ci.yml

name: CI

on:
  push:
    branches:
      - master
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch:
    inputs:
      sccache:
        description: Enable sccache for Rust compilation caching
        required: false
        type: boolean
        default: true
  workflow_call:
    inputs:
      ref:
        description: The commit SHA to build
        required: false
        type: string
      sccache:
        description: Enable sccache for Rust compilation caching
        required: false
        type: boolean
        default: true

jobs:
  preflight:
    name: preflight
    runs-on: ubuntu-latest
    outputs:
      ref: ${{ steps.get-commit.outputs.ref }}
      version: ${{ steps.get-version.outputs.version }}
      rust-profile: ${{ steps.rust-profile.outputs.rust-profile }}
      sccache: ${{ steps.sccache.outputs.enabled }}
      jetsocat-build-matrix: ${{ steps.setup-matrix.outputs.jetsocat-build-matrix }}
      gateway-build-matrix: ${{ steps.setup-matrix.outputs.gateway-build-matrix }}
      agent-build-matrix: ${{ steps.setup-matrix.outputs.agent-build-matrix }}

    steps:
      - name: Setup matrix
        id: setup-matrix
        run: |
          $Jobs = @()
          $Archs = @( 'x64', 'arm64' )
          $Platforms = @( 'linux', 'windows' )

          $Platforms | ForEach-Object {
              $Runner = switch ($_) { 'windows' { 'windows-2022' } 'linux' { 'ubuntu-22.04' } }
              foreach ($Arch in $Archs) {
                  if ($Arch -Eq 'arm64' -And $_ -Eq 'windows') {
                    continue
                  }

                  $Jobs += @{
                      arch = $Arch
                      os = $_
                      runner = $Runner }
              }
          }

          $GatewayMatrix = ConvertTo-JSON $Jobs -Compress
          echo "gateway-build-matrix=$GatewayMatrix" >> $Env:GITHUB_OUTPUT

          $Jobs = @()

          $Platforms | ForEach-Object {
              $Runner = switch ($_) { 'windows' { 'windows-2022' } 'linux' { 'ubuntu-22.04' } }
              foreach ($Arch in $Archs) {
                  $Jobs += @{
                      arch = $Arch
                      os = $_
                      runner = $Runner }
              }
          }

          $AgentMatrix = ConvertTo-JSON $Jobs -Compress
          echo "agent-build-matrix=$AgentMatrix" >> $Env:GITHUB_OUTPUT

          $Jobs = @()
          $Platforms += 'macos'

          $Platforms | ForEach-Object {
              $Runner = switch ($_) { 'windows' { 'windows-2022' } 'macos' { 'macos-15' } 'linux' { 'ubuntu-22.04' } }
              foreach ($Arch in $Archs) {
                  $Jobs += @{
                      arch = $Arch
                      os = $_
                      runner = $Runner }
              }
          }

          $JetsocatMatrix = ConvertTo-JSON $Jobs -Compress
          echo "jetsocat-build-matrix=$JetsocatMatrix" >> $Env:GITHUB_OUTPUT
        shell: pwsh


      ## The SHA to build might be passed via workflow_call, otherwise the current commit is used
      - name: Get commit
        id: get-commit
        run: |
          $Ref = '${{ inputs.ref }}'
          if (-Not $Ref) {
            $Ref = '${{ github.sha }}'
          }
          echo "ref=$Ref" >> $Env:GITHUB_OUTPUT
        shell: pwsh


      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ steps.get-commit.outputs.ref }}

      - name: Get version
        id: get-version
        run: |
          $Version = Get-Content VERSION -TotalCount 1
          echo "version=$Version" >> $Env:GITHUB_OUTPUT
        shell: pwsh


      - name: Install nightly rustfmt
        run: rustup component add --toolchain nightly rustfmt

      - name: Check formatting
        run: |
          cargo +nightly fmt --all -- --check
          if ! [ $? -eq 0 ] ; then
              echo "::error::Bad formatting, please run 'cargo +nightly fmt --all'"
              exit 1
          fi

      - name: Configure rust profile
        id: rust-profile
        run: |
          $CargoProfile = "release"
          if ("${{ github.ref }}" -Eq "refs/heads/master") {
            echo "::notice::Building production profile"
            $CargoProfile = "production"
          }

          echo "rust-profile=$CargoProfile" >> $Env:GITHUB_OUTPUT
        shell: pwsh

      - name: Configure sccache
        id: sccache
        run: |
          # Enable sccache by default; only disable if explicitly set to false
          # This handles push/pull_request triggers where inputs.sccache is undefined
          $Enabled = if ("${{ inputs.sccache }}" -eq "false") { "false" } else { "true" }
          echo "enabled=$Enabled" >> $Env:GITHUB_OUTPUT
        shell: pwsh

      - name: Upload version artifact
        uses: actions/upload-artifact@v7
        with:
          name: version
          path: VERSION

  lints:
    name: lints [${{ matrix.os }}]
    needs: [preflight]
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        os: [windows, linux, macos]
        include:
          - os: windows
            runner: windows-2022
          - os: linux
            runner: ubuntu-latest
          - os: macos
            runner: macos-15

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      # The macos-15 image's ~/.cargo/bin shims dispatch to Homebrew's rustup-init and
      # fail for `cargo`; the official rustup installer replaces them with working ones.
      - name: Repair Rust shims (macOS)
        if: ${{ matrix.os == 'macos' }}
        run: |
          set -eux
          rm -rf "$HOME/.cargo/bin"
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | bash -s -- -y --default-toolchain none --no-modify-path --profile minimal
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
        shell: bash

      - name: Setup Rust cache
        uses: ./.github/actions/setup-rust-cache
        with:
          sccache-enabled: ${{ needs.preflight.outputs.sccache }}

      - name: Check clippy
        shell: pwsh
        run: |
          cargo clippy --workspace --tests -- -D warnings
          if ($LASTEXITCODE -ne 0) {
              Write-Output "::error::Clippy warnings detected, please run 'cargo clippy --workspace --tests' and fix all warnings"
              exit 1
          }

      - name: Show sccache stats
        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
        shell: pwsh
        run: sccache --show-stats

  oracle-markers:
    name: oracle markers
    needs: [preflight]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}
          # A pull request's merge commit and its first parent, the base the check compares against.
          fetch-depth: 2

      - name: Check oracle markers
        env:
          # Reads the files that markers pin in other repositories; a pin the token cannot read gets only a syntax check.
          GH_TOKEN: ${{ secrets.DEVOLUTIONSBOT_TOKEN || github.token }}
        run: |
          $Base = if ('${{ github.event_name }}' -Eq 'pull_request' -And -Not '${{ inputs.ref }}') { 'HEAD^1' }
          ./ci/check-oracle-markers.ps1 -Base $Base
        shell: pwsh

  skill-links:
    name: skill links
    needs: [preflight]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Check skill links
        run: ./ci/check-skill-links.ps1
        shell: pwsh

  oracle-markers-tests:
    name: oracle marker check tests
    needs: [preflight]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}
          # Detecting changes compares the commit with its first parent.
          fetch-depth: 2

      # Installing Pester from PSGallery fails at times, so a commit that leaves the check alone skips its tests.
      # The steps are skipped rather than the job, because the success job requires every job to succeed.
      - name: Detect changes to the check
        id: changes
        run: |
          $Changed = 'true'
          if (('${{ github.event_name }}' -In 'pull_request', 'push') -And -Not '${{ inputs.ref }}') {
            $Files = git diff --name-only HEAD^1 HEAD -- ci/check-oracle-markers.ps1 ci/check-oracle-markers.Tests.ps1
            if ($LASTEXITCODE -ne 0) {
              exit $LASTEXITCODE
            }
            if (-Not $Files) {
              $Changed = 'false'
            }
          }
          echo "changed=$Changed" >> $Env:GITHUB_OUTPUT
        shell: pwsh

      - name: Install Pester
        if: ${{ steps.changes.outputs.changed == 'true' }}
        run: |
          # Retry because PSGallery intermittently answers that no module named Pester matches.
          # The retry is inline because this job may check out an older commit that lacks any shared helper.
          for ($Attempt = 1; $true; $Attempt++) {
            try {
              Install-Module Pester -RequiredVersion 5.6.0 -Force -ErrorAction Stop
              break
            } catch {
              if ($Attempt -ge 4) { throw }
              Write-Warning "Installing Pester failed on attempt ${Attempt}: $_"
              Start-Sleep -Seconds (30 * $Attempt)
            }
          }
        shell: pwsh

      - name: Pester tests
        if: ${{ steps.changes.outputs.changed == 'true' }}
        run: |
          Import-Module Pester -RequiredVersion 5.6.0
          $Result = Invoke-Pester ci/check-oracle-markers.Tests.ps1 -PassThru
          if ($Result.Result -Ne 'Passed') {
            exit 1
          }
        shell: pwsh

  tests:
    name: tests [${{ matrix.os }} ${{ matrix.arch }}]
    needs: [preflight]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows
            arch: x64
            runner: windows-2022
            target: x86_64-pc-windows-msvc
          - os: linux
            arch: x64
            runner: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos
            arch: arm64
            runner: macos-15
            target: aarch64-apple-darwin

