name: Restore dependencies
        run: dotnet restore WeatherExtension.slnx
      
      - name: Publish x64 MSIX
        run: >
          dotnet publish WeatherExtension/WeatherExtension.csproj -c Release -r win-x64
          /p:PublishProfile=win-x64
          /p:AppxPackageSigningEnabled=false
          /p:Version=${{ needs.build-and-test.outputs.version }}

      - name: Publish ARM64 MSIX
        run: >
          dotnet publish WeatherExtension/WeatherExtension.csproj -c Release -r win-arm64
          /p:PublishProfile=win-arm64
          /p:AppxPackageSigningEnabled=false
          /p:Version=${{ needs.build-and-test.outputs.version }}
      
      - name: Disable package source mapping for signing
        shell: pwsh
        run: |
          [xml]$config = Get-Content "${{ github.workspace }}/nuget.config"
          $mapping = $config.configuration.SelectSingleNode("packageSourceMapping")
          if ($mapping) { $config.configuration.RemoveChild($mapping); $config.Save("${{ github.workspace }}/nuget.config") }

      - name: Azure login
        uses: azure/login@v3
        with:
          creds: ${{ secrets.AZURE_CREDS }}

      - name: Sign MSIX packages
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: https://eus.codesigning.azure.net/
          signing-account-name: bbb-signing
          certificate-profile-name: BaldBeardedBuilder
          files-folder: ${{ github.workspace }}\WeatherExtension
          files-folder-filter: msix
          files-folder-recurse: true
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Verify MSIX signatures
        shell: pwsh
        run: |
          $msixFiles = Get-ChildItem -Path "WeatherExtension" -Filter "*.msix" -Recurse

          if ($msixFiles.Count -eq 0) {
            Write-Error "No MSIX packages found!"
            exit 1
          }

          foreach ($file in $msixFiles) {
            Write-Host "Verifying signature on $($file.Name)..."
            $sig = Get-AuthenticodeSignature $file.FullName
            Write-Host "  Status: $($sig.Status)"
            Write-Host "  Signer: $($sig.SignerCertificate.Subject)"
            if ($sig.Status -ne 'Valid') {
              Write-Error "Signature on $($file.Name) is not valid: $($sig.Status)"
              exit 1
            }
          }

          Write-Host "All MSIX packages are signed and verified."
      
      - name: Find and upload MSIX packages
        shell: pwsh
        run: |
          Write-Host "Searching for MSIX packages..."
          
          # Show what was produced
          if (Test-Path "WeatherExtension/AppPackages") {
            Write-Host "AppPackages directory contents:"
            Get-ChildItem -Path "WeatherExtension/AppPackages" -Recurse | ForEach-Object { Write-Host "  $($_.FullName)" }
          } else {
            Write-Host "WeatherExtension/AppPackages directory does not exist"
            Write-Host "Searching entire WeatherExtension directory for .msix files..."
            Get-ChildItem -Path "WeatherExtension" -Filter "*.msix" -Recurse | ForEach-Object { Write-Host "  $($_.FullName)" }
          }
          
          $msixFiles = Get-ChildItem -Path "WeatherExtension" -Filter "*.msix" -Recurse
          
          foreach ($file in $msixFiles) {
            Write-Host "Found MSIX: $($file.FullName)"
          }
          
          if ($msixFiles.Count -eq 0) {
            Write-Error "No MSIX packages found!"
            exit 1
          }
      
      - name: Upload MSIX artifacts
        uses: actions/upload-artifact@v7
        with:
          name: msix-packages
          path: WeatherExtension/**/*.msix
          retention-days: 7

      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release create "${{ github.ref_name }}" --generate-notes --title "${{ github.ref_name }}"

      - name: Upload MSIX packages to GitHub Release
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $msixFiles = Get-ChildItem -Path "WeatherExtension" -Filter "*.msix" -Recurse
          
          foreach ($file in $msixFiles) {
            Write-Host "Uploading $($file.Name) to release..."
            gh release upload "${{ github.ref_name }}" "$($file.FullName)" --clobber
          }

