release.yml

name: Release

on:
  # Keep releases manual-only so default-branch merges do not request approval.
  workflow_dispatch:
    inputs:
      version:
        description: Package version to release. Defaults to the version detected from source files.
        required: false
        type: string
      dry-run:
        description: Build and package only; skip tag creation, GitHub release, and NuGet publication.
        required: false
        default: true
        type: boolean
      github-env:
        description: GitHub environment selection.
        required: true
        type: choice
        options:
          - auto
          - test
          - prod
        default: auto
      publish-nuget:
        description: Publish packages to NuGet.org during a manual release.
        required: false
        default: false
        type: boolean
      publish-psgallery:
        description: Publish Devolutions.Pinget.Client to PowerShell Gallery during a manual release.
        required: false
        default: false
        type: boolean

permissions:
  contents: write

env:
  DOTNET_NOLOGO: true
  CARGO_TERM_COLOR: always

jobs:
  preflight:
    name: Preflight
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.info.outputs.version }}
      tag-name: ${{ steps.info.outputs.tag-name }}
      dry-run: ${{ steps.info.outputs.dry-run }}
      package-env: ${{ steps.info.outputs.package-env }}
      publish-nuget: ${{ steps.info.outputs.publish-nuget }}
      publish-psgallery: ${{ steps.info.outputs.publish-psgallery }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Package information
        id: info
        shell: pwsh
        run: |
          $IsMasterBranch = ('${{ github.ref_name }}' -eq 'master')
          $IsWorkflowDispatch = ('${{ github.event_name }}' -eq 'workflow_dispatch')

          $DryRun = $false
          $PublishNuget = $true
          $PublishPowerShellGallery = $true
          $RequestedEnvironment = 'auto'

          if ($IsWorkflowDispatch) {
            try { $DryRun = [System.Boolean]::Parse('${{ inputs['dry-run'] }}') } catch { $DryRun = $true }
            try { $PublishNuget = [System.Boolean]::Parse('${{ inputs['publish-nuget'] }}') } catch { $PublishNuget = $false }
            try { $PublishPowerShellGallery = [System.Boolean]::Parse('${{ inputs['publish-psgallery'] }}') } catch { $PublishPowerShellGallery = $false }

            $RequestedEnvironment = '${{ inputs['github-env'] }}'.Trim().ToLowerInvariant()
            if ([string]::IsNullOrWhiteSpace($RequestedEnvironment)) {
              $RequestedEnvironment = 'auto'
            }
          }

          switch ($RequestedEnvironment) {
            'auto' {
              $PackageEnv = if ($IsMasterBranch) {
                'publish-prod'
              } else {
                'publish-test'
              }
            }
            'test' {
              $PackageEnv = 'publish-test'
            }
            'prod' {
              $PackageEnv = 'publish-prod'
            }
            default {
              throw "Unsupported github-env value: $RequestedEnvironment (expected auto, test, or prod)"
            }
          }

          if ($RequestedEnvironment -eq 'test' -and ($IsMasterBranch -or (-not $DryRun -and ($PublishNuget -or $PublishPowerShellGallery)))) {
            $PackageEnv = 'publish-prod'
            Write-Host '::notice::github-env=test was promoted to publish-prod'
          }

          if (-not $IsMasterBranch) {
            if ($PackageEnv -ne 'publish-prod') {
              $DryRun = $true
              $PublishNuget = $false
              $PublishPowerShellGallery = $false
            }
          }

          if ($DryRun) {
            $PublishNuget = $false
            $PublishPowerShellGallery = $false
          }

          $Version = '${{ inputs.version }}'
          if ([string]::IsNullOrWhiteSpace($Version)) {
            $coreVersion = Select-String -Path 'rust/crates/pinget-core/Cargo.toml' -Pattern '^version = "([^"]+)"$' | Select-Object -First 1
            $cliVersion = Select-String -Path 'rust/crates/pinget-cli/Cargo.toml' -Pattern '^version = "([^"]+)"$' | Select-Object -First 1
            $dotnetVersion = Select-String -Path 'dotnet/src/Devolutions.Pinget.Cli/Program.cs' -Pattern '^const string Version = "([^"]+)";$' | Select-Object -First 1

            if (($null -eq $coreVersion) -or ($null -eq $cliVersion) -or ($null -eq $dotnetVersion)) {
              throw 'Unable to detect version from source files'
            }