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      # The macos-15 image's ~/.cargo/bin shims dispatch to Homebrew's rustup-init and
      # fail for `cargo`; the official rustup installer replaces them with working ones.
      - name: Repair Rust shims (macOS)
        if: ${{ matrix.os == 'macos' }}
        run: |
          set -eux
          rm -rf "$HOME/.cargo/bin"
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | bash -s -- -y --default-toolchain none --no-modify-path --profile minimal
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
        shell: bash

      - name: Setup Rust cache
        uses: ./.github/actions/setup-rust-cache
        with:
          sccache-enabled: ${{ needs.preflight.outputs.sccache }}

      - name: Configure Linux runner
        if: ${{ matrix.os == 'linux' }}
        run: |
          sudo apt-get update
          sudo apt-get -o Acquire::Retries=3 install libsystemd-dev

      - name: Tests
        run: ./ci/tlk.ps1 test -Platform ${{ matrix.os }} -Architecture ${{ matrix.arch }} -CargoProfile 'dev'
        shell: pwsh
        env:
          AWS_LC_SYS_NO_ASM: true

      # A failed Agent Identity conformance run keeps its work directory, whose agent data directories and logs are the
      # only record of the state that made it fail.
      # The filter matches that directory under `target`, the temporary directory or `ProgramData`, and a file the runner
      # cannot read, such as one only SYSTEM can open, is reported and skipped.
      # UNTESTED: these steps run only after a failure; when changing them, check by hand with a failing conformance test
      # that the artifact holds the kept agent data directories.
      - name: Collect kept Agent Identity conformance directories
        if: ${{ failure() }}
        shell: pwsh
        run: |
          $Destination = Join-Path $Env:RUNNER_TEMP 'agent-identity-conformance'
          New-Item -ItemType Directory -Force $Destination | Out-Null
          $Parents = @('target', [IO.Path]::GetTempPath(), $Env:ProgramData) | Where-Object { $_ }
          $Index = 0
          Get-ChildItem -Path $Parents -Directory -Filter 'agent-identity-integration*' -ErrorAction SilentlyContinue |
            ForEach-Object {
              $Index++
              $Copy = Join-Path $Destination "$Index-$($_.Name)"
              Copy-Item -LiteralPath $_.FullName -Destination $Copy -Recurse -ErrorAction Continue
            }

      - name: Upload kept Agent Identity conformance directories
        if: ${{ failure() }}
        uses: actions/upload-artifact@v7
        with:
          name: agent-identity-conformance-${{ matrix.os }}-${{ matrix.arch }}-attempt-${{ github.run_attempt }}
          path: ${{ runner.temp }}/agent-identity-conformance
          if-no-files-found: ignore

      - name: Timing-sensitive tests
        run: |
          cargo test --locked --target ${{ matrix.target }} -p testsuite --test integration_tests timing:: -- --ignored --test-threads=1
        shell: pwsh
        env:
          AWS_LC_SYS_NO_ASM: true

      - name: Root-only tests
        if: ${{ matrix.os == 'linux' }}
        # Cargo builds as the runner user and runs only the test binary as root, so no build output is owned by root.
        # UNTESTED: the test binary runs as root.
        # A root-only test run without root skips and passes, so after changing this step, check that its log has no SKIP line.
        run: |
          cargo test --locked --target ${{ matrix.target }} --config "target.${{ matrix.target }}.runner='sudo'" -p device-key --lib root_only_
          cargo test --locked --target ${{ matrix.target }} --config "target.${{ matrix.target }}.runner='sudo'" -p testsuite --test integration_tests private_fs::unix::root_only_
        env:
          AWS_LC_SYS_NO_ASM: true

      - name: Show sccache stats
        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
        shell: pwsh
        run: sccache --show-stats

  agent-tunnel-e2e:
    name: agent tunnel end-to-end test
    needs: [preflight]
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Setup Rust cache
        uses: ./.github/actions/setup-rust-cache
        with:
          sccache-enabled: ${{ needs.preflight.outputs.sccache }}

      - name: Configure runner
        run: docker info

      - name: Test agent tunnel
        shell: pwsh
        run: cargo test --locked -p testsuite --test integration_tests cli::agent::tunnel::docker_isolates_real_agent_dns_and_ip_routes -- --ignored --exact --nocapture
        env:
          AWS_LC_SYS_NO_ASM: true

      - name: Show sccache stats
        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
        shell: pwsh
        run: sccache --show-stats

  check-dependencies:
    name: Check no ${{ matrix.banned }} in ${{ matrix.package }} [${{ matrix.target }}]
    needs: [preflight]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        banned: [aws-lc-rs]
        target: [x86_64-unknown-linux-gnu, x86_64-pc-windows-msvc]
        package: [devolutions-gateway, jetsocat]

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Check
        run: ./ci/check-crate-is-not-in-the-tree.ps1 -Package '${{ matrix.package }}' -UnwantedDependency '${{ matrix.banned }}' -Target '${{ matrix.target }}'
        shell: pwsh

  jetsocat:
    name: jetsocat [${{ matrix.os }} ${{ matrix.arch }}]
    needs: [preflight]
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.preflight.outputs.jetsocat-build-matrix) }}

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      # The macos-15 runner image ships `cargo`, `rustc`, etc. in ~/.cargo/bin as
      # symlinks to Homebrew's `rustup-init`, which is a shell-script wrapper that
      # only dispatches on the `rustup`/`rustup-init` names (not on `cargo`/`rustc`/
      # `clippy`). Invoking `cargo` therefore runs `rustup-init` and fails with
      # "unexpected argument 'build'". The official rustup installer lays down proper
      # multi-call hard-link shims, so we run it to repair ~/.cargo/bin.
      - name: Repair Rust shims (macOS)
        if: ${{ matrix.os == 'macos' }}
        run: |
          set -eux
          rm -rf "$HOME/.cargo/bin"
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | bash -s -- -y --default-toolchain none --no-modify-path --profile minimal
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
        shell: bash

      - name: Setup Rust cache
        uses: ./.github/actions/setup-rust-cache
        with:
          sccache-enabled: ${{ needs.preflight.outputs.sccache }}

      - name: Setup LLVM
        if: ${{ runner.os == 'Linux' }}
        uses: Devolutions/actions-public/setup-llvm@v1
        with:
          version: "18.1.8"

      - name: Setup CBake
        if: ${{ runner.os == 'Linux' }}
        uses: Devolutions/actions-public/setup-cbake@v1
        with:
          sysroots: |
            - ubuntu-18.04-amd64
            - ubuntu-18.04-arm64
          cargo_env_scripts: true

      - name: Configure Linux (arm) runner
        if: ${{ matrix.os == 'linux' && matrix.arch == 'arm64' }}
        run: |
          rustup target add aarch64-unknown-linux-gnu
          echo "STRIP_EXECUTABLE=llvm-strip" >> $GITHUB_ENV

      - name: Configure Windows runner
        if: ${{ runner.os == 'Windows' }}
        run: |
          # Retry because the Chocolatey community feed intermittently fails with gateway timeouts.
          # The retry is inline because this job may check out an older commit that lacks any shared helper.
          function Install-ChocoPackage {
            for ($Attempt = 1; $true; $Attempt++) {
              choco install @args --no-progress
              if ($LASTEXITCODE -eq 0) { return }
              if ($Attempt -ge 4) { throw "choco install $args failed after $Attempt attempts with exit code $LASTEXITCODE" }
              Start-Sleep -Seconds (30 * $Attempt)
            }
          }

          # NASM is required by aws-lc-rs (used as rustls crypto backend)
          Install-ChocoPackage nasm

          # We need to add the NASM binary folder to the PATH manually.
          Write-Output "$Env:ProgramFiles\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

          # libclang / LLVM is a requirement for AWS LC.
          # https://aws.github.io/aws-lc-rs/requirements/windows.html#libclang--llvm
          $VSINSTALLDIR = $(vswhere.exe -latest -requires Microsoft.VisualStudio.Component.VC.Llvm.Clang -property installationPath)
          Write-Output "LIBCLANG_PATH=$VSINSTALLDIR\VC\Tools\Llvm\x64\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

        shell: pwsh

      - name: Configure Windows (arm) runner
        if: ${{ runner.os == 'Windows' && matrix.arch == 'arm64' }}
        run: |
          rustup target add aarch64-pc-windows-msvc
        shell: pwsh

      - name: Configure macOS (intel) runner
        if: ${{ matrix.os == 'macos' && matrix.arch == 'x64' }}
        run: |
          rustup target add x86_64-apple-darwin

      - name: Build
        id: build
        run: |
          $StagingPath = Join-Path $Env:RUNNER_TEMP "staging"
          $TargetOutputPath = Join-Path $StagingPath ${{ matrix.os }} ${{ matrix.arch }}
          $ExecutableFileName = 'jetsocat'

          if ($Env:RUNNER_OS -eq "Windows") {
            $ExecutableFileName = "$($ExecutableFileName).exe"
            $Env:CARGO_NO_DEFAULT_FEATURES = "true"
            $Env:CARGO_FEATURES = "native-tls detect-proxy"
          }

          if ($Env:RUNNER_OS -eq "Linux") {
            $LinuxArch = @{'x64'='amd64';'arm64'='arm64'}['${{ matrix.arch }}']
            $RustArch = @{'x64'='x86_64';'arm64'='aarch64'}['${{ matrix.arch }}']
            $RustTarget = "$RustArch-unknown-linux-gnu"
            $Env:SYSROOT_NAME = "ubuntu-18.04-$LinuxArch"
            . "$HOME/.cargo/cbake/${RustTarget}-enter.ps1"
            $Env:AWS_LC_SYS_CMAKE_BUILDER="true"
          }

