release.yml

name: Build, Sign and Release

on:
  push:
    tags:
      - '*'

jobs:
  build-windows:
    name: Build Windows Executable
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11.7'

      - name: Create and activate venv
        run: |
          python -m venv venv
          .\venv\Scripts\Activate

      - name: Install Dependencies
        run: |
          .\venv\Scripts\Activate
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Build with PyInstaller
        run: |
          .\venv\Scripts\Activate
          pyinstaller main.py --name WingmanAiCore --noconfirm --icon assets/wingman-ai.ico --paths venv/Lib/site-packages --add-data "venv/Lib/site-packages/azure/cognitiveservices/speech;azure/cognitiveservices/speech" --add-data "assets;assets" --add-data "services;services" --add-data "wingmen;wingmen" --add-data "templates;templates" --add-data "audio_samples;audio_samples" --add-data "LICENSE;." --add-data "lib/python3.dll;." --hidden-import urllib --hidden-import urllib.robotparser

      - name: Upload Windows Exe Artifact
        uses: actions/upload-artifact@v4
        with:
          name: WingmanAiCore-Windows-Build # Unique name for the build artifact
          path: dist/WingmanAiCore/

  sign-windows-executable:
    needs: build-windows
    runs-on: windows-2022
    steps:
      - uses: actions/checkout@v4 # for the action
      - uses: actions/download-artifact@v4
        with:
          name: WingmanAiCore-Windows-Build
          path: WingmanAiCore

      - name: Sign
        env:
          CERTIFICATE_HOST: ${{ secrets.SM_HOST }}
          CERTIFICATE_HOST_API_KEY: ${{ secrets.SM_API_KEY }}
          CERTIFICATE_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CLIENT_CERTIFICATE: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
          CLIENT_CERTIFICATE_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
        uses: ./.github/actions/code-sign
        with:
          path-to-binary: 'WingmanAiCore/WingmanAiCore.exe'

      - name: Upload Windows Artifact
        uses: actions/upload-artifact@v4
        with:
          name: WingmanAiCore-Windows-Signed # Unique name for the signed artifact
          path: WingmanAiCore

  release:
    needs: [sign-windows-executable]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: WingmanAiCore-Windows-Signed # Ensure this matches the unique signed artifact name
          path: .

      - name: Create Release
        id: create_release
        uses: softprops/action-gh-release@v1
        with:
          files: |
            WingmanAiCore-Windows.zip
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}