Files/.github/workflows/cd-sideload-stable.yml

# Copyright (c) Files Community
# Licensed under the MIT License.

# Abstract:
#  Deploys Files (Sideload).
#
# Workflow:
#  1. Configure manifest, logo and secrets
#  2. Restore, build and package Files
#  3. Publish the appinstaller to files.community
#  4. Sign the package
#  5. Publish the package to Azure

name: Files CD (Sideload Stable)

on:
  workflow_dispatch:

jobs:
  build:
    runs-on: windows-2025-vs2026
    environment: Deployments
    strategy:
      fail-fast: false
      matrix:
        configuration: [Release]
        platform: [x64]
    env:
      SOLUTION_NAME:              'Files.slnx'
      CONFIGURATION:              '${{ matrix.configuration }}'
      PLATFORM:                   '${{ matrix.platform }}'
      APPX_BUNDLE_PLATFORMS:      'x64|arm64'
      WORKING_DIR:                '${{ github.workspace }}' # D:\a\Files\Files\
      ARTIFACTS_STAGING_DIR:      '${{ github.workspace }}\artifacts'
      APPX_PACKAGE_DIR:           '${{ github.workspace }}\artifacts\AppxPackages\'
      APP_PROJECT_PATH:            'src\Files.App\Files.App.csproj'
      PACKAGE_MANIFEST_PATH:      'src\Files.App\Package.appxmanifest'
      LAUNCHER_PROJECT_PATH:      'src\Files.App.Launcher\Files.App.Launcher.vcxproj'
      TEST_PROJECT_PATH:          'tests\Files.InteractionTests\Files.InteractionTests.csproj'
      APP_INSTALLER_SIDELOAD_URL: 'https://cdn.files.community/files/stable/'

    steps:
    - name: Checkout the repository
      uses: actions/checkout@v4
    - name: Setup MSBuild
      uses: microsoft/setup-msbuild@v2
    - name: Setup NuGet
      uses: NuGet/setup-nuget@v2
    - name: Setup .NET
      uses: actions/setup-dotnet@v4
      with:
        global-json-file: global.json

    - name: Configure the package manifest, logo, and secrets
      shell: pwsh
      run: |
        . './.github/scripts/Configure-AppxManifest.ps1' `
          -Branch "SideloadStable" `
          -PackageManifestPath "$env:PACKAGE_MANIFEST_PATH" `
          -Publisher "$env:SIDELOAD_PUBLISHER_SECRET" `
          -WorkingDir "$env:WORKING_DIR" `
          -SecretBingMapsKey "$env:SECRET_BINGMAPS_KEY" `
          -SecretSentry "$env:SECRET_SENTRY" `
          -SecretGitHubOAuthClientId "$env:SECRET_GITHUB_OAUTH_CLIENT_ID"
      env:
        SIDELOAD_PUBLISHER_SECRET: ${{ secrets.SIDELOAD_PUBLISHER_SECRET }}
        SECRET_BINGMAPS_KEY: ${{ secrets.BING_MAPS_SECRET }}
        SECRET_SENTRY: ${{ secrets.SENTRY_SECRET }}
        SECRET_GITHUB_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
  
    - name: Use Windows SDK Preview
      shell: cmd
      run: |
        for /f %%a in ('dir /b /a:d %localappdata%\Microsoft\VisualStudio\17*') do echo UsePreviews=True>%localappdata%\Microsoft\VisualStudio\%%a\sdk.txt

    - name: Restore Files
      shell: pwsh
      run: |
        msbuild $env:SOLUTION_NAME `
        -t:Restore `
        -p:Platform=$env:PLATFORM `
        -p:Configuration=$env:CONFIGURATION `
        -p:PublishReadyToRun=true `
        -v:quiet

    - name: Restore NuGet Packages for Launcher Project
      shell: pwsh
      run: |
        nuget restore "$env:LAUNCHER_PROJECT_PATH" `
          -SolutionDirectory "$env:WORKING_DIR" `
          -Verbosity detailed
    