          $Env:TARGET_OUTPUT_PATH = $TargetOutputPath
          $Env:JETSOCAT_EXECUTABLE = Join-Path $TargetOutputPath $ExecutableFileName
          $Env:CARGO_PACKAGE = "jetsocat"

          ./ci/tlk.ps1 build -Product jetsocat -Platform ${{ matrix.os }} -Architecture ${{ matrix.arch }} -CargoProfile ${{ needs.preflight.outputs.rust-profile }}

          echo "staging-path=$StagingPath" >> $Env:GITHUB_OUTPUT
        shell: pwsh

      - name: Show sccache stats
        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
        shell: pwsh
        run: sccache --show-stats

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: jetsocat-${{ matrix.os }}-${{ matrix.arch }}
          path: ${{ steps.build.outputs.staging-path }}

  jetsocat-merge:
    name: jetsocat merge artifacts
    runs-on: ubuntu-latest
    needs: [preflight, jetsocat]

    steps:
      - name: Merge Artifacts
        uses: actions/upload-artifact/merge@v7
        with:
          name: jetsocat
          pattern: jetsocat-*
          delete-merged: true

  jetsocat-lipo:
    name: jetsocat macos universal
    runs-on: ubuntu-24.04
    needs: [preflight, jetsocat, jetsocat-merge]

    steps:
      - uses: actions/download-artifact@v8
        with:
          name: jetsocat

      - name: Setup CCTools
        uses: Devolutions/actions-public/setup-cctools@v1

      - name: Lipo
        run: |
          $OutputPath = Join-Path "macos" "universal"
          New-Item -ItemType Directory -Path $OutputPath | Out-Null
          $Binaries = Get-ChildItem -Recurse -Path "macos" -Filter "jetsocat" -File | Foreach-Object { $_.FullName } | Select -Unique
          $LipoCmd = $(@('lipo', '-create', '-output', (Join-Path -Path $OutputPath -ChildPath "jetsocat")) + $Binaries) -Join ' '
          Write-Host $LipoCmd
          Invoke-Expression $LipoCmd
        shell: pwsh

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: jetsocat
          path: .
          overwrite: true

  devolutions-gateway-webapp:
    name: Devolutions Gateway Web Apps
    # DEVOLUTIONSBOT_TOKEN is a repository secret, and it can't be used by PRs originating from forks.
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
    needs: [preflight]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Check out Devolutions/actions
        uses: actions/checkout@v6
        with:
          repository: Devolutions/actions
          ref: v1
          token: ${{ secrets.DEVOLUTIONSBOT_TOKEN }}
          path: ./.github/workflows

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: 10

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'pnpm'
          cache-dependency-path: webapp/pnpm-lock.yaml

      - name: Setup .npmrc config file
        uses: ./.github/workflows/npmrc-setup
        with:
          npm_token: ${{ secrets.ARTIFACTORY_NPM_TOKEN }}

      - name: Configure additional Artifactory auth
        run: |
          echo "//devolutions.jfrog.io/artifactory/api/npm/npm/:_auth=${{ secrets.ARTIFACTORY_NPM_TOKEN }}" >> .npmrc
          echo "//devolutions.jfrog.io/artifactory/api/npm/npm/:always-auth=true" >> .npmrc
        working-directory: webapp

      - name: Install dependencies
        run: pnpm install --frozen-lockfile
        working-directory: webapp

      - name: Build packages (libraries)
        run: pnpm build:libs
        working-directory: webapp

      - name: Build applications
        run: pnpm build:apps
        working-directory: webapp

      - name: Check code quality
        run: pnpm check
        working-directory: webapp

      - name: Run session-recording-log tests
        run: pnpm --filter @devolutions/session-recording-log test
        working-directory: webapp

      - name: Run multi-video-player tests
        run: pnpm --filter @devolutions/multi-video-player test --runInBand
        working-directory: webapp

      - name: Upload gateway-ui artifact
        uses: actions/upload-artifact@v7
        with:
          name: webapp-client
          path: webapp/dist/gateway-ui/

      - name: Upload recording-player artifact
        uses: actions/upload-artifact@v7
        with:
          name: webapp-player
          path: webapp/dist/recording-player/

  devolutions-gateway-powershell:
    name: devolutions-gateway-powershell
    needs: [preflight]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Install Pester
        id: prepare
        run: |
          # Retry because PSGallery intermittently answers that no module named Pester matches.
          # The retry is inline because this job may check out an older commit that lacks any shared helper.
          for ($Attempt = 1; $true; $Attempt++) {
            try {
              Install-Module Pester -RequiredVersion 5.6.0 -ErrorAction Stop
              break
            } catch {
              if ($Attempt -ge 4) { throw }
              Write-Warning "Installing Pester failed on attempt ${Attempt}: $_"
              Start-Sleep -Seconds (30 * $Attempt)
            }
          }
        shell: pwsh

      - name: Build module
        run: |
          $PSModuleVersion = "${{ needs.preflight.outputs.version }}"

          ./powershell/build.ps1

          $PSModuleName = "DevolutionsGateway"
          $PSModuleParentPath = Join-Path "powershell" "package"
          Write-Host "PSModuleOutputPath = $PSModuleParentPath"

          $PSStagingPath = Join-Path "powershell-staging" "PowerShell"
          Write-Host "PSStagingPath = $PSStagingPath"
          New-Item -Path $PSStagingPath -ItemType Directory | Out-Null

          $PSModuleTarFilePath = Join-Path $PSStagingPath "$PSModuleName-ps-$PSModuleVersion.tar"
          Write-Host "PSModuleTarFilePath = $PSModuleTarFilePath"

          tar -cvf "$PSModuleTarFilePath" -C "$PSModuleParentPath" "$PSModuleName"
        shell: pwsh

      - name: Pester tests
        run: |
          ./powershell/run-tests.ps1
        shell: pwsh

      - uses: actions/upload-artifact@v7
        with:
          name: devolutions-gateway-powershell
          path: powershell-staging

  # Run Windows-only installer cases on native Windows PowerShell 5.1 and PowerShell 7.
  # Keep artifact production in the Ubuntu job above to avoid duplicate shipping PowerShell artifacts.
  gateway-service-account-tests:
    name: Gateway service account tests [Windows]
    needs: [preflight]
    runs-on: windows-latest

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Install Pester for Windows PowerShell
        run: |
          # Retry because PSGallery intermittently answers that no module named Pester matches.
          # The retry is inline because this job may check out an older commit that lacks any shared helper.
          for ($Attempt = 1; $true; $Attempt++) {
            try {
              Install-Module Pester -RequiredVersion 5.6.0 -Scope CurrentUser -Force -ErrorAction Stop
              break
            } catch {
              if ($Attempt -ge 4) { throw }
              Write-Warning "Installing Pester failed on attempt ${Attempt}: $_"
              Start-Sleep -Seconds (30 * $Attempt)
            }
          }
        shell: powershell

      - name: Run service account tests in Windows PowerShell
        run: |
          Import-Module Pester -RequiredVersion 5.6.0
          $result = Invoke-Pester powershell\pester\ServiceAccount.Tests.ps1 -PassThru
          if ($result.Result -ne 'Passed') {
            exit 1
          }
        shell: powershell

      - name: Install Pester for PowerShell 7
        run: |
          # Retry because PSGallery intermittently answers that no module named Pester matches.
          # The retry is inline because this job may check out an older commit that lacks any shared helper.
          for ($Attempt = 1; $true; $Attempt++) {
            try {
              Install-Module Pester -RequiredVersion 5.6.0 -Scope CurrentUser -Force -ErrorAction Stop
              break
            } catch {
              if ($Attempt -ge 4) { throw }
              Write-Warning "Installing Pester failed on attempt ${Attempt}: $_"
              Start-Sleep -Seconds (30 * $Attempt)
            }
          }
        shell: pwsh

      - name: Run service account tests in PowerShell 7
        run: |
          Import-Module Pester -RequiredVersion 5.6.0
          $result = Invoke-Pester powershell\pester\ServiceAccount.Tests.ps1 -PassThru
          if ($result.Result -ne 'Passed') {
            exit 1
          }
        shell: pwsh

  devolutions-gateway:
    name: devolutions-gateway [${{ matrix.os }} ${{ matrix.arch }}]
    if: ${{ always() }}
    needs: [preflight, devolutions-gateway-powershell, devolutions-gateway-webapp]
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.preflight.outputs.gateway-build-matrix) }}

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Setup Rust cache
        uses: ./.github/actions/setup-rust-cache
        with:
          sccache-enabled: ${{ needs.preflight.outputs.sccache }}

      - name: Download webapp-client
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
        uses: actions/download-artifact@v8
        with:
          name: webapp-client
          path: webapp/dist/gateway-ui

      - name: Download webapp-player
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
        uses: actions/download-artifact@v8
        with:
          name: webapp-player
          path: webapp/dist/recording-player

