# =============================================================================
# The pipeline is reduced to the bare commands and nothing else: no readiness waits, 
# no store or service probes, no diagnostics, no path discovery. 
# Every path is assumed to be where the agent's documentation
# says it is, and a wrong assumption is meant to fail the step that depends on
# it rather than be caught earlier.
#
# Manual trigger only, which is what makes the gate unnecessary: no pull request
# from a fork can reach the signing credentials because no pull request runs it.
# Do not add `pull_request` here.
# =============================================================================
name: Sign with the new agent (minimal)

on:
  push:
    branches: [ main ]
  pull_request:
  workflow_dispatch:
    inputs:
      sign:
        description: "Sign the artifacts with the Signum agent"
        type: boolean
        default: true

permissions:
  contents: read

defaults:
  run:
    shell: pwsh

env:
  PUBLISH_DIR: artifacts/publish

jobs:
  build:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "8.0.x"

      - run: dotnet publish src/SignumSample.App/SignumSample.App.csproj -c Release -o $env:PUBLISH_DIR

      - uses: actions/upload-artifact@v4
        with:
          name: unsigned
          path: ${{ env.PUBLISH_DIR }}

  sign:
    needs: build
    runs-on: ${{ vars.SIGNING_RUNNER || 'windows-latest' }}

    env:
      SIGNUM_UTIL: C:\Program Files\Keyfactor\Signum\setup\signum-util.exe
      SIGNUM_SERVICE: C:\Program Files\Keyfactor\Signum\service\SignumService.exe
      SIGNUM_NEW_AGENT_MSI_URL: ${{ vars.SIGNUM_NEW_AGENT_MSI_URL }}
      SIGNUM_PRIMARY_SERVER: ${{ vars.SIGNUM_PRIMARY_SERVER }}
      SIGNUM_USERNAME: ${{ vars.SIGNUM_USERNAME }}
      SIGNUM_PASSWORD: ${{ secrets.SIGNUM_PASSWORD }}
      SIGNUM_CERT_THUMBPRINT: ${{ vars.SIGNUM_CERT_THUMBPRINT }}

    steps:
      - uses: actions/download-artifact@v4
        with:
          name: unsigned
          path: ${{ env.PUBLISH_DIR }}

      # Both architectures: the MSI's LaunchCondition requires x86 as well as
      # x64 and aborts the install without them.
      - name: Install the Visual C++ runtimes
        run: |
          foreach ($url in @(
            "https://aka.ms/vs/17/release/vc_redist.x64.exe",
            "https://aka.ms/vs/17/release/vc_redist.x86.exe"
          )) {
            $installer = Join-Path $env:RUNNER_TEMP (Split-Path $url -Leaf)
            Invoke-WebRequest $url -OutFile $installer -UseBasicParsing
            Start-Process $installer -ArgumentList "/install", "/quiet", "/norestart" -Wait
          }

      - name: Install the agent
        run: |
          $msi = Join-Path $env:RUNNER_TEMP "signum-agent.msi"
          Invoke-WebRequest $env:SIGNUM_NEW_AGENT_MSI_URL -OutFile $msi -UseBasicParsing
          Start-Process msiexec.exe -ArgumentList "/i", "`"$msi`"", "/quiet", "/norestart" -Wait

      # The MSI only launches the agent above UILevel 3, so a /quiet install
      # never does. This is that launch, by hand.
      - name: Start the agent
        run: |
          Start-Process $env:SIGNUM_SERVICE
          Start-Sleep -Seconds 10

      - name: Authenticate and publish the certificates
        run: |
          & $env:SIGNUM_UTIL setup -h $env:SIGNUM_PRIMARY_SERVER -u $env:SIGNUM_USERNAME -p $env:SIGNUM_PASSWORD
          & $env:SIGNUM_UTIL cs -a -t My

      - name: Sign, verify and run
        run: |
          $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object FullName)[-1].FullName
          $files = "$env:PUBLISH_DIR\SignumSample.App.exe", "$env:PUBLISH_DIR\SignumSample.Library.dll"

          & $signtool sign /fd SHA256 /sha1 $env:SIGNUM_CERT_THUMBPRINT /tr http://timestamp.digicert.com /td SHA256 /v @files
          & $signtool verify /pa /all @files
          & "$env:PUBLISH_DIR\SignumSample.App.exe" --require-signatures

      - uses: actions/upload-artifact@v4
        with:
          name: signed
          path: ${{ env.PUBLISH_DIR }}

      - name: Log the agent out
        if: always()
        run: |
          & $env:SIGNUM_UTIL logout
          exit 0