    - name: Build launcher project
      shell: pwsh
      run: |
        msbuild "$env:LAUNCHER_PROJECT_PATH" `
        -t:Build `
        -p:Platform=$env:PLATFORM `
        -p:Configuration=$env:CONFIGURATION `
        -v:quiet

    - name: Sign launcher EXE with Azure Trusted Signing
      uses: azure/trusted-signing-action@v0.4.0
      with:
        azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
        azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
        endpoint: https://eus.codesigning.azure.net/
        trusted-signing-account-name: ${{ secrets.SIGNING_ACCOUNT_NAME }}
        certificate-profile-name: ${{ secrets.SIGNING_PROFILE_NAME }}
        files-folder: ${{ github.workspace }}\src\Files.App\Assets\FilesOpenDialog
        files-folder-filter: "*.exe"
        files-folder-recurse: false
        file-digest: SHA256
        timestamp-rfc3161: http://timestamp.acs.microsoft.com
        timestamp-digest: SHA256

    - name: Build & package Files
      shell: pwsh
      run: |
        $platforms = "$env:APPX_BUNDLE_PLATFORMS" -split '\|'
        foreach ($plat in $platforms) {
          Write-Host "Building for $plat..."
          msbuild "$env:APP_PROJECT_PATH" `
            -t:Build `
            -p:Platform=$plat `
            -p:Configuration=$env:CONFIGURATION `
            -p:AppxPackageDir="$env:APPX_PACKAGE_DIR" `
            -p:AppxBundle=Never `
            -p:GenerateAppxPackageOnBuild=true `
            -p:UapAppxPackageBuildMode=Sideload `
            -v:quiet
        }

    - name: Create msixbundle and appinstaller
      shell: pwsh
      run: |
        . './.github/scripts/Create-MsixBundle.ps1' `
          -AppxPackageDir "$env:APPX_PACKAGE_DIR" `
          -BundleName "Files.Package" `
          -PackageManifestPath "$env:PACKAGE_MANIFEST_PATH" `
          -AppInstallerUri "$env:APP_INSTALLER_SIDELOAD_URL" `
          -BuildMode "Sideload"

    - name: Remove empty files from the packages
      shell: bash
      run: find $ARTIFACTS_STAGING_DIR -empty -delete

    - name: Sign Files with Azure Trusted Signing
      uses: azure/trusted-signing-action@v0.4.0
      with:
        azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
        azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
        endpoint: https://eus.codesigning.azure.net/
        trusted-signing-account-name: ${{ secrets.SIGNING_ACCOUNT_NAME }}
        certificate-profile-name: ${{ secrets.SIGNING_PROFILE_NAME }}
        files-folder: ${{ env.APPX_PACKAGE_DIR }}
        files-folder-filter: msixbundle
        files-folder-recurse: true
        files-folder-depth: 4
        file-digest: SHA256
        timestamp-rfc3161: http://timestamp.acs.microsoft.com
        timestamp-digest: SHA256

    - name: Upload packages to Cloudflare
      uses: ryand56/r2-upload-action@latest
      with:
        r2-account-id: ${{ secrets.R2_ACCOUNT_ID }}
        r2-access-key-id: ${{ secrets.R2_ACCESS_KEY_ID }}
        r2-secret-access-key: ${{ secrets.R2_SECRET_ACCESS_KEY }}
        r2-bucket: ${{ secrets.R2_BUCKET }}
        source-dir: ${{ env.APPX_PACKAGE_DIR }}
        destination-dir: ./files/stable
          
    - name: Upload the packages to GitHub Actions
      uses: actions/upload-artifact@v4
      with:
        name: 'Appx Packages (${{ env.CONFIGURATION }}, ${{ env.PLATFORM }})'
        path: ${{ env.ARTIFACTS_STAGING_DIR }}