      - name: Download devolutions-gateway-powershell
        uses: actions/download-artifact@v8
        with:
          name: devolutions-gateway-powershell
          path: powershell-staging

      - name: Download Cadeau
        run: |
          $Platform = @{'windows'='win'; 'linux'='linux'}['${{ matrix.os }}']
          $Arch = '${{ matrix.arch }}'
          ./ci/download-cadeau.ps1 -Platform $Platform -Architecture $Arch
        shell: pwsh

      - name: Load dynamic variables
        id: load-variables
        run: |
          $PackageVersion = "${{ needs.preflight.outputs.version }}"
          $StagingPath = Join-Path $Env:RUNNER_TEMP "staging"
          $TargetOutputPath = Join-Path $StagingPath ${{ matrix.os }} ${{ matrix.arch }}
          $ExecutableFileName = if ($Env:RUNNER_OS -eq "Windows") { "DevolutionsGateway.exe" } else { "devolutions-gateway" }

          if ($Env:RUNNER_OS -eq "Windows") {
            $PackageFileName = "DevolutionsGateway.msi"
            $DGatewayPackage = Join-Path $TargetOutputPath $PackageFileName
            echo "dgateway-package=$DGatewayPackage" >> $Env:GITHUB_OUTPUT
          }

          $DGatewayExecutable = Join-Path $TargetOutputPath $ExecutableFileName
          echo "staging-path=$StagingPath" >> $Env:GITHUB_OUTPUT
          echo "target-output-path=$TargetOutputPath" >> $Env:GITHUB_OUTPUT
          echo "dgateway-executable=$DGatewayExecutable" >> $Env:GITHUB_OUTPUT
        shell: pwsh

      - name: Setup LLVM
        if: ${{ runner.os == 'Linux' }}
        uses: Devolutions/actions-public/setup-llvm@v1
        with:
          version: "18.1.8"

      - name: Setup CBake
        if: ${{ runner.os == 'Linux' }}
        uses: Devolutions/actions-public/setup-cbake@v1
        with:
          sysroots: |
            - ubuntu-18.04-amd64
            - ubuntu-18.04-arm64
          cargo_env_scripts: true

      - name: Configure Linux runner
        if: ${{ matrix.os == 'linux' }}
        run: ./ci/setup-linux-build-deps.ps1 -Architecture ${{ matrix.arch }}
        shell: pwsh

      - name: Install fpm
        if: ${{ matrix.os == 'Linux' }}
        run: sudo gem install --no-document fpm

      - name: Configure Windows runner
        if: ${{ matrix.os == 'windows' }}
        run: |
          # Retry because the Chocolatey community feed intermittently fails with gateway timeouts.
          # The retry is inline because this job may check out an older commit that lacks any shared helper.
          function Install-ChocoPackage {
            for ($Attempt = 1; $true; $Attempt++) {
              choco install @args --no-progress
              if ($LASTEXITCODE -eq 0) { return }
              if ($Attempt -ge 4) { throw "choco install $args failed after $Attempt attempts with exit code $LASTEXITCODE" }
              Start-Sleep -Seconds (30 * $Attempt)
            }
          }

          # https://github.com/actions/runner-images/issues/9667
          choco uninstall wixtoolset
          Install-ChocoPackage wixtoolset --version 3.14.0 --allow-downgrade --force

          # WiX is installed on Windows runners but not in the PATH
          Write-Output "C:\Program Files (x86)\WiX Toolset v3.14\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

          # NASM is required by aws-lc-rs (used as rustls crypto backend)
          Install-ChocoPackage nasm

          # We need to add the NASM binary folder to the PATH manually.
          Write-Output "$Env:ProgramFiles\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
        shell: pwsh

      - name: Find mc.exe
        id: find_mc
        if: ${{ matrix.os == 'windows' }}
        run: |
          $sdkRoots = @(
            $Env:WindowsSdkDir
            (Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots" -Name KitsRoot10 -ErrorAction SilentlyContinue)
            "${Env:ProgramFiles(x86)}\Windows Kits\10"
          ) | Where-Object { $_ } | Select-Object -Unique
          $candidates = @()
          if ($Env:WindowsSdkVerBinPath) {
            $candidates += Join-Path $Env:WindowsSdkVerBinPath "mc.exe"
            $candidates += Join-Path $Env:WindowsSdkVerBinPath "x64\mc.exe"
          }
          foreach ($root in $sdkRoots) {
            $bin = Join-Path $root "bin"
            $candidates += Join-Path $bin "x64\mc.exe"
            $candidates += Get-ChildItem -LiteralPath $bin -Directory -ErrorAction SilentlyContinue |
              Where-Object Name -Match '^\d+\.\d+\.\d+\.\d+$' |
              Sort-Object { [version]$_.Name } -Descending |
              ForEach-Object { Join-Path $_.FullName "x64\mc.exe" }
          }
          $mc = $candidates | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf } | Select-Object -First 1
          if (-Not $mc) {
            throw "mc.exe was not found in the installed Windows SDK"
          }
          $path = Split-Path -Parent $mc
          Write-Output "windows_sdk_ver_bin_path=$path" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
          Write-Output $path | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
        shell: pwsh

      - name: Build
        run: |
          if ($Env:RUNNER_OS -eq "Linux") {
            $LinuxArch = @{'x64'='amd64';'arm64'='arm64'}['${{ matrix.arch }}']
            $RustArch = @{'x64'='x86_64';'arm64'='aarch64'}['${{ matrix.arch }}']
            $RustTarget = "$RustArch-unknown-linux-gnu"
            $Env:SYSROOT_NAME = "ubuntu-18.04-$LinuxArch"
            . "$HOME/.cargo/cbake/${RustTarget}-enter.ps1"
            $Env:AWS_LC_SYS_CMAKE_BUILDER="true"
          }

          if ($Env:RUNNER_OS -eq "Windows") {
            $Env:WindowsSdkVerBinPath = '${{ steps.find_mc.outputs.windows_sdk_ver_bin_path }}'
          }

          ./ci/tlk.ps1 build -Product gateway -Platform ${{ matrix.os }} -Architecture ${{ matrix.arch }} -CargoProfile ${{ needs.preflight.outputs.rust-profile }}
        shell: pwsh
        env:
          CARGO_PACKAGE: devolutions-gateway
          DGATEWAY_EXECUTABLE: ${{ steps.load-variables.outputs.dgateway-executable }}
          TARGET_OUTPUT_PATH: ${{ steps.load-variables.outputs.target-output-path }}

      - name: Add msbuild to PATH
        if: ${{ matrix.os == 'windows' }}
        uses: microsoft/setup-msbuild@v3

      - name: Package
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
        run: |
          if ($Env:RUNNER_OS -eq "Windows") {
            $Env:DGATEWAY_PACKAGE = "${{ steps.load-variables.outputs.dgateway-package }}"
            $Env:DGATEWAY_LIB_XMF_PATH = Join-Path "native-libs" "xmf.dll" | Resolve-Path

            $PSStagingPath = Join-Path (Get-Location) "powershell-staging"
            Write-Host "PSStagingPath = $PSStagingPath"
            $PSModuleOutputPath = Join-Path $PSStagingPath "DevolutionsGateway"
            $PSModuleTarFilePath = Get-ChildItem -Path "$PSStagingPath/PowerShell" "*-ps-*.tar" | Select-Object -First 1
            tar -xvf "$PSModuleTarFilePath" -C "$PSStagingPath"
            Get-ChildItem -Path "$PSStagingPath" -Recurse

            $Env:DGATEWAY_PSMODULE_PATH = $PSModuleOutputPath
          } else {
            $Env:DGATEWAY_LIB_XMF_PATH = Join-Path "native-libs" "libxmf.so" | Resolve-Path
          }

          $Env:DGATEWAY_WEBCLIENT_PATH = Join-Path "webapp" "dist" "gateway-ui" | Resolve-Path
          $Env:DGATEWAY_WEBPLAYER_PATH = Join-Path "webapp" "dist" "recording-player" | Resolve-Path

          ./ci/tlk.ps1 package -Product gateway -Platform ${{ matrix.os }} -Architecture ${{ matrix.arch }} -CargoProfile ${{ needs.preflight.outputs.rust-profile }}

          # Rename versioned fpm output to simple basenames for consistent folder-based addressing.
          if ($Env:RUNNER_OS -eq "Linux") {
            $OutputPath = "${{ steps.load-variables.outputs.target-output-path }}"
            Get-ChildItem "$OutputPath/*.deb"     | Rename-Item -NewName "devolutions-gateway.deb"
            Get-ChildItem "$OutputPath/*.changes" | Rename-Item -NewName "devolutions-gateway.changes"
            Get-ChildItem "$OutputPath/*.rpm"     | Rename-Item -NewName "devolutions-gateway.rpm"
          }
        shell: pwsh
        env:
          DGATEWAY_EXECUTABLE: ${{ steps.load-variables.outputs.dgateway-executable }}
          TARGET_OUTPUT_PATH: ${{ steps.load-variables.outputs.target-output-path }}

      - name: Show sccache stats
        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
        shell: pwsh
        run: sccache --show-stats

