cd.yml

name: Build and sign .exe

on:
  workflow_dispatch

jobs:
  build:
    name: Build .exe
    runs-on: windows-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - name: Install dependencies
        run: python -m pip install --upgrade pip
      - name: Install Open Pectus Engine Manager
        run: pip install -e ".[development]"
      - name: Build .exe
        run: |
          pyinstaller pyinstaller.spec
          cd dist
          move "Open Pectus Engine Manager.exe" ../
      - name: Setup SM_CLIENT_CERT_FILE from base64 secret data
        run: echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12 
        shell: bash
      - name: Setup Software Trust Manager
        id: stm-setup
        uses: digicert/code-signing-software-trust-action@v1
        with:
          simple-signing-mode: true
          input: "Open Pectus Engine Manager.exe"
          keypair-alias: key_1229360753
        env:
          SM_HOST: ${{ secrets.SM_HOST }}
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE: D:\\Certificate_pkcs12.p12
          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
      - uses: ncipollo/release-action@v1
        with:
          artifacts: "Open Pectus Engine Manager.exe"
          tag: release
          body: "Download and run `Open Pectus Engine Manager.exe`."
          allowUpdates: true
          makeLatest: true
          omitBodyDuringUpdate: true
          removeArtifacts: true
          replacesArtifacts: true