build.yml

# .github/workflows/build.yml
on:
  push:
    tags:
      - "20[0-9][0-9][0-1][0-9][0-3][0-9]"
      - "20[0-9][0-9][0-1][0-9][0-3][0-9].*"
    branches:
      - "**"
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-windows:
    runs-on: windows-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup MSYS2 (MINGW64)
        uses: msys2/setup-msys2@v2
        with:
          msystem: MINGW64
          release: true
          update: true
          install: >-
            mingw-w64-x86_64-gcc
            mingw-w64-x86_64-make
            mingw-w64-x86_64-binutils
            mingw-w64-x86_64-ntldd
            wget
            unzip
            tar
            p7zip

      - name: Download FFmpeg
        shell: msys2 {0}
        run: |
          set -euxo pipefail
          ./download_and_extract_windows_deps.sh ffmpeg

      - name: Download SDL2
        shell: msys2 {0}
        run: |
          set -euxo pipefail
          ./download_and_extract_windows_deps.sh sdl2 release-2.32.10

      - name: Download SDL2_ttf
        shell: msys2 {0}
        run: |
          set -euxo pipefail
          ./download_and_extract_windows_deps.sh sdl2_ttf release-2.24.0

      - name: Build
        shell: msys2 {0}
        run: |
          set -euxo pipefail
          mingw32-make -j$(nproc)

      - name: Copy runtime DLLs
        shell: msys2 {0}
        run: |
          set -euxo pipefail

          ntldd -R video-compare.exe | \
            awk '/mingw64/ {print $1}' | \
            sort -u | \
            while read dll; do
              cp -f "/mingw64/bin/$dll" .
            done

      - name: Verify build output
        shell: powershell
        run: |
          if (Test-Path "video-compare.exe") {
            $file = Get-Item "video-compare.exe"
            Write-Host "Build successful!"
            Write-Host "File: $($file.Name)"
            Write-Host "Size: $([math]::Round($file.Length / 1MB, 2)) MB"
            Write-Host "Date: $($file.LastWriteTime)"
          } else {
            Write-Error "Build failed: video-compare.exe not found"
            exit 1
          }

      - name: Strip executable
        shell: msys2 {0}
        run: |
          set -euxo pipefail
          strip video-compare.exe

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: video-compare-windows
          path: |
            video-compare.exe
            *.dll
            README.md
          retention-days: 90

  release-windows:
    if: startsWith(github.ref, 'refs/tags/')
    needs: build-windows
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write
    env:
      ZIP_NAME: video-compare-${{ github.ref_name }}-win10-x86_64.zip

    steps:
      - name: Download Windows build artifacts
        uses: actions/download-artifact@v8
        with:
          name: video-compare-windows

      - name: Package Windows release
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y zip

          mkdir -p release
          cp -f video-compare.exe README.md release/
          # Copy all DLLs (if any) from the Windows artifact bundle.
          shopt -s nullglob
          dlls=( *.dll )
          if [ "${#dlls[@]}" -gt 0 ]; then
            cp -f *.dll release/
          fi

          rm -f "$ZIP_NAME"
          (cd release && zip -r "../$ZIP_NAME" .)

          echo "Created $ZIP_NAME"
          ls -lh "$ZIP_NAME"

      - name: Generate artifact attestation (Windows zip)
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: ${{ env.ZIP_NAME }}

      - name: Install Syft (SBOM generator)
        shell: bash
        run: |
          set -euo pipefail
          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sudo sh -s -- -b /usr/local/bin
          syft version

      - name: Generate SBOM (SPDX JSON)
        shell: bash
        run: |
          set -euo pipefail
          syft dir:release -o spdx-json=sbom.spdx.json
          ls -lh sbom.spdx.json

      - name: Generate SBOM attestation (Windows zip)
        uses: actions/attest-sbom@v2
        with:
          subject-path: ${{ env.ZIP_NAME }}
          sbom-path: sbom.spdx.json

      - name: Create draft GitHub Release (if missing)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          tag="${GITHUB_REF_NAME}"
          repo="${GITHUB_REPOSITORY}"
          if ! gh release view "$tag" -R "$repo" >/dev/null 2>&1; then
            gh release create "$tag" -R "$repo" --draft --title "$tag" --notes "Release $tag"
          else
            echo "Release $tag already exists"
          fi

      - name: Upload Windows zip to GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          tag="${GITHUB_REF_NAME}"
          repo="${GITHUB_REPOSITORY}"
          gh release upload "$tag" -R "$repo" "$ZIP_NAME" --clobber=false
          gh release upload "$tag" -R "$repo" sbom.spdx.json --clobber=false

  build-linux:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential \
            libavformat-dev \
            libavcodec-dev \
            libavfilter-dev \
            libavutil-dev \
            libswscale-dev \
            libswresample-dev \
            libsdl2-dev \
            libsdl2-ttf-dev

      - name: Build
        run: make -j$(nproc)

      - name: Verify build output
        run: |
          if [ -f "video-compare" ]; then
            echo "Build successful!"
            ls -lh video-compare
            file video-compare
          else
            echo "Build failed: video-compare not found"
            exit 1
          fi

      - name: Strip executable
        run: |
          strip video-compare
          echo "Stripped executable. New size:"
          ls -lh video-compare

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: video-compare-linux
          path: |
            video-compare
            README.md
          retention-days: 90

  build-macos:
    runs-on: macos-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Install dependencies via Homebrew
        run: |
          brew install ffmpeg sdl2 sdl2_ttf

      - name: Build
        run: make -j$(nproc)

      - name: Verify build output
        run: |
          if [ -f "video-compare" ]; then
            echo "Build successful!"
            ls -lh video-compare
            file video-compare
          else
            echo "Build failed: video-compare not found"
            exit 1
          fi

      - name: Strip executable
        run: |
          strip video-compare
          echo "Stripped executable. New size:"
          ls -lh video-compare

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: video-compare-macos
          path: |
            video-compare
            README.md
          retention-days: 90