            $coreVersionValue = $coreVersion.Matches[0].Groups[1].Value
            $cliVersionValue = $cliVersion.Matches[0].Groups[1].Value
            $dotnetVersionValue = $dotnetVersion.Matches[0].Groups[1].Value

            if (($coreVersionValue -ne $cliVersionValue) -or ($coreVersionValue -ne $dotnetVersionValue)) {
              throw "Version mismatch detected: pinget-core=$coreVersionValue pinget-cli=$cliVersionValue dotnet=$dotnetVersionValue"
            }

            $Version = $coreVersionValue
          }

          if ([string]::IsNullOrWhiteSpace($Version)) {
            throw 'Package version is empty'
          }

          $TagName = "v$Version"

          "version=$Version" >> $Env:GITHUB_OUTPUT
          "tag-name=$TagName" >> $Env:GITHUB_OUTPUT
          "dry-run=$($DryRun.ToString().ToLower())" >> $Env:GITHUB_OUTPUT
          "package-env=$PackageEnv" >> $Env:GITHUB_OUTPUT
          "publish-nuget=$($PublishNuget.ToString().ToLower())" >> $Env:GITHUB_OUTPUT
          "publish-psgallery=$($PublishPowerShellGallery.ToString().ToLower())" >> $Env:GITHUB_OUTPUT

          Write-Host "::notice::Version: $Version"
          Write-Host "::notice::Tag: $TagName"
          Write-Host "::notice::DryRun: $DryRun"
          Write-Host "::notice::Environment: $PackageEnv"
          Write-Host "::notice::GitHubEnvMode: $RequestedEnvironment"
          Write-Host "::notice::PublishNuget: $PublishNuget"
          Write-Host "::notice::PublishPowerShellGallery: $PublishPowerShellGallery"

  rust-artifacts:
    name: Rust Artifacts (${{ matrix.name }})
    runs-on: ${{ matrix.os }}
    needs: preflight
    environment: ${{ needs.preflight.outputs.package-env }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-x64
            os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            archive_name: pinget-linux-x64.zip
            binary_name: pinget
          - name: linux-arm64
            os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            archive_name: pinget-linux-arm64.zip
            binary_name: pinget
          - name: windows-x64
            os: windows-latest
            target: x86_64-pc-windows-msvc
            archive_name: pinget-windows-x64.zip
            binary_name: pinget.exe
          - name: windows-arm64
            os: windows-latest
            target: aarch64-pc-windows-msvc
            archive_name: pinget-windows-arm64.zip
            binary_name: pinget.exe
          - name: macos-x64
            os: macos-14
            target: x86_64-apple-darwin
            archive_name: pinget-macos-x64.zip
            binary_name: pinget
          - name: macos-arm64
            os: macos-14
            target: aarch64-apple-darwin
            archive_name: pinget-macos-arm64.zip
            binary_name: pinget

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Rust toolchain
        shell: pwsh
        run: |
          rustup toolchain install stable --profile minimal --target "${{ matrix.target }}"
          rustup default stable

      - name: Install Linux ARM64 linker
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        shell: bash
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu

      - name: Configure static MSVC runtime
        if: contains(matrix.target, 'windows-msvc')
        shell: pwsh
        run: |
          "RUSTFLAGS=-C target-feature=+crt-static" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Build release binary
        shell: pwsh
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
        run: |
          cargo build --release --package pinget-cli --bin pinget --manifest-path rust/Cargo.toml --target "${{ matrix.target }}"

      - name: Install code signing tools
        if: contains(matrix.target, 'windows-msvc')
        shell: pwsh
        run: |
          dotnet tool install --global AzureSignTool

