build-installer-qt6-win64.yml

name: Build OpenModScan Installer (Windows x64, Qt6)

on:
  push:
    tags:
      - "*"  
  workflow_dispatch:
    inputs:
      branch:
        description: 'Checkout branch'
        required: false
        default: dev
      tag:
        description: 'Checkout tag'
        required: false
      signing:
        description: 'Sign executable and installer'
        type: boolean
        default: false

permissions:
  contents: write

env:
  QT_VERSION: 6.9.3
  QT_ARCH: win64_msvc2022_64
  CMAKE_COMPILER: msvc2022_64
  CMAKE_GENERATOR: "Visual Studio 17 2022"
  CMAKE_ARCH: x64
  BUILD_TYPE: Release
  
   # SingPath variables
  PROJECT_SLUG: OpenModScan
  ORGANIZATION_ID: 2bd9d721-94a7-4c7d-aab8-b81dd84670a5
  ARTIFACT_CONF_SLUG: exe-zip

jobs:
  build-omodscan:
    name: Build OpenModScan installer version '${{ github.event.inputs.tag || github.event.inputs.branch || github.ref_name }}' with Qt6
    runs-on: windows-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.tag || github.event.inputs.branch || github.ref_name }}

      - name: Extract version from CMakeLists.txt
        run: |
          for /f "tokens=2" %%i in ('findstr /R /C:"VERSION [0-9]*\.[0-9]*\.[0-9]*" src\CMakeLists.txt') do echo APP_VERSION=%%i>>%GITHUB_ENV%
        shell: cmd

      - name: Convert version for dev branch
        if: ${{ github.ref_name == 'dev' || github.event.inputs.branch == 'dev' }}
        run: |
          for /f "tokens=1,2 delims=." %%a in ("%APP_VERSION%") do (
            echo APP_VERSION=%%a.%%b-dev>>%GITHUB_ENV%
          )
        shell: cmd
      
      - name: Select signing policy
        run: |
          set SIGNING_POLICY_SLUG=none
          if "${{ github.event_name }}"=="push" (
            if "${{ github.ref_type }}"=="tag" (
              for /f %%i in ('echo "${{ github.ref_name }}" ^| find /i "test"') do set TAG_HAS_TEST=1
              if not defined TAG_HAS_TEST (
                set SIGNING_POLICY_SLUG=release-signing
              )
            )
          )
          if "${{ github.event_name }}"=="workflow_dispatch" (
            if "${{ github.event.inputs.signing }}"=="true" (
              if not "${{ github.event.inputs.tag }}"=="" (
                echo "%{{ github.event.inputs.tag }}%" | find /i "test" >nul
                if errorlevel 1 (
                  set SIGNING_POLICY_SLUG=release-signing
                )
              ) else (
                set SIGNING_POLICY_SLUG=test-signing
              )
            )
          )
          echo SIGNING_POLICY_SLUG=%SIGNING_POLICY_SLUG%>>%GITHUB_ENV%
          echo Selected signing policy: %SIGNING_POLICY_SLUG%
        shell: cmd

      - name: Install Python (for aqtinstall)
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install aqtinstall
        run: |
          python -m pip install aqtinstall

      - name: Install Qt
        run: |
          python -m aqt install-qt windows desktop ${{ env.QT_VERSION }} ${{ env.QT_ARCH }} -O C:\Qt -m qt5compat qtpdf qtserialport qtserialbus
        shell: cmd

      - name: Set BUILD_DIR
        run: |
          echo BUILD_DIR=build-omodscan-Qt_${{ env.QT_VERSION }}_${{ env.CMAKE_COMPILER }}bit-${{ env.BUILD_TYPE }}>>%GITHUB_ENV%
        shell: cmd

      - name: Get Visual Studio path
        run: |
          for /f "usebackq tokens=*" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" ^
           -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath`) do set VS_PATH=%%i
          echo VS_PATH=%VS_PATH%>>%GITHUB_ENV%
        shell: cmd

      - name: Configure CMake
        run: |
          cmake src -B ${{ env.BUILD_DIR }} -G "${{ env.CMAKE_GENERATOR }}" -A ${{ env.CMAKE_ARCH }} -DCMAKE_PREFIX_PATH="C:/Qt/${{ env.QT_VERSION }}/${{ env.CMAKE_COMPILER }}"
        shell: cmd

      - name: Build
        run: |
          cmake --build ${{ env.BUILD_DIR }} --config ${{ env.BUILD_TYPE }} --parallel
        shell: cmd

      - name: Upload Executable
        id: upload-exe
        uses: actions/upload-artifact@v4
        if: success()
        with:
          name: omodscan-${{ env.APP_VERSION }}_${{ env.CMAKE_ARCH }}.exe
          path: ${{ env.BUILD_DIR }}\${{ env.BUILD_TYPE }}\omodscan.exe