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: devolutions-gateway-${{ matrix.os }}-${{ matrix.arch }}
          path: ${{ steps.load-variables.outputs.staging-path }}

  devolutions-gateway-merge:
    name: devolutions gateway merge artifacts
    # Keep fork builds eligible when the webapp job is skipped, but never merge partial Gateway artifacts.
    if: ${{ always() && needs.devolutions-gateway.result == 'success' }}
    needs: [preflight, devolutions-gateway]
    runs-on: ubuntu-latest

    steps:
      - name: Merge Artifacts
        uses: actions/upload-artifact/merge@v7
        with:
          name: devolutions-gateway
          pattern: devolutions-gateway-*
          delete-merged: true

  devolutions-pedm-desktop:
    name: devolutions-pedm-desktop
    runs-on: windows-latest
    needs: [preflight]

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Add msbuild to PATH
        uses: microsoft/setup-msbuild@v3

      - name: Build
        run: ./dotnet/DesktopAgent/build.ps1
        shell: pwsh

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: devolutions-pedm-desktop
          path: ./dotnet/DesktopAgent/bin/Release/net48/*

  devolutions-agent:
    name: devolutions-agent [${{ matrix.os }} ${{ matrix.arch }}]
    needs: [preflight, devolutions-pedm-desktop]
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include: ${{ fromJson(needs.preflight.outputs.agent-build-matrix) }}

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Setup Rust cache
        uses: ./.github/actions/setup-rust-cache
        with:
          sccache-enabled: ${{ needs.preflight.outputs.sccache }}

      - name: Load dynamic variables
        id: load-variables
        run: |
          $PackageVersion = "${{ needs.preflight.outputs.version }}"
          $StagingPath = Join-Path $Env:RUNNER_TEMP "staging"
          $SymbolsPath = Join-Path $Env:RUNNER_TEMP "symbols"
          New-Item -ItemType Directory $StagingPath
          New-Item -ItemType Directory $SymbolsPath

          $TargetOutputPath = Join-Path $StagingPath ${{ matrix.os }} ${{ matrix.arch }}
          $ExecutableFileName = if ($Env:RUNNER_OS -eq "Windows") { "DevolutionsAgent.exe" } else { "devolutions-agent" }

          if ($Env:RUNNER_OS -eq "Windows") {
            $PackageFileName = "DevolutionsAgent.msi"
            $DAgentPackage = Join-Path $TargetOutputPath $PackageFileName

            echo "dagent-package=$DAgentPackage" >> $Env:GITHUB_OUTPUT

            $DAgentPedmShellExtDll = Join-Path $TargetOutputPath "DevolutionsPedmShellExt.dll"
            echo "dagent-pedm-shell-ext-dll=$DAgentPedmShellExtDll" >> $Env:GITHUB_OUTPUT

            $DAgentPedmShellExtMsix = Join-Path $TargetOutputPath "DevolutionsPedmShellExt.msix"
            echo "dagent-pedm-shell-ext-msix=$DAgentPedmShellExtMsix" >> $Env:GITHUB_OUTPUT

            $DAgentSessionExecutable = Join-Path $TargetOutputPath "DevolutionsSession.exe"
            echo "dagent-session-executable=$DAgentSessionExecutable" >> $Env:GITHUB_OUTPUT

            $DAgentUpdaterExecutable = Join-Path $TargetOutputPath "DevolutionsAgentUpdater.exe"
            echo "dagent-updater-executable=$DAgentUpdaterExecutable" >> $Env:GITHUB_OUTPUT
          }

          $DAgentExecutable = Join-Path $TargetOutputPath $ExecutableFileName
          echo "staging-path=$StagingPath" >> $Env:GITHUB_OUTPUT
          echo "symbols-path=$SymbolsPath" >> $Env:GITHUB_OUTPUT
          echo "target-output-path=$TargetOutputPath" >> $Env:GITHUB_OUTPUT
          echo "dagent-executable=$DAgentExecutable" >> $Env:GITHUB_OUTPUT
        shell: pwsh

      - name: Download devolutions-pedm-desktop
        if: ${{ matrix.os == 'windows' }}
        uses: actions/download-artifact@v8
        with:
          name: devolutions-pedm-desktop
          path: devolutions-pedm-desktop

      - name: Download tun2socks
        id: tun2socks
        if: ${{ matrix.os == 'windows' }}
        run: |
          $Arch = '${{ matrix.arch }}'
          $Destination = Join-Path $PWD "tun2socks" windows $Arch
          ./ci/download-tun2socks.ps1 -Architecture $Arch -Destination $Destination
          $Tun2SocksExecutablePath = Join-Path $Destination "tun2socks.exe"
          $WintunLibraryPath = Join-Path $Destination "wintun.dll"
          echo "tun2socks-executable-path=$Tun2SocksExecutablePath" >> $Env:GITHUB_OUTPUT
          echo "wintun-library-path=$WintunLibraryPath" >> $Env:GITHUB_OUTPUT
          @($Tun2SocksExecutablePath, $WintunLibraryPath) | % {
            if (-Not (Test-Path $_)) { throw "$_ not found" }
          }
        shell: pwsh

      - name: Download multi-pwsh
        id: multi-pwsh
        if: ${{ matrix.os == 'windows' }}
        run: |
          $Destination = Join-Path $Env:RUNNER_TEMP "multi-pwsh" "windows" "${{ matrix.arch }}"
          ./ci/download-multi-pwsh.ps1 -Architecture "${{ matrix.arch }}" -Destination $Destination
          echo "executable-path=$(Join-Path $Destination 'multi-pwsh.exe')" >> $Env:GITHUB_OUTPUT
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload tun2socks artifacts
        if: ${{ matrix.os == 'windows' }}
        uses: actions/upload-artifact@v7
        with:
          name: tun2socks-windows-${{ matrix.arch }}
          path: tun2socks/

      - name: Setup LLVM
        if: ${{ runner.os == 'Linux' }}
        uses: Devolutions/actions-public/setup-llvm@v1
        with:
          version: "18.1.8"

      - name: Setup CBake
        if: ${{ runner.os == 'Linux' }}
        uses: Devolutions/actions-public/setup-cbake@v1
        with:
          sysroots: |
            - ubuntu-18.04-amd64
            - ubuntu-18.04-arm64
          cargo_env_scripts: true

      - name: Configure Linux runner
        if: ${{ matrix.os == 'linux' }}
        run: ./ci/setup-linux-build-deps.ps1 -Architecture ${{ matrix.arch }}
        shell: pwsh

      - name: Install fpm
        if: ${{ matrix.os == 'Linux' }}
        run: sudo gem install --no-document fpm

      - name: Configure Windows runner
        if: ${{ matrix.os == 'windows' }}
        run: |
          # Retry because the Chocolatey community feed intermittently fails with gateway timeouts.
          # The retry is inline because this job may check out an older commit that lacks any shared helper.
          function Install-ChocoPackage {
            for ($Attempt = 1; $true; $Attempt++) {
              choco install @args --no-progress
              if ($LASTEXITCODE -eq 0) { return }
              if ($Attempt -ge 4) { throw "choco install $args failed after $Attempt attempts with exit code $LASTEXITCODE" }
              Start-Sleep -Seconds (30 * $Attempt)
            }
          }

          # https://github.com/actions/runner-images/issues/9667
          choco uninstall wixtoolset
          Install-ChocoPackage wixtoolset --version 3.14.0 --allow-downgrade --force

          # Devolutions PEDM needs MakeAppx.exe
          Write-Output "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x64" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

          # WiX is installed on Windows runners but not in the PATH
          Write-Output "C:\Program Files (x86)\WiX Toolset v3.14\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

          # NASM is required by aws-lc-rs (used as rustls crypto backend)
          Install-ChocoPackage nasm

          # We need to add the NASM binary folder to the PATH manually.
          Write-Output "$Env:ProgramFiles\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - name: Configure Windows (arm) runner
        if: ${{ runner.os == 'Windows' && matrix.arch == 'arm64' }}
        run: |
          rustup target add aarch64-pc-windows-msvc
        shell: pwsh

      - name: Add msbuild to PATH
        if: ${{ matrix.os == 'windows' }}
        uses: microsoft/setup-msbuild@v3

      - name: Find mc.exe
        id: find_mc
        if: ${{ matrix.os == 'windows' }}
        run: |
          $sdkRoots = @(
            $Env:WindowsSdkDir
            (Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots" -Name KitsRoot10 -ErrorAction SilentlyContinue)
            "${Env:ProgramFiles(x86)}\Windows Kits\10"
          ) | Where-Object { $_ } | Select-Object -Unique
          $candidates = @()
          if ($Env:WindowsSdkVerBinPath) {
            $candidates += Join-Path $Env:WindowsSdkVerBinPath "mc.exe"
            $candidates += Join-Path $Env:WindowsSdkVerBinPath "x64\mc.exe"
          }
          foreach ($root in $sdkRoots) {
            $bin = Join-Path $root "bin"
            $candidates += Join-Path $bin "x64\mc.exe"
            $candidates += Get-ChildItem -LiteralPath $bin -Directory -ErrorAction SilentlyContinue |
              Where-Object Name -Match '^\d+\.\d+\.\d+\.\d+$' |
              Sort-Object { [version]$_.Name } -Descending |
              ForEach-Object { Join-Path $_.FullName "x64\mc.exe" }
          }
          $mc = $candidates | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf } | Select-Object -First 1
          if (-Not $mc) {
            throw "mc.exe was not found in the installed Windows SDK"
          }
          $path = Split-Path -Parent $mc
          Write-Output "windows_sdk_ver_bin_path=$path" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
          Write-Output $path | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
        shell: pwsh

