{% from '.github/workflows/pyinstaller-build.sh.j2' import build %}
{% from '.github/workflows/pyinstaller-test.ps1.j2' import test_powershell %}
{% from '.github/workflows/pyinstaller-test.sh.j2' import test_bash %}
jobs:
  build:
    runs-on: ${{ '{{' }} matrix.os }}
    steps:
      - uses: 'actions/checkout@{{ github_latest_action_tag('actions', 'checkout') }}'
{% if settings.private %}
      - name: 'Delete old caches and artifacts'
        env:
          GH_TOKEN: ${{ '{{' }} secrets.GITHUB_TOKEN }}
        run: |
          gh cache list --json id,createdAt -q '.[] | select((now - (.createdAt | sub("\\.[0-9]+"; "") | fromdateiso8601)) > 43200) | .key' | xargs -r -L1 gh cache delete
          gh api repos/${{ '{{' }} github.repository }}/actions/artifacts --paginate -q '.artifacts[] | select((now - (.created_at | sub("\\.[0-9]+"; "") | fromdateiso8601)) > 43200) | .id' | xargs -r -I{} gh api -X DELETE repos/${{ '{{' }} github.repository }}/actions/artifacts/{}
{% endif %}
{% if settings.package_manager == 'uv' %}
      - name: 'Install yq'
        run: 'pipx install yq'
      - name: 'Install uv'
        uses: 'astral-sh/setup-uv@{{ github_latest_action_tag('astral-sh', 'setup-uv') }}'
{% else %}
      - name: 'Install Poetry'
        run: 'pipx install poetry yq'
{% endif %}
      - name: 'Set up Python'
        uses: 'actions/setup-python@{{ github_latest_action_tag('actions', 'setup-python') }}'
        with:
{% if settings.package_manager != 'uv' %}
          cache: 'poetry'
{% endif %}
          python-version: '3.13'
{% if settings.pyinstaller.vcpkg.enabled %}
  {% for os_name, target in settings.pyinstaller.vcpkg.targets.items() %}
      - if: matrix.os == '{{ os_name }}'
        name: 'Cache vcpkg installed packages'
        uses: 'actions/cache@{{ github_latest_action_tag('actions', 'cache') }}'
        with:
          key: vcpkg-{{ target.triplet }}-{{ target.packages | join('-') }}-${{ '{{' }} hashFiles('.github/workflows/pyinstaller.yml') }}
          path: '~/vcpkg/installed'
      - if: matrix.os == '{{ os_name }}'
        name: 'Set up vcpkg'
        run: |
          $cachedInstalled = $null
          if (Test-Path "$env:USERPROFILE\vcpkg\installed") {
            $cachedInstalled = "$env:TEMP\vcpkg-installed"
            Move-Item "$env:USERPROFILE\vcpkg\installed" $cachedInstalled
            Remove-Item -Recurse -Force "$env:USERPROFILE\vcpkg"
          }
          git clone --depth 1 https://github.com/microsoft/vcpkg "$env:USERPROFILE\vcpkg"
          if ($cachedInstalled) {
            Move-Item $cachedInstalled "$env:USERPROFILE\vcpkg\installed"
          }
          & "$env:USERPROFILE\vcpkg\bootstrap-vcpkg.bat" -disableMetrics
    {% for pkg in target.packages %}
          & "$env:USERPROFILE\vcpkg\vcpkg.exe" install {{ pkg }} --triplet {{ target.triplet }}
    {% endfor %}

          $installed = "$env:USERPROFILE\vcpkg\installed\{{ target.triplet }}"

          Add-Content -Path $env:GITHUB_PATH -Value "$env:USERPROFILE\vcpkg"
          Add-Content -Path $env:GITHUB_PATH -Value "$installed\tools\pkgconf"
          Add-Content -Path $env:GITHUB_ENV -Value "VCPKG_ROOT=$env:USERPROFILE\vcpkg"
          Add-Content -Path $env:GITHUB_ENV -Value "VCPKG_DEFAULT_TRIPLET={{ target.triplet }}"
          Add-Content -Path $env:GITHUB_ENV -Value "OPENSSL_DIR=$installed"
          Add-Content -Path $env:GITHUB_ENV -Value "PKG_CONFIG_PATH=$installed\lib\pkgconfig"
          Add-Content -Path $env:GITHUB_ENV -Value "CMAKE_PREFIX_PATH=$installed"
          Add-Content -Path $env:GITHUB_ENV -Value "LIB=$installed\lib"
          Add-Content -Path $env:GITHUB_ENV -Value "INCLUDE=$installed\include"
        shell: 'pwsh'
  {% endfor %}
{% endif %}
{% if settings.package_manager == 'uv' %}
      - name: 'Install dependencies (uv)'
        run: |
          uv sync{{ ' ' + settings.pyinstaller.uv_sync_args | join(' ') if settings.pyinstaller.uv_sync_args else '' }}
          uv pip install pyinstaller
        shell: 'bash'
{% else %}
      - name: 'Install dependencies (Poetry)'
        run: |
          poetry install
          poetry run -- pip install pyinstaller
        shell: 'bash'
{% endif %}
      - name: 'Build with PyInstaller'
        run: |
          {{ build(settings) | indent(10) | trim }}
        shell: 'bash'
{% if settings.supported_platforms == 'all' or 'windows' in settings.supported_platforms %}
      - if: matrix.os == 'windows-latest' || matrix.os == 'windows-11-arm'