          $TestCertsUrl = "https://raw.githubusercontent.com/Devolutions/devolutions-authenticode/master/data/certs"
          Invoke-WebRequest -Uri "$TestCertsUrl/authenticode-test-ca.crt" -OutFile ".\authenticode-test-ca.crt"
          Import-Certificate -FilePath ".\authenticode-test-ca.crt" -CertStoreLocation "cert:\LocalMachine\Root"
          Remove-Item ".\authenticode-test-ca.crt" -ErrorAction SilentlyContinue | Out-Null

      - name: Code sign Rust binary
        if: contains(matrix.target, 'windows-msvc')
        shell: pwsh
        env:
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          CODE_SIGNING_CERTIFICATE_NAME: ${{ secrets.CODE_SIGNING_CERTIFICATE_NAME }}
          CODE_SIGNING_CLIENT_ID: ${{ secrets.CODE_SIGNING_CLIENT_ID }}
          CODE_SIGNING_CLIENT_SECRET: ${{ secrets.CODE_SIGNING_CLIENT_SECRET }}
          CODE_SIGNING_KEYVAULT_URL: ${{ secrets.CODE_SIGNING_KEYVAULT_URL }}
          CODE_SIGNING_TIMESTAMP_SERVER: ${{ vars.CODE_SIGNING_TIMESTAMP_SERVER }}
          TARGET: ${{ matrix.target }}
          PINGET_BIN_NAME: ${{ matrix.binary_name }}
        run: |
          $PackageEnv = '${{ needs.preflight.outputs.package-env }}'
          $DryRun = [System.Boolean]::Parse('${{ needs.preflight.outputs.dry-run }}')
          $RequiredVariables = @(
            'AZURE_TENANT_ID',
            'CODE_SIGNING_CERTIFICATE_NAME',
            'CODE_SIGNING_CLIENT_ID',
            'CODE_SIGNING_CLIENT_SECRET',
            'CODE_SIGNING_KEYVAULT_URL',
            'CODE_SIGNING_TIMESTAMP_SERVER'
          )
          $MissingVariables = @($RequiredVariables | Where-Object {
            [string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($_))
          })

          if ($MissingVariables.Count -gt 0) {
            $Message = "Code signing configuration missing: $($MissingVariables -join ', ')"
            if ($PackageEnv -eq 'publish-prod' -and -not $DryRun) {
              throw $Message
            }

            Write-Host "$Message; skipping code signing."
            return
          }

          $BinaryPath = [System.IO.Path]::Combine('rust', 'target', $env:TARGET, 'release', $env:PINGET_BIN_NAME)
          if (-not (Test-Path -Path $BinaryPath)) {
            throw "Binary not found: $BinaryPath"
          }

          AzureSignTool sign `
            -kvt $env:AZURE_TENANT_ID `
            -kvu $env:CODE_SIGNING_KEYVAULT_URL `
            -kvi $env:CODE_SIGNING_CLIENT_ID `
            -kvs $env:CODE_SIGNING_CLIENT_SECRET `
            -kvc $env:CODE_SIGNING_CERTIFICATE_NAME `
            -tr $env:CODE_SIGNING_TIMESTAMP_SERVER `
            -v `
            $BinaryPath
          if ($LASTEXITCODE -ne 0) {
            throw "Code signing failed for $BinaryPath."
          }

      - name: Package artifacts
        shell: pwsh
        env:
          TARGET: ${{ matrix.target }}
          PINGET_BIN_NAME: ${{ matrix.binary_name }}
          PINGET_ARCHIVE_NAME: ${{ matrix.archive_name }}
        run: |
          Add-Type -AssemblyName System.IO.Compression.FileSystem

          $target = $env:TARGET
          $binaryName = $env:PINGET_BIN_NAME
          $archiveName = $env:PINGET_ARCHIVE_NAME
          $binaryPath = [System.IO.Path]::Combine('rust', 'target', $target, 'release', $binaryName)

          if (-not (Test-Path -Path $binaryPath)) {
            throw "Binary not found: $binaryPath"
          }

          if (Test-Path -Path $archiveName) {
            Remove-Item -Path $archiveName -Force
          }

