build-baseline.yml

name: build-baseline

on:
  pull_request:
    branches:
      - develop
      - main
  push:
    branches:
      - develop
      - main
    tags:
      - "v*"

permissions:
  contents: read

env:
  GIT_CONFIG_COUNT: "1"
  GIT_CONFIG_KEY_0: init.defaultBranch
  GIT_CONFIG_VALUE_0: develop

jobs:
  build-windows-native:
    name: build / windows / amd64
    runs-on: windows-2025
    strategy:
      fail-fast: false
    permissions:
      contents: read
    env:
      BANDSCOPE_ARTIFACT_OS: windows
      BANDSCOPE_ARTIFACT_ARCH: amd64
      BANDSCOPE_TARGET_TRIPLE: x86_64-pc-windows-msvc
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22.22.3
          cache: npm
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"
      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          version: "0.8.6"
          enable-cache: false
      - name: Install Rust stable
        run: rustup toolchain install stable --profile minimal
      - name: Add Windows target
        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain stable
      - name: Verify Windows antivirus baseline
        shell: pwsh
        run: |
          function Write-AntivirusEvidence($message) {
            Write-Host $message
            if ($env:GITHUB_STEP_SUMMARY) {
              Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value $message
            }
          }

          if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) {
            $status = Get-MpComputerStatus
            Write-AntivirusEvidence "Antivirus check: Defender status AntivirusEnabled=$($status.AntivirusEnabled) RealTimeProtectionEnabled=$($status.RealTimeProtectionEnabled)."
            if ($status.AntivirusEnabled) {
              return
            }
            Write-AntivirusEvidence "Antivirus check: Defender telemetry is present but antivirus is not reported as enabled on this hosted runner."
          }

          $products = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue
          if ($products) {
            Write-AntivirusEvidence "Antivirus check: SecurityCenter2 reported at least one antivirus product."
            return
          }

          $defenderService = Get-Service -Name WinDefend -ErrorAction SilentlyContinue
          if ($defenderService -and $defenderService.Status -in @('Running', 'StartPending')) {
            Write-AntivirusEvidence "Antivirus check: WinDefend service is present and active."
            return
          }

          Write-AntivirusEvidence "Antivirus check: no explicit antivirus telemetry was available on this hosted runner."
      - name: Install node dependencies
        run: npm ci
      - name: Sync Python dependencies
        run: uv sync --project services/analysis-engine --group dev --frozen
      - name: Build frontend
        run: npm run build --workspace @bandscope/desktop
      - name: Build native shell
        run: npm exec --workspace @bandscope/desktop -- tauri build --target $env:BANDSCOPE_TARGET_TRIPLE --bundles nsis
      - name: Package Windows amd64 artifact
        run: python scripts/release/package_desktop_artifact.py
      - name: Upload Windows amd64 artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bandscope-windows-amd64-${{ github.sha }}
          path: artifacts/*

  build-windows-arm64:
    name: build / windows / arm64
    runs-on: windows-11-arm
    strategy:
      fail-fast: false
    permissions:
      contents: read
    env:
      BANDSCOPE_ARTIFACT_OS: windows
      BANDSCOPE_ARTIFACT_ARCH: arm64
      BANDSCOPE_TARGET_TRIPLE: aarch64-pc-windows-msvc
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22.22.3
          cache: npm
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"
      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          version: "0.8.6"
          enable-cache: false
      - name: Install Rust stable
        run: rustup toolchain install stable --profile minimal
      - name: Add Windows arm target
        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain stable
      - name: Verify Windows antivirus baseline
        shell: pwsh
        run: |
          function Write-AntivirusEvidence($message) {
            Write-Host $message
            if ($env:GITHUB_STEP_SUMMARY) {
              Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value $message
            }
          }

          if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) {
            $status = Get-MpComputerStatus
            Write-AntivirusEvidence "Antivirus check: Defender status AntivirusEnabled=$($status.AntivirusEnabled) RealTimeProtectionEnabled=$($status.RealTimeProtectionEnabled)."
            if ($status.AntivirusEnabled) {
              return
            }
            Write-AntivirusEvidence "Antivirus check: Defender telemetry is present but antivirus is not reported as enabled on this hosted runner."
          }

          $products = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue
          if ($products) {
            Write-AntivirusEvidence "Antivirus check: SecurityCenter2 reported at least one antivirus product."
            return
          }

          $defenderService = Get-Service -Name WinDefend -ErrorAction SilentlyContinue
          if ($defenderService -and $defenderService.Status -in @('Running', 'StartPending')) {
            Write-AntivirusEvidence "Antivirus check: WinDefend service is present and active."
            return
          }

