name: Desktop Windows Build

on:
  workflow_dispatch:

jobs:
  build-windows-exe:
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build desktop package
        run: pnpm --filter @fusion/desktop build

      # Code-signing hardening is intentionally deferred to FN-5592.
      - name: Package signed Windows EXE
        if: ${{ env.WINDOWS_CERTIFICATE_BASE64 != '' }}
        run: pnpm --filter @fusion/desktop exec electron-builder --win --x64 --arm64 --publish never
        env:
          WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
          CSC_LINK: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
          CSC_KEY_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Package unsigned Windows EXE
        if: ${{ env.WINDOWS_CERTIFICATE_BASE64 == '' }}
        run: pnpm --filter @fusion/desktop exec electron-builder --win --x64 --arm64 --publish never
        env:
          WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify signed artifacts
        if: ${{ env.WINDOWS_CERTIFICATE_BASE64 != '' }}
        shell: pwsh
        env:
          WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
        run: |
          $exes = Get-ChildItem packages/desktop/dist-electron -Filter *.exe
          if ($exes.Count -eq 0) { Write-Error "No EXE artifacts produced"; exit 1 }
          foreach ($exe in $exes) {
            $sig = Get-AuthenticodeSignature $exe.FullName
            Write-Host "$($exe.Name): $($sig.Status)"
            if ($sig.Status -ne 'Valid') { Write-Error "Signature invalid: $($exe.Name) ($($sig.Status))"; exit 1 }
          }

      # Automated publish is intentionally deferred to FN-5593.
      # Keep a single artifact; filenames include -x64 / -arm64 so both arches are captured.
      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: fusion-desktop-windows
          path: |
            packages/desktop/dist-electron/*.exe
            packages/desktop/dist-electron/*.blockmap