          $archive = [System.IO.Compression.ZipFile]::Open($archiveName, [System.IO.Compression.ZipArchiveMode]::Create)
          try {
            [System.IO.Compression.ZipFileExtensions]::CreateEntryFromFile(
              $archive,
              $binaryPath,
              $binaryName,
              [System.IO.Compression.CompressionLevel]::Optimal
            ) | Out-Null
          }
          finally {
            $archive.Dispose()
          }

          Write-Host "Created $archiveName"

      - name: Upload Rust artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.archive_name }}
          path: ${{ matrix.archive_name }}
          if-no-files-found: error

  csharp-packages:
    name: C# Packages
    runs-on: windows-latest
    needs: preflight
    environment: ${{ needs.preflight.outputs.package-env }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Setup Rust
        shell: pwsh
        run: |
          rustup toolchain install stable --profile minimal --target x86_64-pc-windows-msvc --target aarch64-pc-windows-msvc
          rustup default stable

      - name: Install Pester
        shell: pwsh
        run: |
          Set-PSRepository PSGallery -InstallationPolicy Trusted
          Install-Module Pester -Scope CurrentUser -Force -SkipPublisherCheck

      - name: Restore solution
        run: dotnet restore dotnet/Devolutions.Pinget.slnx

      - name: Build solution
        run: dotnet build dotnet/Devolutions.Pinget.slnx -c Release --no-restore

      - name: Run core tests
        run: dotnet test dotnet/src/Devolutions.Pinget.Core.Tests/Devolutions.Pinget.Core.Tests.csproj -c Release --no-build

      - name: Build native COM DLLs
        shell: pwsh
        env:
          RUSTFLAGS: -C target-feature=+crt-static
        run: |
          cargo build -p pinget-com --manifest-path rust/Cargo.toml --release --target x86_64-pc-windows-msvc
          cargo build -p pinget-com --manifest-path rust/Cargo.toml --release --target aarch64-pc-windows-msvc

      - name: Run PowerShell tests
        shell: pwsh
        run: pwsh -NoLogo -NoProfile -File (Resolve-Path 'dotnet/tests/RunTests.ps1')

      - name: Install code signing tools
        shell: pwsh
        run: |
          dotnet tool install --global AzureSignTool

          $TestCertsUrl = "https://raw.githubusercontent.com/Devolutions/devolutions-authenticode/master/data/certs"
          Invoke-WebRequest -Uri "$TestCertsUrl/authenticode-test-ca.crt" -OutFile ".\authenticode-test-ca.crt"
          Import-Certificate -FilePath ".\authenticode-test-ca.crt" -CertStoreLocation "cert:\LocalMachine\Root"
          Remove-Item ".\authenticode-test-ca.crt" -ErrorAction SilentlyContinue | Out-Null

      - name: Code sign C# binaries
        shell: pwsh
        env:
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          CODE_SIGNING_CERTIFICATE_NAME: ${{ secrets.CODE_SIGNING_CERTIFICATE_NAME }}
          CODE_SIGNING_CLIENT_ID: ${{ secrets.CODE_SIGNING_CLIENT_ID }}
          CODE_SIGNING_CLIENT_SECRET: ${{ secrets.CODE_SIGNING_CLIENT_SECRET }}
          CODE_SIGNING_KEYVAULT_URL: ${{ secrets.CODE_SIGNING_KEYVAULT_URL }}
          CODE_SIGNING_TIMESTAMP_SERVER: ${{ vars.CODE_SIGNING_TIMESTAMP_SERVER }}
        run: |
          $PackageEnv = '${{ needs.preflight.outputs.package-env }}'
          $DryRun = [System.Boolean]::Parse('${{ needs.preflight.outputs.dry-run }}')
          $RequiredVariables = @(
            'AZURE_TENANT_ID',
            'CODE_SIGNING_CERTIFICATE_NAME',
            'CODE_SIGNING_CLIENT_ID',
            'CODE_SIGNING_CLIENT_SECRET',
            'CODE_SIGNING_KEYVAULT_URL',
            'CODE_SIGNING_TIMESTAMP_SERVER'
          )
          $MissingVariables = @($RequiredVariables | Where-Object {
            [string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($_))
          })

          if ($MissingVariables.Count -gt 0) {
            $Message = "Code signing configuration missing: $($MissingVariables -join ', ')"
            if ($PackageEnv -eq 'publish-prod' -and -not $DryRun) {
              throw $Message
            }