        name: 'Test binary'
        run: |
          {{ test_powershell(settings.pyinstaller.test_commands) | indent(10) | trim }}
{% endif %}
{% if settings.supported_platforms == 'all' or 'macos' in settings.supported_platforms %}
      - if: matrix.os == 'macos-latest' || matrix.os == 'macos-15-intel'
        name: 'Test binary'
        run: |
          {{ test_bash(settings.pyinstaller.test_commands) | indent(10) | trim }}
{% endif %}
      - name: 'Upload Artifacts'
        uses: 'actions/upload-artifact@{{ github_latest_action_tag('actions', 'upload-artifact') }}'
        with:
          if-no-files-found: error
          name: {{ settings.github_project_name }}-binaries-${{ '{{' }} matrix.suffix }}
          path: |
            ${{ '{{' }} matrix.dist_path }}
  {% if not settings.private %}
      - name: 'Attest'
        uses: 'actions/attest@{{ github_latest_action_tag('actions', 'attest') }}'
        with:
          subject-path: '${{ '{{' }} matrix.dist_path }}'
      - name: 'Generate SBOM'
        uses: 'anchore/sbom-action@{{ github_latest_action_tag('anchore', 'sbom-action') }}'
        env:
          SYFT_SOURCE_NAME: '{{ settings.github_project_name }}'
          SYFT_SOURCE_VERSION: ${{ '{{' }} github.ref_name }}
        with:
          path: 'dist/'
          output-file: 'sbom.spdx.json'
          upload-artifact: false
      - name: 'Attest SBOM'
        uses: 'actions/attest@{{ github_latest_action_tag('actions', 'attest') }}'
        with:
          subject-path: '${{ '{{' }} matrix.dist_path }}'
          sbom-path: 'sbom.spdx.json'
  {% endif %}
{% if settings.supported_platforms == 'all' or 'macos' in settings.supported_platforms %}
      - if: (matrix.os == 'macos-latest' || matrix.os == 'macos-15-intel') && github.ref_type == 'tag'
        name: 'Zip files'
        run: |
          rm -fR _out
          mkdir _out
          zip -j _out/{{ settings.github_project_name }}-${{ '{{' }} github.ref_name }}-${{ '{{' }} matrix.suffix }}.zip ${{ '{{' }} matrix.dist_path }}
{% endif %}
{% if settings.supported_platforms == 'all' or 'windows' in settings.supported_platforms %}
      - if: (matrix.os == 'windows-latest' || matrix.os == 'windows-11-arm') && github.ref_type == 'tag'
        name: 'Zip files'
        run: |
          Remove-Item -Force _out -ErrorAction Continue
          New-Item -ItemType Directory -Name _out
          Compress-Archive -Path ${{ '{{' }} matrix.dist_path }} -DestinationPath _out/{{ settings.github_project_name }}-${{ '{{' }} github.ref_name }}-${{ '{{' }} matrix.suffix }}.zip
        shell: pwsh
{% endif %}
  {% if not settings.private %}
      - if: github.ref_type == 'tag'
        name: 'Attest'
        uses: 'actions/attest@{{ github_latest_action_tag('actions', 'attest') }}'
        with:
          subject-path: '_out/*.zip'
      - if: github.ref_type == 'tag'
        name: 'Attest SBOM'
        uses: 'actions/attest@{{ github_latest_action_tag('actions', 'attest') }}'
        with:
          subject-path: '_out/*.zip'
          sbom-path: 'sbom.spdx.json'
  {% endif %}
      - if: github.ref_type == 'tag'
        name: Upload package
        uses: softprops/action-gh-release@{{ github_latest_action_tag('softprops', 'action-gh-release') }}
        with:
          draft: true
          fail_on_unmatched_files: true
          files: |
            _out/*.zip
    strategy:
      matrix:
        include:
{% if settings.supported_platforms == 'all' or 'macos' in settings.supported_platforms %}
          - os: 'macos-15-intel'
            dist_path: 'dist/*'
            suffix: 'mac-x86_64'
          - os: 'macos-latest'
            dist_path: 'dist/*'
            suffix: 'mac-arm64'
{% endif %}
{% if settings.supported_platforms == 'all' or 'windows' in settings.supported_platforms %}
          - os: 'windows-latest'
            dist_path: 'dist/*.exe'
            suffix: 'win-x86_64'
  {% if not settings.private %}
          - os: 'windows-11-arm'
            dist_path: 'dist/*.exe'
            suffix: 'win-arm64'
  {% endif %}
{% endif %}
name: 'PyInstaller'
'on':
  push:
    branches:
      - 'master'
    paths:
      - '**/*.py'
      - '**/*.pyi'
      - '.github/workflows/pyinstaller.yml'
      - 'pyproject.toml'
      - 'uv.lock'
      - 'poetry.lock'
    tags:
      - 'v*.*.*'
permissions:
{% if settings.private %}
  actions: 'write'
{% endif %}
  attestations: 'write'
  contents: 'write'
  id-token: 'write'