          Write-AntivirusEvidence "Antivirus check: no explicit antivirus telemetry was available on this hosted runner."
      - name: Install node dependencies
        run: npm ci
      - name: Sync Python dependencies
        if: runner.os != 'Windows' || runner.arch != 'ARM64' # llvmlite lacks wheel for Windows ARM64
        run: uv sync --project services/analysis-engine --group dev --frozen
      - name: Build frontend
        run: npm run build --workspace @bandscope/desktop
      - name: Build native shell
        run: npm exec --workspace @bandscope/desktop -- tauri build --target $env:BANDSCOPE_TARGET_TRIPLE --bundles nsis
      - name: Package Windows arm64 artifact
        run: python scripts/release/package_desktop_artifact.py
      - name: Upload Windows arm64 artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bandscope-windows-arm64-${{ github.sha }}
          path: artifacts/*

  gate-windows:
    name: gate / build / windows
    runs-on: ubuntu-latest
    needs:
      - build-windows-native
      - build-windows-arm64
    steps:
      - name: Confirm both Windows architectures built
        run: true

  build-macos-native:
    name: build / macos / amd64
    runs-on: macos-15-intel
    strategy:
      fail-fast: false
    permissions:
      contents: read
    env:
      BANDSCOPE_ARTIFACT_OS: macos
      BANDSCOPE_ARTIFACT_ARCH: amd64
      BANDSCOPE_TARGET_TRIPLE: x86_64-apple-darwin
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22.22.3
          cache: npm
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"
      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          version: "0.8.6"
          enable-cache: false
      - name: Install Rust stable
        run: rustup toolchain install stable --profile minimal
      - name: Add macOS Intel target
        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain stable
      - name: Install node dependencies
        run: npm ci
      - name: Sync Python dependencies
        run: uv sync --project services/analysis-engine --group dev --frozen
      - name: Build frontend
        run: npm run build --workspace @bandscope/desktop
      - name: Build native shell
        run: npm exec --workspace @bandscope/desktop -- tauri build --target "$BANDSCOPE_TARGET_TRIPLE" --bundles dmg
      - name: Package macOS amd64 artifact
        run: python3 scripts/release/package_desktop_artifact.py
      - name: Upload macOS amd64 artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bandscope-macos-amd64-${{ github.sha }}
          path: artifacts/*

  build-macos-arm64:
    name: build / macos / arm64
    runs-on: macos-15
    strategy:
      fail-fast: false
    permissions:
      contents: read
    env:
      BANDSCOPE_ARTIFACT_OS: macos
      BANDSCOPE_ARTIFACT_ARCH: arm64
      BANDSCOPE_TARGET_TRIPLE: aarch64-apple-darwin
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22.22.3
          cache: npm
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"
      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          version: "0.8.6"
          enable-cache: false
      - name: Install Rust stable
        run: rustup toolchain install stable --profile minimal
      - name: Add macOS arm target
        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain stable
      - name: Install node dependencies
        run: npm ci
      - name: Sync Python dependencies
        run: uv sync --project services/analysis-engine --group dev --frozen
      - name: Build frontend
        run: npm run build --workspace @bandscope/desktop
      - name: Build native shell
        run: npm exec --workspace @bandscope/desktop -- tauri build --target "$BANDSCOPE_TARGET_TRIPLE" --bundles dmg
      - name: Package macOS arm64 artifact
        run: python3 scripts/release/package_desktop_artifact.py
      - name: Upload macOS arm64 artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bandscope-macos-arm64-${{ github.sha }}
          path: artifacts/*

  gate-macos:
    name: gate / build / macos
    runs-on: ubuntu-latest
    needs:
      - build-macos-native
      - build-macos-arm64
    steps:
      - name: Confirm both macOS architectures built
        run: true

  publish-immutable-release:
    name: release-artifact / publish
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    needs:
      - gate-windows
      - gate-macos
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: bandscope-*-${{ github.sha }}
          path: downloaded-artifacts
          skip-decompress: true
      - name: Extract release artifacts with repo-owned validation
        run: python3 scripts/release/extract_release_artifacts.py downloaded-artifacts artifacts
      - name: Generate release CycloneDX SBOM
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          path: .
          format: cyclonedx-json
          output-file: bandscope-sbom.cdx.json
          upload-artifact: false
          upload-release-assets: false
      - name: Upload release SBOM artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bandscope-release-sbom-${{ github.sha }}
          path: |
            bandscope-sbom.cdx.json
            supply-chain/supplemental-component-inventory.json
      - name: Validate release asset set
        run: python3 scripts/release/select_release_assets.py --output release-assets.txt
      - name: Create draft release with complete assets, then publish
        env:
          GH_TOKEN: ${{ secrets.BANDSCOPE_RELEASE_TOKEN }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          if [ -z "${GH_TOKEN:-}" ]; then
            echo "BANDSCOPE_RELEASE_TOKEN is required to publish immutable release assets."
            exit 1
          fi
          if gh release view "$RELEASE_TAG" --repo "${{ github.repository }}" >/dev/null 2>&1; then
            echo "Release $RELEASE_TAG already exists; immutable release assets must be attached before publication."
            exit 1
          fi
          python3 scripts/release/select_release_assets.py --input release-assets.txt
          mapfile -t release_assets < release-assets.txt
          (( ${#release_assets[@]} > 0 ))
          gh release create "$RELEASE_TAG" \
            "${release_assets[@]}" \
            --draft \
            --generate-notes \
            --title "BandScope ${RELEASE_TAG#v}" \
            --verify-tag \
            --repo "${{ github.repository }}"
          gh release edit "$RELEASE_TAG" --draft=false --repo "${{ github.repository }}"