            Write-Host "$Message; skipping code signing."
            return
          }

          $SignParams = @(
            'sign',
            '-kvt', $env:AZURE_TENANT_ID,
            '-kvu', $env:CODE_SIGNING_KEYVAULT_URL,
            '-kvi', $env:CODE_SIGNING_CLIENT_ID,
            '-kvs', $env:CODE_SIGNING_CLIENT_SECRET,
            '-kvc', $env:CODE_SIGNING_CERTIFICATE_NAME,
            '-tr', $env:CODE_SIGNING_TIMESTAMP_SERVER,
            '-v'
          )

          $BinaryRoots = @(
            'dotnet/src/Devolutions.Pinget.Core/bin/Release',
            'dotnet/src/Devolutions.Pinget.PowerShell.Engine/bin/Release',
            'dotnet/src/Devolutions.Pinget.PowerShell.Cmdlets/bin/Release',
            'rust/target/x86_64-pc-windows-msvc/release',
            'rust/target/aarch64-pc-windows-msvc/release'
          )
          $Binaries = @(Get-ChildItem -Path $BinaryRoots -Recurse -File -Include '*.dll','*.exe' | Where-Object {
            $_.FullName -like '*\bin\Release\*' -and $_.FullName -notmatch '\\ref\\'
          })

          if ($Binaries.Count -eq 0) {
            throw 'No C# binaries were found for code signing.'
          }

          foreach ($Binary in $Binaries) {
            $Signature = Get-AuthenticodeSignature -FilePath $Binary.FullName
            if ($Signature.Status -eq 'Valid') {
              Write-Host "Code signing skipped for already-signed binary: $($Binary.FullName)"
              continue
            }

            AzureSignTool @SignParams $Binary.FullName
            if ($LASTEXITCODE -ne 0) {
              throw "Code signing failed for $($Binary.FullName)."
            }
          }

      - name: Pack NuGet packages
        shell: pwsh
        env:
          PACKAGE_VERSION: ${{ needs.preflight.outputs.version }}
        run: |
          New-Item -Path dist/nuget -ItemType Directory -Force | Out-Null
          $packArgs = @('-c', 'Release', '--no-build', '-p:ContinuousIntegrationBuild=true', "-p:Version=$env:PACKAGE_VERSION", '-p:IncludeSymbols=true', '-p:SymbolPackageFormat=snupkg', '-o', 'dist/nuget')
          dotnet pack dotnet/src/Devolutions.Pinget.Core/Devolutions.Pinget.Core.csproj @packArgs
          dotnet pack dotnet/src/Devolutions.Pinget.PowerShell.Engine/Devolutions.Pinget.PowerShell.Engine.csproj @packArgs

      - name: Package PowerShell module
        shell: pwsh
        env:
          PACKAGE_VERSION: ${{ needs.preflight.outputs.version }}
        run: |
          $archivePath = Join-Path 'dist' "Devolutions.Pinget.Client.$env:PACKAGE_VERSION.zip"
          pwsh -NoLogo -NoProfile -File (Resolve-Path 'scripts/Build-PowerShellModule.ps1') -NoBuild -Version $env:PACKAGE_VERSION -OutputRoot dist/powershell-module -ArchivePath $archivePath -Clean

      - name: Upload package artifacts
        uses: actions/upload-artifact@v7
        with:
          name: csharp-nuget
          path: |
            dist/nuget/*.nupkg
            dist/nuget/*.snupkg
          if-no-files-found: error

      - name: Upload PowerShell module artifact
        uses: actions/upload-artifact@v7
        with:
          name: powershell-module
          path: dist/Devolutions.Pinget.Client.*.zip
          if-no-files-found: error

  cli-native-packages:
    name: CLI Native NuGet Packages
    runs-on: windows-latest
    needs:
      - preflight
      - rust-artifacts
    environment: ${{ needs.preflight.outputs.package-env }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: Download Rust release artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: pinget-*.zip
          path: artifacts/release-rust

