release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

jobs:
  package:
    name: Build portable Windows release
    runs-on: windows-latest
    timeout-minutes: 40

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'

      - name: Restore
        run: dotnet restore .\PtpLabClock.sln

      - name: Test
        run: dotnet test .\PtpLabClock.sln -c Release --no-restore --logger trx --results-directory TestResults

      - name: Protocol smoke validation
        run: dotnet run --project .\src\PtpLabClock.Console --configuration Release -- --validate-protocol --domain 0 --export-pcap .\TestResults\ptp-validation.pcap

      - name: Publish portable single EXE files
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $publishRoot = Resolve-Path "."
          New-Item -ItemType Directory -Path .\artifacts -Force | Out-Null
          New-Item -ItemType Directory -Path .\publish\app -Force | Out-Null
          New-Item -ItemType Directory -Path .\publish\console -Force | Out-Null

          $singleFileProps = @(
            "-p:PublishSingleFile=true",
            "-p:SelfContained=true",
            "-p:IncludeNativeLibrariesForSelfExtract=true",
            "-p:EnableCompressionInSingleFile=true",
            "-p:PublishReadyToRun=false",
            "-p:PublishTrimmed=false",
            "-p:DebugType=None",
            "-p:DebugSymbols=false"
          )

          dotnet publish .\src\PtpLabClock.App\PtpLabClock.App.csproj -c Release -r win-x64 --self-contained true @singleFileProps -o .\publish\app
          dotnet publish .\src\PtpLabClock.Console\PtpLabClock.Console.csproj -c Release -r win-x64 --self-contained true @singleFileProps -o .\publish\console

          Copy-Item .\publish\app\PtpLabClock.App.exe .\artifacts\PtpLabClock.App.win-x64.portable.exe -Force
          Copy-Item .\publish\console\PtpLabClock.Console.exe .\artifacts\PtpLabClock.Console.win-x64.portable.exe -Force

          if (-not (Test-Path .\artifacts\PtpLabClock.App.win-x64.portable.exe)) { throw "App portable EXE was not created." }
          if (-not (Test-Path .\artifacts\PtpLabClock.Console.win-x64.portable.exe)) { throw "Console portable EXE was not created." }

      - name: Create optional ZIP packages with notices
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $packages = @(
            @{ Name = "PtpLabClock.App.win-x64.portable"; Exe = ".\artifacts\PtpLabClock.App.win-x64.portable.exe" },
            @{ Name = "PtpLabClock.Console.win-x64.portable"; Exe = ".\artifacts\PtpLabClock.Console.win-x64.portable.exe" }
          )

          foreach ($package in $packages) {
            $dir = Join-Path ".\artifacts" $package.Name
            New-Item -ItemType Directory -Path $dir -Force | Out-Null
            Copy-Item $package.Exe (Join-Path $dir (Split-Path $package.Exe -Leaf)) -Force
            Copy-Item .\LICENSE $dir -Force
            Copy-Item .\NOTICE $dir -Force
            Copy-Item .\THIRD-PARTY-NOTICES.md $dir -Force
            Copy-Item .\docs\release-readme.md (Join-Path $dir "README-FIRST.md") -Force
            Compress-Archive -Path (Join-Path $dir "*") -DestinationPath ".\artifacts\$($package.Name).zip" -Force
          }

      - name: Generate checksums and SPDX-style release manifest
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $releaseFiles = Get-ChildItem .\artifacts -File | Where-Object { $_.Extension -in ".exe", ".zip" } | Sort-Object Name
          $checksums = foreach ($file in $releaseFiles) {
            $hash = Get-FileHash $file.FullName -Algorithm SHA256
            "$($hash.Hash.ToLowerInvariant())  $($file.Name)"
          }
          $checksums | Set-Content .\artifacts\checksums.txt -Encoding UTF8

          $sbom = [ordered]@{
            spdxVersion = "SPDX-2.3"
            dataLicense = "CC0-1.0"
            SPDXID = "SPDXRef-DOCUMENT"
            name = "Process Bus Timing Lab portable Windows release manifest"
            documentNamespace = "https://github.com/masarray/PtpLabClock/releases/$env:GITHUB_RUN_ID"
            creationInfo = [ordered]@{
              created = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
              creators = @("Tool: GitHub Actions", "Organization: Process Bus Timing Lab")
            }
            packages = @(
              [ordered]@{ SPDXID = "SPDXRef-Package-PtpLabClock"; name = "PtpLabClock"; downloadLocation = "NOASSERTION"; filesAnalyzed = $false; licenseConcluded = "Apache-2.0"; licenseDeclared = "Apache-2.0"; copyrightText = "Copyright (C) 2026 Ari Sulistiono" },
              [ordered]@{ SPDXID = "SPDXRef-Package-SharpPcap"; name = "SharpPcap"; versionInfo = "6.3.1"; downloadLocation = "https://www.nuget.org/packages/SharpPcap/6.3.1"; filesAnalyzed = $false; licenseConcluded = "MIT"; licenseDeclared = "MIT"; copyrightText = "NOASSERTION" }
            )
            releaseArtifacts = @($releaseFiles | ForEach-Object { [ordered]@{ name = $_.Name; sha256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLowerInvariant(); size = $_.Length } })
          }
          $sbom | ConvertTo-Json -Depth 8 | Set-Content .\artifacts\PtpLabClock.release-sbom.spdx.json -Encoding UTF8