      - name: Build
        run: |
          if ($Env:RUNNER_OS -eq "Windows") {
            $Env:DAGENT_UPDATER_EXECUTABLE = "${{ steps.load-variables.outputs.dagent-updater-executable }}"
            $Env:DAGENT_PEDM_SHELL_EXT_DLL = "${{ steps.load-variables.outputs.dagent-pedm-shell-ext-dll }}"
            $Env:DAGENT_PEDM_SHELL_EXT_MSIX = "${{ steps.load-variables.outputs.dagent-pedm-shell-ext-msix }}"
            $Env:DAGENT_SESSION_EXECUTABLE = "${{ steps.load-variables.outputs.dagent-session-executable }}"
            $Env:DAGENT_TUN2SOCKS_EXE = "${{ steps.tun2socks.outputs.tun2socks-executable-path }}"
            $Env:DAGENT_WINTUN_DLL = "${{ steps.tun2socks.outputs.wintun-library-path }}"
            $Env:DAGENT_MULTI_PWSH_EXECUTABLE = "${{ steps.multi-pwsh.outputs.executable-path }}"
            $Env:WindowsSdkVerBinPath = '${{ steps.find_mc.outputs.windows_sdk_ver_bin_path }}'
          }

          if ($Env:RUNNER_OS -eq "Linux") {
            $LinuxArch = @{'x64'='amd64';'arm64'='arm64'}['${{ matrix.arch }}']
            $RustArch = @{'x64'='x86_64';'arm64'='aarch64'}['${{ matrix.arch }}']
            $RustTarget = "$RustArch-unknown-linux-gnu"
            $Env:SYSROOT_NAME = "ubuntu-18.04-$LinuxArch"
            . "$HOME/.cargo/cbake/${RustTarget}-enter.ps1"
            $Env:AWS_LC_SYS_CMAKE_BUILDER="true"
          }

          ./ci/tlk.ps1 build -Product agent -Platform ${{ matrix.os }} -Architecture ${{ matrix.arch }} -CargoProfile ${{ needs.preflight.outputs.rust-profile }}
        shell: pwsh
        env:
          CARGO_PACKAGE: devolutions-agent
          DAGENT_EXECUTABLE: ${{ steps.load-variables.outputs.dagent-executable }}
          TARGET_OUTPUT_PATH: ${{ steps.load-variables.outputs.target-output-path }}

      - name: Package
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
        run: |
          if ($Env:RUNNER_OS -eq "Windows") {
            $DesktopStagingPath = Join-Path (Get-Location) "devolutions-pedm-desktop"
            Get-ChildItem -Path $DesktopStagingPath -Recurse | Where-Object { $_.Extension -notin '.exe', '.dll' } | Remove-Item -Recurse -Force

            $Env:DAGENT_PACKAGE = "${{ steps.load-variables.outputs.dagent-package }}"
            $Env:DAGENT_DESKTOP_AGENT_PATH = $DesktopStagingPath
            $Env:DAGENT_UPDATER_EXECUTABLE = "${{ steps.load-variables.outputs.dagent-updater-executable }}"
            $Env:DAGENT_PEDM_SHELL_EXT_DLL = "${{ steps.load-variables.outputs.dagent-pedm-shell-ext-dll }}"
            $Env:DAGENT_PEDM_SHELL_EXT_MSIX = "${{ steps.load-variables.outputs.dagent-pedm-shell-ext-msix }}"
            $Env:DAGENT_SESSION_EXECUTABLE = "${{ steps.load-variables.outputs.dagent-session-executable }}"
            $Env:DAGENT_TUN2SOCKS_EXE = "${{ steps.tun2socks.outputs.tun2socks-executable-path }}"
            $Env:DAGENT_WINTUN_DLL = "${{ steps.tun2socks.outputs.wintun-library-path }}"
            $Env:DAGENT_MULTI_PWSH_EXECUTABLE = "${{ steps.multi-pwsh.outputs.executable-path }}"
          }

          ./ci/tlk.ps1 package -Product agent -Platform ${{ matrix.os }} -Architecture ${{ matrix.arch }} -CargoProfile ${{ needs.preflight.outputs.rust-profile }}

          # Rename versioned fpm output to simple basenames for consistent folder-based addressing.
          if ($Env:RUNNER_OS -eq "Linux") {
            $OutputPath = "${{ steps.load-variables.outputs.target-output-path }}"
            Get-ChildItem "$OutputPath/*.deb"     | Rename-Item -NewName "devolutions-agent.deb"
            Get-ChildItem "$OutputPath/*.changes" | Rename-Item -NewName "devolutions-agent.changes"
            Get-ChildItem "$OutputPath/*.rpm"     | Rename-Item -NewName "devolutions-agent.rpm"
          }
        shell: pwsh
        env:
          DAGENT_EXECUTABLE: ${{ steps.load-variables.outputs.dagent-executable }}
          TARGET_OUTPUT_PATH: ${{ steps.load-variables.outputs.target-output-path }}


      - name: Clean up architecture-agnostic files before upload
        run: |
          if ($Env:RUNNER_OS -eq "Windows") {
            # Remove devolutions-pedm-desktop folder completely to avoid duplicates
            # These will be available separately from the devolutions-pedm-desktop job
            $DesktopStagingPath = Join-Path (Get-Location) "devolutions-pedm-desktop"
            if (Test-Path $DesktopStagingPath) {
              Write-Host "Removing devolutions-pedm-desktop folder: $DesktopStagingPath"
              Remove-Item $DesktopStagingPath -Recurse -Force
            }
          }
        shell: pwsh

      - name: Show sccache stats
        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
        shell: pwsh
        run: sccache --show-stats

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: devolutions-agent-${{ matrix.os }}-${{ matrix.arch }}
          path: ${{ steps.load-variables.outputs.staging-path }}

  devolutions-agent-merge:
    name: devolutions agent merge artifacts
    runs-on: ubuntu-latest
    needs: [preflight, devolutions-agent]

    steps:
      - name: Merge Artifacts
        uses: actions/upload-artifact/merge@v7
        with:
          name: devolutions-agent
          pattern: devolutions-agent-*
          delete-merged: true

  tun2socks-merge:
    name: tun2socks merge artifacts
    runs-on: ubuntu-latest
    needs: [preflight, devolutions-agent]

    steps:
      - name: Merge Artifacts
        uses: actions/upload-artifact/merge@v7
        with:
          name: tun2socks
          pattern: tun2socks-*
          delete-merged: true

  devolutions-pedm-client:
    name: devolutions-pedm-client
    runs-on: ubuntu-latest
    needs: [preflight]

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Build
        run: ./crates/devolutions-pedm/openapi/dotnet-client/build.ps1
        shell: pwsh

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: devolutions-pedm-client
          path: ./crates/devolutions-pedm/openapi/dotnet-client/src/Devolutions.Pedm.Client/bin/Release/Devolutions.Pedm.Client.*

  dotnet-utils-tests:
    name: .NET utils tests
    runs-on: windows-2022
    needs: [preflight]

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Tests
        run: dotnet test utils/dotnet/GatewayUtils.sln
        shell: pwsh

      - name: Build agent channel package
        run: ./crates/agent-channel-proto/dotnet/build.ps1
        shell: pwsh

      - name: Agent identity authority tests
        run: dotnet test dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.sln
        shell: pwsh

      - name: Build agent identity authority package
        run: ./dotnet/Devolutions.Agent.Identity.Authority/build.ps1
        shell: pwsh

  agent-identity-vectors:
    name: Agent Identity test vectors
    runs-on: ubuntu-latest
    needs: [preflight]

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      # The vectors are recomputed with an independent library, so that an error in them can't pass into every implementation that agrees with them.
      - name: Verify the vectors
        run: |
          python3 -m venv "$RUNNER_TEMP/vectors"
          "$RUNNER_TEMP/vectors/bin/pip" install --quiet --disable-pip-version-check cryptography==50.0.2
          "$RUNNER_TEMP/vectors/bin/python" -I docs/agent-identity/verify_vectors.py
          "$RUNNER_TEMP/vectors/bin/python" -I docs/agent-identity/verify_vectors.py --self-test
  agent-installer-event-log-tests:
    name: Agent installer Event Log lifecycle tests
    runs-on: windows-2022
    needs: [preflight]

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Tests
        run: dotnet test package/AgentWindowsManaged.Tests/DevolutionsAgent.Installer.Tests.csproj
        shell: pwsh

  gateway-installer-tests:
    name: Gateway installer tests
    runs-on: windows-2022
    needs: [preflight]

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Tests
        run: dotnet test package/WindowsManaged.UnitTests/DevolutionsGateway.Installer.Tests.csproj
        shell: pwsh

  winapi-sanitizer-tests:
    name: Windows API sanitizer tests
    runs-on: windows-2022
    needs: [preflight]

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Setup Rust cache
        uses: ./.github/actions/setup-rust-cache
        with:
          sccache-enabled: ${{ needs.preflight.outputs.sccache }}

