local-ci-cd-system/.gitea/workflows/build-ns7zip.yml

# Build ns7zip (Local CI) — pipeline per nsis-plugin-ns7zip
#
# Cross-platform matrix build: runs in parallel on both windows-build (WinRM)
# and linux-build (SSH) runners using the reusable composite action.
# Uses: https://gitea.emulab.it/Simone/local-ci-cd-system/.gitea/actions/local-ci-build@main
#
# Trigger: push su tag v*, oppure run manuale

name: Build ns7zip (Local CI)

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  build:
    strategy:
      matrix:
        target: [windows, linux]
      fail-fast: false

    # Runner label must match config.yaml labels: windows-build or linux-build
    runs-on: ${{ matrix.target }}-build

    steps:
      - uses: https://gitea.emulab.it/Simone/local-ci-cd-system/.gitea/actions/local-ci-build@main
        with:
          # build_plugin.py auto-detects host/toolset and builds all
          # configs by default; --dist forwards to the per-version script
          # which copies the DLLs to <repo>/dist/<config> instead of the
          # committed plugins/ dir.
          build-command:   'python build_plugin.py --dist'
          artifact-source: 'dist'
          submodules:      'true'
          guest-os:        ${{ matrix.target == 'linux' && 'Linux' || 'Windows' }}
          # In-guest clone (default). repo-url must be reachable FROM the
          # guest (VMnet8 NAT -> gitea.emulab.it), not the host-only SSH
          # alias. ci_orchestrator injects the GiteaPAT credential into
          # the HTTPS URL, so GiteaPAT must exist in the LocalSystem
          # keyring (Set-CIGuestCredential.ps1 -Target GiteaPAT) — or
          # nsis-plugin-ns7zip must be public.
          use-git-clone:   'true'
          repo-url:        'https://gitea.emulab.it/Simone/nsis-plugin-ns7zip.git'
          # Cross-repo build: github.ref_name is this repo's branch, not
          # nsis-plugin-ns7zip's. Pin the target repo's branch.
          repo-branch:     'main'
          # Suffix disambiguates artifact dirs: F:\CI\Artifacts\{run_id}-{attempt}-windows
          job-id-suffix:   '${{ matrix.target }}'
          artifact-name:   'nsis-plugin-ns7zip-${{ matrix.target }}-${{ github.ref_name }}'

  # ── Publish Gitea release with build artifacts ────────────────────────────
  # Runs only on tag pushes, after both matrix legs succeed.
  # Requires a GITEA_TOKEN secret with repo write permissions.
  release:
    needs: build
    # Tag pushes only. Explicit ${{ }} + event gate: a bare
    # `if: github.ref_type == 'tag'` can leave the job stuck "blocked"
    # (instead of skipped) on Gitea for workflow_dispatch runs.
    if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
    runs-on: windows-build

    steps:
      # No actions/download-artifact (its code is fetched from github.com).
      # The runner host is single and shared; the build matrix legs left
      # their outputs at F:\CI\Artifacts\{run_id}-{run_attempt}-{target}
      # (job-id-suffix = matrix.target). Read them directly from disk.
      - name: Create Gitea release and upload assets
        shell: powershell
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GITEA_URL:   ${{ github.server_url }}
          REPO:        ${{ github.repository }}
          TAG:         ${{ github.ref_name }}
          RUN_ID:      ${{ github.run_id }}
          RUN_ATTEMPT: ${{ github.run_attempt }}
        run: |
          #Requires -Version 5.1
          Set-StrictMode -Version Latest
          $ErrorActionPreference = 'Stop'

          $authHeader = @{ Authorization = "token $env:GITEA_TOKEN" }
          $apiBase    = "$env:GITEA_URL/api/v1/repos/$env:REPO"

          # Create the release (non-draft, non-prerelease)
          $releaseBody = @{
              tag_name   = $env:TAG
              name       = $env:TAG
              draft      = $false
              prerelease = $false
          } | ConvertTo-Json
          $jsonHeaders = $authHeader + @{ 'Content-Type' = 'application/json' }
          $release = Invoke-RestMethod -Method Post -Uri "$apiBase/releases" `
                         -Headers $jsonHeaders -Body $releaseBody
          $releaseId = $release.id
          Write-Host "Release created: id=$releaseId name=$($release.name)"

          # Compress each host-side artifact directory and upload as a
          # release asset. The build legs collected to
          # F:\CI\Artifacts\{run_id}-{run_attempt}-{target}.
          foreach ($target in @('windows', 'linux')) {
              $srcDir  = "F:\CI\Artifacts\$env:RUN_ID-$env:RUN_ATTEMPT-$target"
              if (-not (Test-Path -LiteralPath $srcDir) -or
                  -not (Get-ChildItem -Force -LiteralPath $srcDir)) {
                  throw "artifact dir missing or empty: $srcDir"
              }
              $zipName = "nsis-plugin-ns7zip-$target-$env:TAG.zip"
              Compress-Archive -Path "$srcDir\*" -DestinationPath $zipName -Force

              $uploadUrl     = "$apiBase/releases/$releaseId/assets?name=$zipName"
              $uploadHeaders = $authHeader + @{ 'Content-Type' = 'application/zip' }
              $zipBytes      = [System.IO.File]::ReadAllBytes(
                                   (Resolve-Path $zipName).ProviderPath)
              Invoke-RestMethod -Method Post -Uri $uploadUrl `
                  -Headers $uploadHeaders -Body $zipBytes | Out-Null