      - name: Stage Rust CLI artifacts
        shell: pwsh
        run: |
          $Artifacts = @(
            @{ Archive = 'pinget-windows-x64.zip'; Rid = 'win-x64'; SourceBinary = 'pinget.exe'; PackageBinary = 'pinget.exe' },
            @{ Archive = 'pinget-windows-arm64.zip'; Rid = 'win-arm64'; SourceBinary = 'pinget.exe'; PackageBinary = 'pinget.exe' },
            @{ Archive = 'pinget-linux-x64.zip'; Rid = 'linux-x64'; SourceBinary = 'pinget'; PackageBinary = 'pinget' },
            @{ Archive = 'pinget-linux-arm64.zip'; Rid = 'linux-arm64'; SourceBinary = 'pinget'; PackageBinary = 'pinget' },
            @{ Archive = 'pinget-macos-x64.zip'; Rid = 'osx-x64'; SourceBinary = 'pinget'; PackageBinary = 'pinget' },
            @{ Archive = 'pinget-macos-arm64.zip'; Rid = 'osx-arm64'; SourceBinary = 'pinget'; PackageBinary = 'pinget' }
          )

          foreach ($Artifact in $Artifacts) {
            $archive = Get-ChildItem -Path artifacts/release-rust -Recurse -File -Filter $Artifact.Archive | Select-Object -First 1
            if ($null -eq $archive) {
              throw "Rust release archive not found: $($Artifact.Archive)"
            }

            $extractRoot = Join-Path $env:RUNNER_TEMP "pinget-$($Artifact.Rid)"
            Remove-Item -Path $extractRoot -Recurse -Force -ErrorAction SilentlyContinue
            New-Item -Path $extractRoot -ItemType Directory -Force | Out-Null
            Expand-Archive -Path $archive.FullName -DestinationPath $extractRoot -Force

            $binary = Join-Path $extractRoot $Artifact.SourceBinary
            if (-not (Test-Path -Path $binary -PathType Leaf)) {
              throw "Rust release binary not found after extracting $($Artifact.Archive): $binary"
            }

            $stageDir = Join-Path 'artifacts/cli/rust' $Artifact.Rid
            New-Item -Path $stageDir -ItemType Directory -Force | Out-Null
            Copy-Item -Path $binary -Destination (Join-Path $stageDir $Artifact.PackageBinary) -Force
          }

      - name: Build .NET NativeAOT CLI artifacts
        shell: pwsh
        env:
          PACKAGE_VERSION: ${{ needs.preflight.outputs.version }}
        run: |
          pwsh -NoLogo -NoProfile -File (Resolve-Path 'scripts\Build-CliNativeNuGetPackages.ps1') `
            -Package DotNet `
            -Version $env:PACKAGE_VERSION `
            -NoPack `
            -Clean

      - name: Install code signing tools
        shell: pwsh
        run: |
          dotnet tool install --global AzureSignTool

          $TestCertsUrl = "https://raw.githubusercontent.com/Devolutions/devolutions-authenticode/master/data/certs"
          Invoke-WebRequest -Uri "$TestCertsUrl/authenticode-test-ca.crt" -OutFile ".\authenticode-test-ca.crt"
          Import-Certificate -FilePath ".\authenticode-test-ca.crt" -CertStoreLocation "cert:\LocalMachine\Root"
          Remove-Item ".\authenticode-test-ca.crt" -ErrorAction SilentlyContinue | Out-Null