      # --- Build Store-specific packages with the MS Store publisher identity ---
      - name: Clean sideload MSIX packages
        shell: pwsh
        run: |
          Write-Host "Removing sideload MSIX packages before Store build..."
          Get-ChildItem -Path "WeatherExtension" -Filter "*.msix" -Recurse | Remove-Item -Force
          if (Test-Path "WeatherExtension/AppPackages") {
            Remove-Item -Path "WeatherExtension/AppPackages" -Recurse -Force
          }

      - name: Patch manifest with Store publisher identity
        shell: pwsh
        run: |
          $manifestPath = "WeatherExtension/Package.appxmanifest"
          $storePublisher = "${{ secrets.STORE_PUBLISHER_NAME }}"

          [xml]$manifest = Get-Content $manifestPath
          $manifest.Package.Identity.Publisher = $storePublisher
          $manifest.Save($manifestPath)

          Write-Host "Updated publisher to: $storePublisher"

      - name: Publish x64 Store MSIX
        run: >
          dotnet publish WeatherExtension/WeatherExtension.csproj -c Release -r win-x64
          /p:PublishProfile=win-x64
          /p:AppxPackageSigningEnabled=false
          /p:Version=${{ needs.build-and-test.outputs.version }}

      - name: Publish ARM64 Store MSIX
        run: >
          dotnet publish WeatherExtension/WeatherExtension.csproj -c Release -r win-arm64
          /p:PublishProfile=win-arm64
          /p:AppxPackageSigningEnabled=false
          /p:Version=${{ needs.build-and-test.outputs.version }}

      - name: Collect Store MSIX packages
        shell: pwsh
        run: |
          New-Item -Path "store-packages" -ItemType Directory -Force
          $msixFiles = Get-ChildItem -Path "WeatherExtension" -Filter "*.msix" -Recurse
          foreach ($file in $msixFiles) {
            Write-Host "Copying $($file.Name) to store-packages/"
            Copy-Item $file.FullName -Destination "store-packages/$($file.Name)"
          }

      - name: Upload Store MSIX artifacts
        uses: actions/upload-artifact@v7
        with:
          name: msix-store-packages
          path: store-packages/*.msix
          retention-days: 7

  store-submit:
    needs: [package, build-and-test]
    runs-on: windows-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Update Package.appxmanifest for Store
        shell: pwsh
        run: |
          $manifestPath = "WeatherExtension/Package.appxmanifest"
          $version = "${{ needs.build-and-test.outputs.version }}"
          $storePublisher = "${{ secrets.STORE_PUBLISHER_NAME }}"

          [xml]$manifest = Get-Content $manifestPath
          $manifest.Package.Identity.Version = $version
          $manifest.Package.Identity.Publisher = $storePublisher
          $manifest.Save($manifestPath)

          Write-Host "Updated manifest: Version=$version, Publisher=$storePublisher"

      - name: Download MSIX artifacts
        uses: actions/download-artifact@v8
        with:
          name: msix-store-packages
          path: msix-packages

      - name: List Store MSIX packages
        shell: pwsh
        run: |
          Write-Host "Store MSIX packages to submit:"
          Get-ChildItem -Path "msix-packages" -Filter "*.msix" -Recurse | ForEach-Object {
            Write-Host "  $($_.FullName) ($([math]::Round($_.Length / 1MB, 2)) MB)"
          }

      - name: Create multi-architecture .msixbundle
        id: bundle
        shell: pwsh
        run: |
          $version = "${{ needs.build-and-test.outputs.version }}"

          # 'msstore publish' picks its publisher from the *extension* of the positional
          # argument and uploads exactly that single file. Previously we passed the
          # project name ('WeatherExtension'), so the CLI treated it as a project, ran
          # its own project detection/packaging, gathered none of our prebuilt packages,
          # and committed the submission that Partner Center clones from the last
          # published one -- re-publishing the stale 1.1.0.0 packages every release.
          #
          # A single multi-architecture .msixbundle sidesteps all of that: it is selected
          # deterministically by extension and carries both x64 and arm64 at the correct
          # version, so the freshly built packages are what actually gets submitted.
          $msixFiles = Get-ChildItem -Path "msix-packages" -Filter "*.msix" -Recurse
          if ($msixFiles.Count -eq 0) {
            Write-Error "No MSIX packages found to bundle!"
            exit 1
          }