      - name: Generate polished release notes
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $version = if ($env:GITHUB_REF_NAME) { $env:GITHUB_REF_NAME } else { "manual-build" }
          $createdUtc = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
          $appHash = (Get-FileHash .\artifacts\PtpLabClock.App.win-x64.portable.exe -Algorithm SHA256).Hash.ToLowerInvariant()
          $consoleHash = (Get-FileHash .\artifacts\PtpLabClock.Console.win-x64.portable.exe -Algorithm SHA256).Hash.ToLowerInvariant()

          $releaseNotes = @(
            "## Process Bus Timing Lab $version",
            "",
            "Windows PTP lab simulator and timing-health monitor for IEC 61850 FAT, SAT, analyzer validation, and Process Bus troubleshooting.",
            "",
            "### Downloads",
            "",
            "| Asset | Purpose |",
            "|---|---|",
            "| ``PtpLabClock.App.win-x64.portable.exe`` | Desktop dashboard, self-contained single-file app. |",
            "| ``PtpLabClock.Console.win-x64.portable.exe`` | CLI validation, RAW self-test, passive monitor, and scripts. |",
            "| ``PtpLabClock.App.win-x64.portable.zip`` | App EXE plus license, notices, and release README. |",
            "| ``PtpLabClock.Console.win-x64.portable.zip`` | Console EXE plus license, notices, and release README. |",
            "| ``checksums.txt`` | SHA256 verification for release assets. |",
            "| ``PtpLabClock.release-sbom.spdx.json`` | SPDX-style dependency and artifact manifest. |",
            "| ``ptp-validation.pcap`` | Protocol smoke-validation PCAP generated during release. |",
            "",
            "### Verification",
            "",
            "````powershell",
            "Get-FileHash .\PtpLabClock.App.win-x64.portable.exe -Algorithm SHA256",
            "Get-Content .\checksums.txt",
            "````",
            "",
            "Expected direct EXE hashes from this release build:",
            "",
            "````text",
            "$appHash  PtpLabClock.App.win-x64.portable.exe",
            "$consoleHash  PtpLabClock.Console.win-x64.portable.exe",
            "````",
            "",
            "### RAW NIC requirements",
            "",
            "RAW NIC mode requires Npcap and may require Administrator privileges. Prefer a wired Ethernet adapter or controlled lab TAP/mirror port. Wi-Fi, VPN, loopback, and virtual adapters may behave inconsistently.",
            "",
            "### Known limitations",
            "",
            "- Portable EXE artifacts are not code-signed yet and may trigger Windows SmartScreen on first run.",
            "- RAW NIC mode depends on Npcap, adapter driver support, and local security policy.",
            "- Local self-capture failure does not always prove packet transmission failed; verify with external capture when possible.",
            "- Software timestamps are diagnostic only and are not hardware-timestamped timing evidence.",
            "- This project is not a certified PTP grandmaster, GPS clock, or relay-acceptance timing source.",
            "",
            "### Safety boundary",
            "",
            "Use this tool in controlled lab, FAT, SAT preparation, analyzer validation, and approved engineering networks. Do not publish synthetic traffic into operational protection networks without explicit engineering approval.",
            "",
            "_Generated by GitHub Actions at $createdUtc._"
          )

          $releaseNotes | Set-Content .\artifacts\release-notes.md -Encoding UTF8

      - name: Upload release build artifact
        uses: actions/upload-artifact@v4
        with:
          name: portable-release-packages
          path: |
            .\artifacts\*.exe
            .\artifacts\*.zip
            .\artifacts\checksums.txt
            .\artifacts\PtpLabClock.release-sbom.spdx.json
            .\artifacts\release-notes.md
            .\TestResults\ptp-validation.pcap

      - name: Publish GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            .\artifacts\*.exe
            .\artifacts\*.zip
            .\artifacts\checksums.txt
            .\artifacts\PtpLabClock.release-sbom.spdx.json
            .\artifacts\release-notes.md
            .\TestResults\ptp-validation.pcap
          body_path: .\artifacts\release-notes.md