libvirtualhid/.github/workflows/ci.yml

---
name: CI
permissions: {}

on:
  pull_request:
  push:
    branches:
      - master

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

env:
  PYTHON_VERSION: '3.14'

jobs:
  setup_release:
    name: Setup Release
    outputs:
      python_version: ${{ steps.ci_versions.outputs.python_version }}
      publish_release: ${{ steps.setup_release.outputs.publish_release }}
      release_body: ${{ steps.setup_release.outputs.release_body }}
      release_commit: ${{ steps.setup_release.outputs.release_commit }}
      release_generate_release_notes: ${{ steps.setup_release.outputs.release_generate_release_notes }}
      release_tag: ${{ steps.setup_release.outputs.release_tag }}
      release_version: ${{ steps.setup_release.outputs.release_version }}
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Export CI versions
        id: ci_versions
        run: echo "python_version=${PYTHON_VERSION}" >> "${GITHUB_OUTPUT}"

      - name: Setup Release
        id: setup_release
        uses: LizardByte/actions/actions/release_setup@d0ae7f82215a479fe2b74f4088c53ee6460513dd  # v2026.728.214955
        with:
          dotnet: true
          github_token: ${{ secrets.GITHUB_TOKEN }}

  driver:
    name: Windows Driver
    needs: setup_release
    permissions:
      contents: read
    uses: ./.github/workflows/ci-driver.yml
    with:
      azure_signing_account: ${{ vars.AZURE_SIGNING_ACCOUNT }}
      azure_signing_cert_profile: ${{ vars.AZURE_SIGNING_CERT_PROFILE }}
      azure_signing_endpoint: ${{ vars.AZURE_SIGNING_ENDPOINT }}
      publish_release: ${{ needs.setup_release.outputs.publish_release }}
      release_commit: ${{ needs.setup_release.outputs.release_commit }}
      release_version: ${{ needs.setup_release.outputs.release_version }}
    secrets:
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}

  build:
    name: Library
    needs:
      - driver
      - setup_release
    permissions:
      contents: read
    uses: ./.github/workflows/ci-build.yml
    with:
      python_version: ${{ needs.setup_release.outputs.python_version }}
      release_commit: ${{ needs.setup_release.outputs.release_commit }}
      release_version: ${{ needs.setup_release.outputs.release_version }}

  results:
    name: Coverage and Test Results
    if: >-
      always() &&
      (needs.build.result == 'success' || needs.build.result == 'failure') &&
      startsWith(github.repository, 'LizardByte/')
    needs: build
    permissions:
      contents: read
    uses: ./.github/workflows/ci-results.yml
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  release:
    name: Release
    if: >-
      always() &&
      needs.setup_release.outputs.publish_release == 'true' &&
      needs.build.result == 'success' &&
      needs.driver.result == 'success' &&
      startsWith(github.repository, 'LizardByte/')
    needs:
      - build
      - driver
      - setup_release
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Download Windows driver installer artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: windows-driver-installer
          path: windows-driver-installer

      - name: Prepare release artifact
        run: |
          mkdir -p artifacts
          cp windows-driver-installer/*.msi artifacts/

      - name: Validate release metadata
        env:
          RELEASE_COMMIT: ${{ needs.setup_release.outputs.release_commit }}
          RELEASE_TAG: ${{ needs.setup_release.outputs.release_tag }}
          RELEASE_VERSION: ${{ needs.setup_release.outputs.release_version }}
        run: |
          test -n "${RELEASE_TAG}"
          test -n "${RELEASE_VERSION}"
          test "${RELEASE_COMMIT}" = "${GITHUB_SHA}"
          test -s "artifacts/libvirtualhid-Windows-AMD64-driver-installer.msi"

      - name: Create/Update GitHub Release
        if: needs.setup_release.outputs.publish_release == 'true'
        uses: LizardByte/actions/actions/release_create@d0ae7f82215a479fe2b74f4088c53ee6460513dd  # v2026.728.214955
        with:
          allowUpdates: false
          body: ${{ needs.setup_release.outputs.release_body }}
          draft: false
          generateReleaseNotes: ${{ needs.setup_release.outputs.release_generate_release_notes }}
          name: ${{ needs.setup_release.outputs.release_tag }}
          prerelease: true
          tag: ${{ needs.setup_release.outputs.release_tag }}
          token: ${{ secrets.GH_BOT_TOKEN }}
          virustotal_api_key: ${{ secrets.VIRUSTOTAL_API_KEY }}