          # Stage the .msix packages in a clean folder so makeappx bundles only them.
          $bundleInput = Join-Path $env:GITHUB_WORKSPACE "bundle-input"
          New-Item -Path $bundleInput -ItemType Directory -Force | Out-Null
          $msixFiles | ForEach-Object { Copy-Item $_.FullName -Destination $bundleInput }

          $makeappx = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\makeappx.exe" -ErrorAction SilentlyContinue |
            Sort-Object FullName -Descending | Select-Object -First 1
          if (-not $makeappx) {
            Write-Error "makeappx.exe not found in the Windows SDK."
            exit 1
          }
          Write-Host "Using makeappx: $($makeappx.FullName)"

          $uploadDir = Join-Path $env:GITHUB_WORKSPACE "store-upload"
          New-Item -Path $uploadDir -ItemType Directory -Force | Out-Null
          $bundlePath = Join-Path $uploadDir "WeatherExtension_$version.msixbundle"

          & $makeappx.FullName bundle /d $bundleInput /bv $version /p $bundlePath /o
          if ($LASTEXITCODE -ne 0) {
            Write-Error "makeappx bundle failed with exit code $LASTEXITCODE"
            exit 1
          }

          $resolved = (Resolve-Path $bundlePath).Path
          Write-Host "Created .msixbundle: $resolved"
          Write-Host "Bundled packages:"
          $msixFiles | ForEach-Object { Write-Host "  $($_.Name)" }
          echo "bundle_file=$resolved" >> $env:GITHUB_OUTPUT

      - name: Setup Microsoft Store CLI
        uses: microsoft/microsoft-store-apppublisher@v1.3
      
      - name: Configure Store credentials
        shell: pwsh
        run: |
          msstore reconfigure `
            --tenantId "${{ secrets.PARTNER_CENTER_TENANT_ID }}" `
            --sellerId "${{ secrets.PARTNER_CENTER_SELLER_ID }}" `
            --clientId "${{ secrets.PARTNER_CENTER_CLIENT_ID }}" `
            --clientSecret "${{ secrets.PARTNER_CENTER_CLIENT_SECRET }}"
      
      - name: Submit to Microsoft Store (draft, no commit)
        shell: pwsh
        run: |
          # Create/upload the draft submission but DON'T commit yet. Partner Center
          # builds every new submission as a *copy of the last published one*, so the
          # draft still carries any previously published packages. We commit only after
          # the cleanup step below has removed the stale ones.
          msstore publish "${{ steps.bundle.outputs.bundle_file }}" -id "${{ secrets.STORE_PRODUCT_ID }}" --noCommit
          if ($LASTEXITCODE -ne 0) {
            Write-Error "msstore publish --noCommit failed with exit code $LASTEXITCODE"
            exit 1
          }

      - name: Remove stale packages and commit submission
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"

          # Surface the API response body on any failing REST call (PowerShell otherwise
          # only shows the status line and hides the useful error detail).
          trap {
            if ($_.ErrorDetails -and $_.ErrorDetails.Message) {
              Write-Host "API error response: $($_.ErrorDetails.Message)"
            }
            break
          }

          $tenantId     = "${{ secrets.PARTNER_CENTER_TENANT_ID }}"
          $clientId     = "${{ secrets.PARTNER_CENTER_CLIENT_ID }}"
          $clientSecret = "${{ secrets.PARTNER_CENTER_CLIENT_SECRET }}"
          $appId        = "${{ secrets.STORE_PRODUCT_ID }}"
          $version      = "${{ needs.build-and-test.outputs.version }}"

          # msstore's own 'submission update' can't be used here: it passes the entire
          # submission JSON as a command-line argument (Windows caps args at ~32 KB) and
          # it DELETES the draft when pricing.priceId == "Base". The raw Store submission
          # REST API avoids both problems and lets us surgically mark packages for delete.

