3proxy/.github/workflows/build-watcom.yml

name: Build Win32 3proxy-lite with Watcom

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  ci:
    permissions:
      contents: write
      id-token: write
      attestations: write
    name: "${{ matrix.target }}"
    strategy:
      matrix:
        target:
          - windows-2022
    runs-on: ${{ matrix.target }}
    steps:
    - uses: actions/checkout@v7
#    - name: configure
#      run: ./configure
    - name: Setup Open Watcom
      uses: open-watcom/setup-watcom@v1
    - name: set date
      run: |
       $NOW = Get-Date -Format "yyMMddHHmmss"
       echo "now: $NOW"
       $RELEASE = Get-Content -Path "RELEASE" -Raw
       echo "release: $RELEASE"
       echo "RELEASE=$RELEASE" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
       echo "VERSION=/D `"VERSION=\`"3proxy-$RELEASE\`"`"" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
       echo "BUILDDATE=/D `"BUILDDATE=\`"$NOW\`"`"" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append       
    - name: make Watcom
      shell: cmd
      run: |
       echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c
       nmake /F Makefile.watcom       
    - name: Decode Certificate
      shell: pwsh
      run: |
       $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}")
       [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte)       
    - name: Sign
      shell: pwsh
      run: |
       $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName
       & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}" /tr http://timestamp.digicert.com /td sha256 /fd sha256 "bin\3proxy.exe"
       & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}" /tr http://timestamp.digicert.com /td sha256 /fd sha256 "bin\3proxy_crypt.exe"       
    - name: make dist dir
      shell: cmd
      run: |
       mkdir dist
       mkdir dist\3proxy
       mkdir dist\3proxy\bin
       mkdir dist\3proxy\cfg
       mkdir dist\3proxy\cfg\sql
       mkdir dist\3proxy\doc
       mkdir dist\3proxy\doc\ru
       mkdir dist\3proxy\doc\html
       mkdir dist\3proxy\doc\html\plugins
       mkdir dist\3proxy\doc\html\man5
       mkdir dist\3proxy\doc\html\man8
       mkdir dist\3proxy\doc\html\devel
       copy bin\3proxy.exe dist\3proxy\bin\
       copy bin\*.dll dist\3proxy\bin\
       copy bin\3proxy_crypt.exe  dist\3proxy\bin\
       copy cfg\*.* dist\3proxy\cfg\
       copy cfg\sql\*.*  dist\3proxy\cfg\sql\
       copy doc\ru\*.*  dist\3proxy\doc\ru\
       copy doc\html\*.* dist\3proxy\doc\html\
       copy doc\html\plugins\*.* dist\3proxy\doc\html\plugins\
       copy doc\html\man8\*.* dist\3proxy\doc\html\man8\
       copy doc\html\man5\*.* dist\3proxy\doc\html\man5\
       copy doc\html\devel\*.* dist\3proxy\doc\html\devel\
       copy copying dist\3proxy\
       copy authors dist\3proxy\
       copy README.md dist\3proxy\
       copy rus.3ps dist\3proxy\       
    - name: Get artifact
      uses: actions/upload-artifact@v7
      with:
       name: "3proxy-${{ env.RELEASE }}-lite"
       path: dist/
    - name: Create zip
      if: github.event_name == 'release'
      shell: pwsh
      run: Compress-Archive -Path dist/* -DestinationPath 3proxy-${{ env.RELEASE }}-lite.zip
    - name: Checksums and detached signature
      if: github.event_name == 'release'
      shell: bash
      env:
       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      run: |
       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
       sha256sum *.zip > SHA256SUMS-win-lite
       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
           -u "$KEYID" --armor --detach-sign SHA256SUMS-win-lite
       sha256sum -c SHA256SUMS-win-lite       
    - name: Attest build provenance
      if: github.event_name == 'release'
      uses: actions/attest-build-provenance@v2
      with:
        subject-path: |
          *.zip          
    - name: Upload to release
      if: github.event_name == 'release'
      shell: bash
      env:
       GH_TOKEN: ${{ github.token }}
       TAG: ${{ github.event.release.tag_name }}
      run: gh release upload "$TAG" *.zip SHA256SUMS-win-lite SHA256SUMS-win-lite.asc