      - name: Prepare runner
        run: |
          $VSInstallationPath = $(vswhere.exe -latest -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath)
          Write-Host "VCToolsInstallDir = $VSInstallationPath"
          Get-ChildItem "$VSInstallationPath"

          $toolsPath = "$VSInstallationPath\VC\Tools\MSVC"
          Write-Host "toolsPath = $toolsPath"
          Get-ChildItem "$toolsPath"

          $firstItem = Get-ChildItem "$toolsPath" | Select-Object -Last 1
          $binPath = "$toolsPath\$($firstItem.Name)\bin\Hostx64\x64"
          Write-Host "binPath = $binPath"
          Get-ChildItem "$binPath"

          $asanDllPath = "$binPath\clang_rt.asan_dynamic-x86_64.dll"
          Write-Host "asanDllPath = $asanDllPath"

          New-Item -ItemType Directory ".\target\x86_64-pc-windows-msvc\debug\"
          Copy-Item -Path "$asanDllPath" -Destination .\target\x86_64-pc-windows-msvc\debug\

          rustup toolchain install nightly
        shell: pwsh

      - name: Run tests
        run: |
          $Env:RUSTFLAGS="-Zsanitizer=address"
          cargo +nightly test --target x86_64-pc-windows-msvc -p win-api-wrappers -p devolutions-pedm
        shell: pwsh

      - name: Show sccache stats
        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
        shell: pwsh
        run: sccache --show-stats

  winapi-miri:
    name: Windows API miri tests [${{ matrix.os }}][${{ matrix.mode }}]
    needs: [preflight]
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - windows
          - linux
        mode:
          - stacked-borrow
          - tree-borrows
        include:
          - os: windows
            runner: windows-latest
          - os: linux
            runner: ubuntu-latest
          - mode: tree-borrows
            miriflags: -Zmiri-tree-borrows

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Setup Rust cache
        uses: ./.github/actions/setup-rust-cache
        with:
          sccache-enabled: ${{ needs.preflight.outputs.sccache }}

      # NOTE: Pinned to a specific nightly version for reproducibility.
      # Update this manually on a regular basis.
      - name: Prepare runner
        run: |
          rustup toolchain install nightly-2026-02-11 --component miri

      - name: Run tests
        run: |
          $Env:MIRIFLAGS = "${{ matrix.miriflags }}"
          cargo +nightly-2026-02-11 miri test -p win-api-wrappers
        shell: pwsh

      - name: Show sccache stats
        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
        shell: pwsh
        run: sccache --show-stats

  pedm-simulator:
    name: PEDM simulator
    runs-on: windows-2022
    needs: [preflight]

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Prepare runner
        run: |
          rustup toolchain install nightly

      # The pstools Chocolatey package is unreliable: it downloads PSTools.zip from
      # Microsoft at install time, and its pinned checksum breaks whenever Microsoft
      # updates the zip. Download it directly and verify against our own checksum
      # instead; bump the hash deliberately when Microsoft publishes a new PSTools.
      - name: Install PsExec
        shell: pwsh
        run: |
          $expectedHash = 'C26C6BA44997E650A733DF257C8FEB83898D3FAEF2D2E391869D107E40863553'
          $zipPath = Join-Path $env:RUNNER_TEMP 'PSTools.zip'
          $toolsDir = Join-Path $env:RUNNER_TEMP 'PSTools'
          Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/PSTools.zip' -OutFile $zipPath
          $actualHash = (Get-FileHash -Path $zipPath -Algorithm SHA256).Hash
          if ($actualHash -ne $expectedHash) {
            throw "PSTools.zip checksum mismatch: expected $expectedHash, got $actualHash"
          }
          Expand-Archive -Path $zipPath -DestinationPath $toolsDir
          Add-Content -Path $env:GITHUB_PATH -Value $toolsDir

      # The Docker service for Windows containers may not be started yet at this point.
      # Starting it explicitly avoids flaky failures when the daemon is not ready.
      - name: Start Docker service
        run: Start-Service docker
        shell: pwsh

      - name: Prepare PEDM simulator build
        run: ./crates/pedm-simulator/prepare.ps1

      - name: Build PEDM simulator container
        run: ./crates/pedm-simulator/build-container.ps1

      - name: Run PEDM simulator (container with limited user)
        run: ./crates/pedm-simulator/run-container.ps1

      # It’s difficult to get realtime stdout/stderr when using psexec -s.
      # Instead, the run-expect-elevation.ps1 script will redirect the output into a file that we can read afterwards.
      - name: Run PEDM simulator (as LocalSystem)
        run: |
          $scriptPath = Resolve-Path -Path "./crates/pedm-simulator/run-expect-elevation.ps1"
          psexec -accepteula -s pwsh.exe $scriptPath
          Get-Content -Path ./crates/pedm-simulator/pedm-simulator_run-expect-elevation.out

  agent-policy-e2e:
    name: Agent policy end-to-end test
    runs-on: windows-2022
    needs: [preflight]
    env:
      AGENT_POLICY_TEST_SHA: ${{ inputs.ref || github.event.pull_request.head.sha || needs.preflight.outputs.ref }}

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ env.AGENT_POLICY_TEST_SHA }}

      - name: Setup Rust cache
        uses: ./.github/actions/setup-rust-cache
        with:
          sccache-enabled: ${{ needs.preflight.outputs.sccache }}

      # Keep this installation aligned with the PEDM simulator job.
      - name: Install PsExec
        shell: pwsh
        run: |
          $expectedHash = 'C26C6BA44997E650A733DF257C8FEB83898D3FAEF2D2E391869D107E40863553'
          $zipPath = Join-Path $env:RUNNER_TEMP 'PSTools.zip'
          $toolsDir = Join-Path $env:RUNNER_TEMP 'PSTools'
          Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/PSTools.zip' -OutFile $zipPath
          $actualHash = (Get-FileHash -Path $zipPath -Algorithm SHA256).Hash
          if ($actualHash -ne $expectedHash) {
            throw "PSTools.zip checksum mismatch: expected $expectedHash, got $actualHash"
          }
          Expand-Archive -Path $zipPath -DestinationPath $toolsDir
          Add-Content -Path $env:GITHUB_PATH -Value $toolsDir

      - name: Build Agent policy test executables
        id: build-policy-executables
        shell: pwsh
        run: |
          $actualCommit = git rev-parse HEAD
          if ($LASTEXITCODE -ne 0 -or $actualCommit -ne $env:AGENT_POLICY_TEST_SHA) {
            throw "Agent policy tests must build the requested commit $env:AGENT_POLICY_TEST_SHA, got $actualCommit"
          }
          cargo build --locked -p devolutions-agent
          if ($LASTEXITCODE -ne 0) {
            exit $LASTEXITCODE
          }
          cargo build --locked -p agent-policy-tester
          if ($LASTEXITCODE -ne 0) {
            exit $LASTEXITCODE
          }

      - name: Run Agent policy tester as standard user
        shell: pwsh
        run: |
          ./crates/agent-policy-tester/run-unelevated.ps1
          $exitCode = $LASTEXITCODE
          Get-Content -Path ./crates/agent-policy-tester/agent-policy-tester-unelevated.out
          if ($exitCode -ne 0) {
            exit $exitCode
          }

      - name: Run Agent policy tester as LocalSystem
        if: ${{ !cancelled() && steps.build-policy-executables.outcome == 'success' }}
        shell: pwsh
        run: |
          $scriptPath = Resolve-Path -Path "./crates/agent-policy-tester/run-as-system.ps1"
          psexec -accepteula -s pwsh.exe -NoProfile -File $scriptPath
          $exitCode = $LASTEXITCODE
          Get-Content -Path ./crates/agent-policy-tester/agent-policy-tester.out
          if ($exitCode -ne 0) {
            exit $exitCode
          }

      - name: Show sccache stats
        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
        shell: pwsh
        run: sccache --show-stats

  secure-memory-verifier:
    name: secure-memory-verifier
    runs-on: windows-2022
    needs: [preflight]

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Setup Rust cache
        uses: ./.github/actions/setup-rust-cache
        with:
          sccache-enabled: ${{ needs.preflight.outputs.sccache }}

      - name: Run secure-memory-verifier
        run: cargo run -p secure-memory-verifier -- all
        shell: pwsh

      - name: Show sccache stats
        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
        shell: pwsh
        run: sccache --show-stats

  success:
    name: Success
    if: ${{ always() }}
    needs: [tests, agent-tunnel-e2e, agent-policy-e2e, lints, oracle-markers, oracle-markers-tests, skill-links, check-dependencies, jetsocat-lipo, devolutions-gateway-powershell, gateway-service-account-tests, devolutions-gateway, devolutions-gateway-merge, devolutions-pedm-desktop, devolutions-agent, devolutions-agent-merge, devolutions-pedm-client, dotnet-utils-tests, agent-identity-vectors, agent-installer-event-log-tests, gateway-installer-tests, winapi-sanitizer-tests, winapi-miri, pedm-simulator, secure-memory-verifier]
    runs-on: ubuntu-latest

    steps:
      - name: Check success
        run: |
          $results = '${{ toJSON(needs.*.result) }}' | ConvertFrom-Json
          $succeeded = $($results | Where { $_ -Ne "success" }).Count -Eq 0
          exit $(if ($succeeded) { 0 } else { 1 })
        shell: pwsh

  upload-git-log:
    name: Upload git-log output
    if: ${{ github.ref == 'refs/heads/master' }}
    needs: [preflight, success]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}
          fetch-depth: 10