          # --- Step 1: Azure AD access token (client credentials) ---
          $tokenBody = @{
            grant_type    = "client_credentials"
            client_id     = $clientId
            client_secret = $clientSecret
            resource      = "https://manage.devcenter.microsoft.com"
          }
          $token = (Invoke-RestMethod -Method Post `
            -Uri "https://login.microsoftonline.com/$tenantId/oauth2/token" `
            -ContentType "application/x-www-form-urlencoded" `
            -Body $tokenBody).access_token
          if (-not $token) { Write-Error "Failed to acquire Azure AD access token."; exit 1 }
          $headers = @{ Authorization = "Bearer $token" }
          $base = "https://manage.devcenter.microsoft.com/v1.0/my/applications/$appId"

          # --- Step 2: locate the pending draft created by the previous step ---
          $app = Invoke-RestMethod -Method Get -Uri $base -Headers $headers
          $subId = $app.pendingApplicationSubmission.id
          if (-not $subId) {
            Write-Error "No pending submission found. Did 'msstore publish --noCommit' succeed?"
            exit 1
          }
          Write-Host "Pending submission: $subId"

          $submissionUri = "$base/submissions/$subId"
          $submission = Invoke-RestMethod -Method Get -Uri $submissionUri -Headers $headers

          # --- Step 3: mark inherited packages for deletion ---
          # Discriminate by fileStatus, NOT version: a freshly uploaded package is
          # "PendingUpload" and its version field is still empty (Partner Center hasn't
          # extracted its manifest yet), so a version comparison would wrongly match it.
          # Every "Uploaded" package is inherited from the previously published submission
          # and must go; the new bundle we just uploaded is "PendingUpload" and is kept.
          Write-Host "Release version: $version"
          Write-Host "Packages in draft:"
          $changed = $false
          foreach ($p in $submission.applicationPackages) {
            $marker = ""
            if ($p.fileStatus -eq "Uploaded") {
              $p.fileStatus = "PendingDelete"
              $changed = $true
              $marker = "  <-- marked for deletion"
            }
            Write-Host "  $($p.fileName) v$($p.version) [$($p.fileStatus)]$marker"
          }

          # Safety guard: never commit a submission with no surviving package.
          $surviving = @($submission.applicationPackages | Where-Object { $_.fileStatus -ne "PendingDelete" })
          if ($surviving.Count -eq 0) {
            Write-Error "Refusing to commit: every package is marked PendingDelete. The new bundle should still be PendingUpload."
            exit 1
          }

          # --- Step 4: PUT the edited draft (only when something changed) ---
          if ($changed) {
            $body = $submission | ConvertTo-Json -Depth 100
            Invoke-RestMethod -Method Put -Uri $submissionUri -Headers $headers `
              -ContentType "application/json" -Body $body | Out-Null
            Write-Host "Draft updated: stale packages marked PendingDelete."
          } else {
            Write-Host "No stale packages to remove."
          }

          # --- Step 5: commit the submission ---
          # The Ingestion API rejects the commit unless the request advertises a JSON
          # content type, even though the commit itself carries no body. Passing
          # -ContentType sends the header (Content-Length: 0) and satisfies the check.
          Invoke-RestMethod -Method Post -Uri "$submissionUri/commit" -Headers $headers `
            -ContentType "application/json" | Out-Null
          Write-Host "Submission commit requested."