      - name: Signing Executable
        uses: signpath/github-action-submit-signing-request@v1
        if: success() && env.SIGNING_POLICY_SLUG != 'none'
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '${{ env.ORGANIZATION_ID }}'
          project-slug: '${{ env.PROJECT_SLUG }}'
          signing-policy-slug: ${{ env.SIGNING_POLICY_SLUG }}
          artifact-configuration-slug: ${{ env.ARTIFACT_CONF_SLUG }}
          github-artifact-id: '${{steps.upload-exe.outputs.artifact-id}}'
          output-artifact-directory: ${{ env.BUILD_DIR }}\${{ env.BUILD_TYPE }}
          wait-for-completion: true
          wait-for-completion-timeout-in-seconds: 3600

      - name: Upload signed Executable
        uses: actions/upload-artifact@v4
        if: success() && env.SIGNING_POLICY_SLUG != 'none'
        with:
          name: omodscan-${{ env.APP_VERSION }}_${{ env.CMAKE_ARCH }}-signed.exe
          path: ${{ env.BUILD_DIR }}\${{ env.BUILD_TYPE }}\omodscan.exe

      - name: Deploy Qt dependencies using windeployqt
        run: |
          call "${{ env.VS_PATH }}\VC\Auxiliary\Build\vcvars64.bat"
          "C:\Qt\${{ env.QT_VERSION }}\${{ env.CMAKE_COMPILER }}\bin\windeployqt.exe" ^
            "%CD%\${{ env.BUILD_DIR }}\${{ env.BUILD_TYPE }}\omodscan.exe" ^
            --release ^
            --no-opengl-sw ^
            --no-system-d3d-compiler ^
            --no-system-dxc-compiler ^
            --plugindir "%CD%\${{ env.BUILD_DIR }}\${{ env.BUILD_TYPE }}\plugins" ^
            --skip-plugin-types help,generic,networkinformation,qmltooling,tls ^
            --exclude-plugins qsqlibase,qsqlmimer,qsqloci,qsqlodbc,qsqlpsql
        shell: cmd

      - name: Install NSIS
        run: |
          choco install nsis -y
        shell: cmd

      - name: Build NSIS installer
        run: |
          "C:\Program Files (x86)\NSIS\makensis.exe" ^
           /DVERSION="${{ env.APP_VERSION }}" ^
           /DMIN_WINDOWS_VERSION=10 ^
           /DBUILD_PATH="%CD%\${{ env.BUILD_DIR }}\${{ env.BUILD_TYPE }}" ^
           /DICON_FILE="%CD%\src\res\omodscan.ico" ^
           /DWELCOMEFINISHPAGE_BITMAP="%CD%\.github\win32\nsis3-omodscan.bmp" ^
           /DLICENSE_FILE="%CD%\src\res\license.txt" ^
           /DOUTPUT_FILE="%CD%\qt6-omodscan-${{ env.APP_VERSION }}_${{ env.CMAKE_ARCH }}.exe" ^
           %CD%\.github\win32\installer-win64.nsi
        shell: cmd

      - name: Upload Installer
        id: upload-installer
        uses: actions/upload-artifact@v4
        if: success()
        with:
          name: qt6-omodscan-${{ env.APP_VERSION }}_${{ env.CMAKE_ARCH }}
          path: qt6-omodscan-${{ env.APP_VERSION }}_${{ env.CMAKE_ARCH }}.exe

      - name: Signing Installer
        uses: signpath/github-action-submit-signing-request@v1
        if: success() && env.SIGNING_POLICY_SLUG != 'none'
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '${{ env.ORGANIZATION_ID }}'
          project-slug: '${{ env.PROJECT_SLUG }}'
          signing-policy-slug: ${{ env.SIGNING_POLICY_SLUG }}
          artifact-configuration-slug: ${{ env.ARTIFACT_CONF_SLUG }}
          github-artifact-id: '${{steps.upload-installer.outputs.artifact-id}}'
          output-artifact-directory: .
          wait-for-completion: true
          wait-for-completion-timeout-in-seconds: 3600

      - name: Upload signed Installer
        uses: actions/upload-artifact@v4
        if: success() && env.SIGNING_POLICY_SLUG != 'none'
        with:
          name: qt6-omodscan-${{ env.APP_VERSION }}_${{ env.CMAKE_ARCH }}-signed
          path: qt6-omodscan-${{ env.APP_VERSION }}_${{ env.CMAKE_ARCH }}.exe

      - name: Create or update GitHub Release and upload EXE
        if: success() && github.event_name == 'push' && github.ref_type == 'tag'
        uses: softprops/action-gh-release@v2
        with:
          draft: true
          tag_name: ${{ github.ref_name }}
          name: Open ModScan ${{ env.APP_VERSION }}
          files: |
            qt6-omodscan-${{ env.APP_VERSION }}_${{ env.CMAKE_ARCH }}.exe
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}