name: Sign Windows Binaries

on:
  workflow_dispatch:
    inputs:
      artifact_pattern:
        description: 'Pattern for artifacts to download (default: terragrunt_windows_*)'
        required: false
        type: string
        default: 'terragrunt_windows_*'
      upload_artifact_name:
        description: 'Name for the uploaded signed artifacts'
        required: false
        type: string
        default: 'windows-signed-files'
  workflow_call:
    inputs:
      artifact_pattern:
        description: 'Pattern for artifacts to download (default: terragrunt_windows_*)'
        required: false
        type: string
        default: 'terragrunt_windows_*'
      upload_artifact_name:
        description: 'Name for the uploaded signed artifacts'
        required: false
        type: string
        default: 'windows-signed-files'

jobs:
  build:
    name: Build (windows/${{ matrix.arch }})
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [amd64, "386"]

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Use mise to install dependencies
        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
        with:
          version: 2026.1.9
          experimental: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - id: go-cache-paths
        run: |
          echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"

      - name: Go Build Cache
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
        with:
          path: ${{ steps.go-cache-paths.outputs.go-build }}
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}-windows-${{ matrix.arch }}
          restore-keys: |
            ${{ runner.os }}-go-build-

      - name: Go Mod Cache
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
        with:
          path: ${{ steps.go-cache-paths.outputs.go-mod }}
          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-mod-

      - name: Build Terragrunt
        env:
          GOOS: windows
          GOARCH: ${{ matrix.arch }}
          CGO_ENABLED: 0
          BUILD_VERSION: ${{ github.ref_name }}
        run: |
          OUTPUT="bin/terragrunt_${GOOS}_${GOARCH}.exe"
          go build -o "${OUTPUT}" \
            -ldflags "-s -w -X github.com/gruntwork-io/go-commons/version.Version=${BUILD_VERSION}" \
            .

      - name: Verify Static Linking
        env:
          GOOS: windows
          GOARCH: ${{ matrix.arch }}
        run: |
          OUTPUT="bin/terragrunt_${GOOS}_${GOARCH}.exe"
          .github/scripts/release/verify-static-binary.sh "${OUTPUT}" "${GOOS}" "${GOARCH}"

      - name: Upload Build Artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: terragrunt_windows_${{ matrix.arch }}
          path: bin/terragrunt_windows_${{ matrix.arch }}.exe

  sign-windows:
    name: Sign Windows Binaries
    needs: build
    if: always() && (needs.build.result == 'success' || needs.build.result == 'skipped')
    runs-on: windows-2025

    env:
      SM_HOST: https://clientauth.one.digicert.com
      SM_API_KEY: ${{ secrets.WINDOWS_SIGNING_API_KEY }}
      SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_SIGNING_P12_PASSWORD }}
      SM_KEYPAIR_ALIAS: ${{ secrets.WINDOWS_SIGNING_KEYPAIR_ALIAS }}
      WINDOWS_SIGNING_P12_BASE64: ${{ secrets.WINDOWS_SIGNING_P12_BASE64 }}

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Download Windows build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: ${{ inputs.artifact_pattern }}
          path: artifacts/
          merge-multiple: true

      - name: Prepare build artifacts
        shell: pwsh
        run: .github/scripts/release/prepare-windows-artifacts.ps1 -ArtifactsDirectory artifacts -BinDirectory bin

      - name: Setup Go
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
        with:
          go-version-file: go.mod

      - name: Install go-winres
        shell: pwsh
        run: .github/scripts/release/install-go-winres.ps1

      # Install DigiCert smtools (smctl)
      - name: Install DigiCert smtools
        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
        with:
          force-download-tools: 'true'

      # Verify smctl is available
      - name: Verify smctl installation
        shell: pwsh
        run: .github/scripts/release/verify-smctl.ps1

      # Restore P12 client certificate and set SM_CLIENT_CERT_FILE
      - name: Restore P12 client certificate
        shell: pwsh
        run: .github/scripts/release/restore-p12-certificate.ps1

      # Sign Windows binaries using external script
      - name: Sign and patch Windows binaries
        shell: pwsh
        run: .github/scripts/release/sign-windows.ps1 -BinDirectory bin

      # Upload Windows binaries (signed amd64 + unsigned 386)
      - name: Upload Windows Binaries
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ inputs.upload_artifact_name }}
          path: |
            bin/terragrunt_windows_amd64.exe
            bin/terragrunt_windows_386.exe
          if-no-files-found: error