          # --- Step 6: poll until the commit is accepted (or fails) ---
          $okStates   = @("Certification", "Release", "Published", "PreProcessing", "Publishing")
          $failStates = @("CommitFailed", "PreProcessingFailed", "CertificationFailed", "ReleaseFailed", "PublishFailed", "Canceled")
          for ($i = 0; $i -lt 20; $i++) {
            Start-Sleep -Seconds 30
            $status = Invoke-RestMethod -Method Get -Uri "$submissionUri/status" -Headers $headers
            Write-Host "Status: $($status.status)"
            if ($failStates -contains $status.status) {
              Write-Host ($status.statusDetails | ConvertTo-Json -Depth 10)
              Write-Error "Submission entered failure state '$($status.status)'."
              exit 1
            }
            if ($okStates -contains $status.status) {
              Write-Host "Submission committed successfully; certification is now in progress."
              break
            }
          }

  winget-publish:
    needs: [package, build-and-test]
    runs-on: ubuntu-latest

    steps:
      - name: Preflight - validate WINGET_TOKEN
        shell: pwsh
        env:
          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
        run: |
          # komac masks every HTTP error on its package-existence check as
          # "<id> does not exist in microsoft/winget-pkgs", which hides the real cause
          # (almost always a rejected token -> 401). This step exercises the same reads
          # komac performs, with the same WINGET_TOKEN, and prints the true HTTP status.
          if ([string]::IsNullOrWhiteSpace($env:WINGET_TOKEN)) {
            Write-Error "WINGET_TOKEN secret is empty or unset."
            exit 1
          }
          if ($env:WINGET_TOKEN -ne $env:WINGET_TOKEN.Trim()) {
            Write-Warning "WINGET_TOKEN has leading/trailing whitespace - re-save the secret without newlines."
          }

          $auth = @{ Authorization = "Bearer $($env:WINGET_TOKEN.Trim())"; "User-Agent" = "winget-preflight"; Accept = "application/vnd.github+json" }

          # 1) Who is this token, and what classic scopes does it carry?
          $u = Invoke-WebRequest -Uri "https://api.github.com/user" -Headers $auth -SkipHttpErrorCheck
          Write-Host "GET /user                 -> HTTP $($u.StatusCode)"
          Write-Host "  x-oauth-scopes:         '$($u.Headers['x-oauth-scopes'])'"
          Write-Host "  x-ratelimit-remaining:  $($u.Headers['x-ratelimit-remaining'])"
          if ($u.StatusCode -eq 200) {
            Write-Host "  authenticated as:       $(($u.Content | ConvertFrom-Json).login)"
          }

          # 2) REST read of the package folder (proves the package is visible to this token).
          $pkg = "https://api.github.com/repos/microsoft/winget-pkgs/contents/manifests/b/BaldBeardedBuilder/WeatherforCommandPalette"
          $r = Invoke-WebRequest -Uri $pkg -Headers $auth -SkipHttpErrorCheck
          Write-Host "GET package manifest path -> HTTP $($r.StatusCode)"

          # 3) GraphQL viewer query - komac uses the GraphQL API, so this mirrors it best.
          $g = Invoke-WebRequest -Uri "https://api.github.com/graphql" -Method Post -Headers $auth `
            -Body '{"query":"{viewer{login}}"}' -SkipHttpErrorCheck
          Write-Host "POST /graphql viewer      -> HTTP $($g.StatusCode)"

          if ($u.StatusCode -ne 200 -or $g.StatusCode -ne 200) {
            Write-Host ""
            Write-Host "WINGET_TOKEN is being REJECTED by GitHub (see HTTP statuses above)."
            Write-Host "komac reports this as 'does not exist in microsoft/winget-pkgs'."
            Write-Host "Fix: create a *classic* PAT (not fine-grained) with the 'public_repo' scope,"
            Write-Host "confirm it is not expired, authorize it for SSO if your account requires it,"
            Write-Host "and paste it into the WINGET_TOKEN secret with no surrounding whitespace."
            Write-Error "WINGET_TOKEN failed validation."
            exit 1
          }
          Write-Host ""
          Write-Host "Token is valid. If komac still reports 'does not exist', the cause is not the token."

      - name: Submit to WinGet
        uses: vedantmgoyal9/winget-releaser@v2
        with:
          identifier: BaldBeardedBuilder.WeatherforCommandPalette
          installers-regex: '\.msix$'
          token: ${{ secrets.WINGET_TOKEN }}
          max-versions-to-keep: 3
          version: ${{ needs.build-and-test.outputs.version }}