      - name: Code sign .NET NativeAOT CLI artifacts
        shell: pwsh
        env:
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          CODE_SIGNING_CERTIFICATE_NAME: ${{ secrets.CODE_SIGNING_CERTIFICATE_NAME }}
          CODE_SIGNING_CLIENT_ID: ${{ secrets.CODE_SIGNING_CLIENT_ID }}
          CODE_SIGNING_CLIENT_SECRET: ${{ secrets.CODE_SIGNING_CLIENT_SECRET }}
          CODE_SIGNING_KEYVAULT_URL: ${{ secrets.CODE_SIGNING_KEYVAULT_URL }}
          CODE_SIGNING_TIMESTAMP_SERVER: ${{ vars.CODE_SIGNING_TIMESTAMP_SERVER }}
        run: |
          $PackageEnv = '${{ needs.preflight.outputs.package-env }}'
          $DryRun = [System.Boolean]::Parse('${{ needs.preflight.outputs.dry-run }}')
          $RequiredVariables = @(
            'AZURE_TENANT_ID',
            'CODE_SIGNING_CERTIFICATE_NAME',
            'CODE_SIGNING_CLIENT_ID',
            'CODE_SIGNING_CLIENT_SECRET',
            'CODE_SIGNING_KEYVAULT_URL',
            'CODE_SIGNING_TIMESTAMP_SERVER'
          )
          $MissingVariables = @($RequiredVariables | Where-Object {
            [string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($_))
          })

          if ($MissingVariables.Count -gt 0) {
            $Message = "Code signing configuration missing: $($MissingVariables -join ', ')"
            if ($PackageEnv -eq 'publish-prod' -and -not $DryRun) {
              throw $Message
            }

            Write-Host "$Message; skipping code signing."
            return
          }

          $SignParams = @(
            'sign',
            '-kvt', $env:AZURE_TENANT_ID,
            '-kvu', $env:CODE_SIGNING_KEYVAULT_URL,
            '-kvi', $env:CODE_SIGNING_CLIENT_ID,
            '-kvs', $env:CODE_SIGNING_CLIENT_SECRET,
            '-kvc', $env:CODE_SIGNING_CERTIFICATE_NAME,
            '-tr', $env:CODE_SIGNING_TIMESTAMP_SERVER,
            '-v'
          )

          $Binaries = @(Get-ChildItem -Path 'artifacts/cli/dotnet-nativeaot' -Recurse -File -Include '*.exe')
          if ($Binaries.Count -eq 0) {
            throw 'No .NET NativeAOT CLI executables were found for code signing.'
          }

          foreach ($Binary in $Binaries) {
            AzureSignTool @SignParams $Binary.FullName
            if ($LASTEXITCODE -ne 0) {
              throw "Code signing failed for $($Binary.FullName)."
            }
          }

      - name: Pack CLI NuGet packages
        shell: pwsh
        env:
          PACKAGE_VERSION: ${{ needs.preflight.outputs.version }}
        run: |
          pwsh -NoLogo -NoProfile -File (Resolve-Path 'scripts\Build-CliNativeNuGetPackages.ps1') `
            -Version $env:PACKAGE_VERSION `
            -NoBuild `
            -Clean:$false

      - name: Upload CLI NuGet package artifacts
        uses: actions/upload-artifact@v7
        with:
          name: cli-nuget
          path: artifacts/cli-nuget/*.nupkg
          if-no-files-found: error

  create-tag:
    name: Create Tag
    runs-on: ubuntu-latest
    needs:
      - preflight
      - rust-artifacts
      - csharp-packages
      - cli-native-packages
    if: ${{ fromJSON(needs.preflight.outputs.dry-run) == false }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Ensure tag does not already exist
        shell: bash
        run: |
          if git ls-remote --exit-code --tags origin "refs/tags/${{ needs.preflight.outputs.tag-name }}" >/dev/null 2>&1; then
            echo "Tag ${{ needs.preflight.outputs.tag-name }} already exists on origin" >&2
            exit 1
          fi

      - name: Create and push tag
        shell: bash
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "${{ needs.preflight.outputs.tag-name }}" "${GITHUB_SHA}" -m "Release ${{ needs.preflight.outputs.tag-name }}"
          git push origin "${{ needs.preflight.outputs.tag-name }}"

  github-release:
    name: GitHub Release
    runs-on: ubuntu-latest
    needs:
      - preflight
      - create-tag
      - rust-artifacts
      - csharp-packages
      - cli-native-packages
    if: ${{ fromJSON(needs.preflight.outputs.dry-run) == false }}

    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: dist/release
          merge-multiple: true