      - name: Generate git-log.txt
        run: git log --max-count=10 > ./git-log.txt
        shell: pwsh

      - name: Upload git-log.txt
        uses: actions/upload-artifact@v7
        with:
          name: git-log
          path: ./git-log.txt

  onedrive:
    name: OneDrive
    environment: onedrive-upload
    if: ${{ github.ref == 'refs/heads/master' }}
    needs: [preflight, upload-git-log]
    runs-on: ubuntu-latest

    steps:
      - name: Check out Devolutions/actions
        uses: actions/checkout@v6
        with:
          repository: Devolutions/actions
          ref: v1
          token: ${{ secrets.DEVOLUTIONSBOT_TOKEN }}
          path: ./.github/workflows

      - name: Get current timestamp
        id: timestamp
        run: echo "timestamp=$(date +'%Y%m%d%H%M')" >> $GITHUB_OUTPUT

      - name: Install Devolutions Toolbox
        uses: ./.github/workflows/toolbox-install
        with:
          github_token: ${{ secrets.DEVOLUTIONSBOT_TOKEN }}

      - uses: actions/download-artifact@v8
        with:
          name: jetsocat
          path: ${{ runner.temp }}/artifacts_raw/jetsocat

      - uses: actions/download-artifact@v8
        with:
          name: devolutions-gateway
          path: ${{ runner.temp }}/artifacts_raw/devolutions-gateway

      - uses: actions/download-artifact@v8
        with:
          name: devolutions-agent
          path: ${{ runner.temp }}/artifacts_raw/devolutions-agent

      - uses: actions/download-artifact@v8
        with:
          name: git-log
          path: ${{ runner.temp }}/artifacts_raw/git-log

      - name: Prepare upload
        id: prepare
        run: |
          $version="${{ needs.preflight.outputs.version }}"
          $ref="${{ needs.preflight.outputs.ref }}"
          $shortRef=$ref.Substring(0, 8)
          $sourceFolder = "${{ runner.temp }}/artifacts_raw"
          $destinationFolder = "${{ runner.temp }}/artifacts"

          Write-Host "version = $version"
          Write-Host "ref = $ref"

          echo "version=$version" >> $Env:GITHUB_OUTPUT
          echo "short-ref=$shortRef" >> $Env:GITHUB_OUTPUT
          echo "files-to-upload=$destinationFolder" >> $Env:GITHUB_OUTPUT

          New-Item -Path "$destinationFolder" -ItemType "directory"

          function MoveArtifact([string]$RelSource, [string]$DestName) {
            $src = Join-Path $sourceFolder $RelSource
            $dst = Join-Path $destinationFolder $DestName
            Write-Host "$src --> $dst"
            Move-Item -Path $src -Destination $dst
          }

          # Create symbols ZIPs from individual PDBs (package.yml signing hasn't run yet).
          $SymbolProducts = @(
            @{ Dir = 'devolutions-gateway'; Name = 'DevolutionsGateway'; Arches = @('x64') },
            @{ Dir = 'devolutions-agent';   Name = 'DevolutionsAgent';   Arches = @('x64', 'arm64') },
            @{ Dir = 'jetsocat';            Name = 'jetsocat';           Arches = @('x64', 'arm64') }
          )
          foreach ($P in $SymbolProducts) {
            foreach ($Arch in $P.Arches) {
              $ArchDir = Join-Path $sourceFolder $P.Dir windows $Arch
              $Pdbs = Get-ChildItem -Path $ArchDir -Filter '*.pdb' -File -ErrorAction SilentlyContinue
              if ($Pdbs) {
                $Pdbs | Compress-Archive -DestinationPath (Join-Path $ArchDir "$($P.Name).symbols.zip") -CompressionLevel Optimal
              }
            }
          }

          # Gateway Windows MSI + symbols
          MoveArtifact "devolutions-gateway/windows/x64/DevolutionsGateway.msi" "DevolutionsGateway-${version}-x64.msi"
          MoveArtifact "devolutions-gateway/windows/x64/DevolutionsGateway.symbols.zip" "DevolutionsGateway-${version}-x64.symbols.zip"

          # Gateway Linux DEB/RPM/changes
          foreach ($Arch in @('x64', 'arm64')) {
            MoveArtifact "devolutions-gateway/linux/${Arch}/devolutions-gateway.deb" "devolutions-gateway_${version}_${Arch}.deb"
            MoveArtifact "devolutions-gateway/linux/${Arch}/devolutions-gateway.rpm" "devolutions-gateway_${version}_${Arch}.rpm"
            MoveArtifact "devolutions-gateway/linux/${Arch}/devolutions-gateway.changes" "devolutions-gateway_${version}_${Arch}.changes"
          }

          # Agent Windows MSI + symbols.zip
          foreach ($Arch in @('x64', 'arm64')) {
            MoveArtifact "devolutions-agent/windows/${Arch}/DevolutionsAgent.msi" "DevolutionsAgent-${version}-${Arch}.msi"
            MoveArtifact "devolutions-agent/windows/${Arch}/DevolutionsAgent.symbols.zip" "DevolutionsAgent-${version}-${Arch}.symbols.zip"
          }

          # Agent Linux DEB/RPM/changes
          foreach ($Arch in @('x64', 'arm64')) {
            MoveArtifact "devolutions-agent/linux/${Arch}/devolutions-agent.deb" "devolutions-agent_${version}_${Arch}.deb"
            MoveArtifact "devolutions-agent/linux/${Arch}/devolutions-agent.rpm" "devolutions-agent_${version}_${Arch}.rpm"
            MoveArtifact "devolutions-agent/linux/${Arch}/devolutions-agent.changes" "devolutions-agent_${version}_${Arch}.changes"
          }

          # Jetsocat archives: .tar.xz for Linux, .zip for Windows and macOS
          $Platforms = @(
            @{ OS = "windows"; Arch = "x64";       Ext = ".exe"; Archive = "zip" },
            @{ OS = "windows"; Arch = "arm64";     Ext = ".exe"; Archive = "zip" },
            @{ OS = "linux";   Arch = "x64";       Ext = "";     Archive = "tar.xz" },
            @{ OS = "linux";   Arch = "arm64";     Ext = "";     Archive = "tar.xz" },
            @{ OS = "macos";   Arch = "x64";       Ext = "";     Archive = "tar.xz" },
            @{ OS = "macos";   Arch = "arm64";     Ext = "";     Archive = "tar.xz" },
            @{ OS = "macos";   Arch = "universal"; Ext = "";     Archive = "tar.xz" }
          )

          foreach ($P in $Platforms) {
            $BinaryPath = Join-Path $sourceFolder jetsocat $P.OS $P.Arch "jetsocat$($P.Ext)"
            if (Test-Path $BinaryPath) {
              $ArchiveDst = Join-Path $destinationFolder "jetsocat-${version}-$($P.OS)-$($P.Arch).$($P.Archive)"
              $BinaryName = Split-Path $BinaryPath -Leaf
              $StageDir = Join-Path $Env:RUNNER_TEMP "jetsocat-stage-$($P.OS)-$($P.Arch)"
              New-Item -ItemType Directory -Path $StageDir -Force | Out-Null
              Copy-Item -Path $BinaryPath -Destination (Join-Path $StageDir $BinaryName) -Force
              if ($P.Archive -eq 'tar.xz') {
                tar -cJf $ArchiveDst -C $StageDir .
              } else {
                # Compress-Archive preserves the source path structure inside the ZIP.
                # Staging to a flat temp dir ensures the binary lands at the ZIP root.
                Compress-Archive -Path (Join-Path $StageDir '*') -DestinationPath $ArchiveDst -Force
              }
              Remove-Item -Path $StageDir -Recurse -Force
              Write-Host "$BinaryPath --> $ArchiveDst"
            } else {
              throw "Jetsocat binary not found: $BinaryPath"
            }
          }

          # Jetsocat Windows symbols
          foreach ($Arch in @('x64', 'arm64')) {
            $SymPath = Join-Path $sourceFolder jetsocat windows $Arch jetsocat.symbols.zip
            if (Test-Path $SymPath) {
              MoveArtifact "jetsocat/windows/${Arch}/jetsocat.symbols.zip" "jetsocat-${version}-windows-${Arch}.symbols.zip"
            } else {
              throw "Jetsocat Windows symbols not found: $SymPath"
            }
          }

          # git-log
          MoveArtifact "git-log/git-log.txt" "git-log.txt"
        shell: pwsh

      - name: Upload to OneDrive
        uses: ./.github/workflows/onedrive-upload
        with:
          azure_client_id: ${{ secrets.ONEDRIVE_AUTOMATION_CLIENT_ID }}
          azure_client_secret: ${{ secrets.ONEDRIVE_AUTOMATION_CLIENT_SECRET }}
          conflict_behavior: replace
          destination_path: /Gateway/${{ steps.prepare.outputs.version }}-${{ steps.timestamp.outputs.timestamp }}-${{ steps.prepare.outputs.short-ref }}
          remote: prereleases
          source_path: ${{ steps.prepare.outputs.files-to-upload }}