name: Desktop Windows Internal Build

on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: desktop-windows-internal-${{ github.ref }}
  cancel-in-progress: false

jobs:
  windows-internal:
    name: Windows NSIS internal validation
    runs-on: windows-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "22.13"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Resolve internal build metadata
        id: build-metadata
        shell: pwsh
        run: |
          if ($env:GITHUB_REF_TYPE -eq "tag") {
            throw "Windows internal validation builds must run from a branch, not a release tag."
          }

          $channel = "dev"
          if ($env:GITHUB_REF_NAME -in @("dev", "main", "release")) {
            $channel = $env:GITHUB_REF_NAME
          }

          "channel=$channel" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          "commit=$env:GITHUB_SHA" | Out-File -FilePath $env:GITHUB_OUTPUT -Append

      - name: Install dependencies
        run: npm ci

      - name: Check release build metadata
        run: npm run release:env:check
        env:
          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}

      - name: Check synchronized client version
        run: npm run version:check

      - name: Check runtime boundary
        run: npm run runtime:check

      - name: Check desktop release and security gate
        run: npm run desktop:release:check

      - name: Check UI contract
        run: npm run ui:contract

      - name: Type check
        run: npm run type-check

      - name: Unit tests
        run: npm run test:unit

      - name: Build Web artifact
        run: npm run build
        env:
          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}

      - name: Write Windows internal Tauri config
        shell: pwsh
        run: |
          $config = @{
            bundle = @{
              createUpdaterArtifacts = $false
            }
          } | ConvertTo-Json -Depth 8
          Set-Content -Path "tauri.windows.internal.conf.json" -Value $config -Encoding utf8
          Get-Content "tauri.windows.internal.conf.json"

      - name: Build unsigned Windows NSIS internal installer
        timeout-minutes: 30
        run: npm run desktop:build -- --config tauri.windows.internal.conf.json --bundles nsis --ci
        env:
          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}

      - name: Create Windows installer checksum manifest
        shell: pwsh
        run: |
          $bundleDir = "src-tauri/target/release/bundle/nsis"
          $installers = Get-ChildItem -Path $bundleDir -Filter "*.exe" -File
          if ($installers.Count -eq 0) {
            throw "No Windows NSIS EXE installer was produced."
          }

          $checksums = foreach ($installer in $installers) {
            $hash = Get-FileHash -Path $installer.FullName -Algorithm SHA256
            "$($hash.Hash.ToLowerInvariant())  $($installer.Name)"
          }

          $manifest = Join-Path $bundleDir "SHA256SUMS.txt"
          $checksums | Set-Content -Path $manifest -Encoding utf8
          Get-Content $manifest

      - name: Upload Windows internal installer
        uses: actions/upload-artifact@v4
        with:
          name: ctms-windows-internal-${{ steps.build-metadata.outputs.channel }}-${{ steps.build-metadata.outputs.commit }}
          path: |
            frontend/src-tauri/target/release/bundle/nsis/*.exe
            frontend/src-tauri/target/release/bundle/nsis/SHA256SUMS.txt
          if-no-files-found: error