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "${{ needs.preflight.outputs.tag-name }}" dist/release/*.zip dist/release/*.nupkg dist/release/*.snupkg --generate-notes --repo "${{ github.repository }}"

  publish-nuget:
    name: Publish NuGet
    runs-on: ubuntu-latest
    environment: ${{ needs.preflight.outputs.package-env }}
    permissions:
      contents: read
      id-token: write
    needs:
      - preflight
      - csharp-packages
      - cli-native-packages
      - create-tag
      - github-release
    if: ${{ fromJSON(needs.preflight.outputs.dry-run) == false && fromJSON(needs.preflight.outputs.publish-nuget) == true }}

    steps:
      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x

      - name: NuGet login (OIDC)
        id: nuget-login
        uses: NuGet/login@v1
        with:
          user: ${{ secrets.NUGET_BOT_USERNAME }}

      - name: Download package artifacts
        uses: actions/download-artifact@v8
        with:
          name: csharp-nuget
          path: dist/nuget

      - name: Download CLI package artifacts
        uses: actions/download-artifact@v8
        with:
          name: cli-nuget
          path: dist/nuget

      - name: Push packages to NuGet.org
        shell: pwsh
        run: |
          $Packages = @(Get-ChildItem -Path dist/nuget -Filter '*.nupkg')
          if ($Packages.Count -eq 0) {
            throw 'No NuGet packages were downloaded.'
          }

          foreach ($Package in $Packages) {
            dotnet nuget push $Package.FullName --api-key '${{ steps.nuget-login.outputs.NUGET_API_KEY }}' --source https://api.nuget.org/v3/index.json --skip-duplicate
            if ($LASTEXITCODE -ne 0) {
              throw "NuGet package publishing failed for $($Package.FullName)."
            }
          }

          $SymbolPackages = @(Get-ChildItem -Path dist/nuget -Filter '*.snupkg')
          foreach ($SymbolPackage in $SymbolPackages) {
            dotnet nuget push $SymbolPackage.FullName --api-key '${{ steps.nuget-login.outputs.NUGET_API_KEY }}' --source https://api.nuget.org/v3/index.json --skip-duplicate
            if ($LASTEXITCODE -ne 0) {
              throw "NuGet symbol package publishing failed for $($SymbolPackage.FullName)."
            }
          }

  publish-psgallery:
    name: Publish PowerShell Gallery
    runs-on: ubuntu-latest
    environment: ${{ needs.preflight.outputs.package-env }}
    env:
      PSGALLERY_NUGET_API_KEY: ${{ secrets.PSGALLERY_NUGET_API_KEY }}
    needs:
      - preflight
      - csharp-packages
      - create-tag
      - github-release
    if: ${{ fromJSON(needs.preflight.outputs.dry-run) == false && fromJSON(needs.preflight.outputs.publish-psgallery) == true }}

    steps:
      - name: Download PowerShell module artifact
        uses: actions/download-artifact@v8
        with:
          name: powershell-module
          path: dist/powershell-module

      - name: Publish Devolutions.Pinget.Client to PowerShell Gallery
        shell: pwsh
        run: |
          if ([string]::IsNullOrWhiteSpace($env:PSGALLERY_NUGET_API_KEY)) {
            throw 'PSGALLERY_NUGET_API_KEY is not configured.'
          }

          $archive = Get-ChildItem -Path dist/powershell-module -Filter 'Devolutions.Pinget.Client.*.zip' | Select-Object -First 1
          if ($null -eq $archive) {
            throw 'PowerShell module archive was not downloaded.'
          }

          $expandedRoot = Join-Path 'dist' 'powershell-gallery'
          Expand-Archive -Path $archive.FullName -DestinationPath $expandedRoot -Force
          $modulePath = (Resolve-Path (Join-Path $expandedRoot 'Devolutions.Pinget.Client')).Path

          Test-ModuleManifest -Path (Join-Path $modulePath 'Devolutions.Pinget.Client.psd1') | Out-Null
          Publish-Module -Path $modulePath -NuGetApiKey $env:PSGALLERY_NUGET_API_KEY -Verbose