mpckit/build/windows/Taskfile.yml

version: '3'

includes:
  common: ../Taskfile.yml

vars:
  # Signing configuration - edit these values for your project
  # SIGN_CERTIFICATE: "path/to/certificate.pfx"
  # SIGN_THUMBPRINT: "certificate-thumbprint"  # Alternative to SIGN_CERTIFICATE
  # TIMESTAMP_SERVER: "http://timestamp.digicert.com"
  #
  # Password is stored securely in system keychain. Run: wails3 setup signing

tasks:
  build:
    summary: Builds the application for Windows
    # MPCkit builds on each system natively; there is no Docker cross-build.
    # Without cgo (the default) Go can still cross-compile for Windows.
    preconditions:
      - sh: '{{if and (ne OS "windows") (eq .CGO_ENABLED "1")}}false{{else}}true{{end}}'
        msg: "A cgo build for Windows must be made on Windows."
    cmds:
      - task: build:native
        vars:
          ARCH: '{{.ARCH}}'
          DEV: '{{.DEV}}'
          EXTRA_TAGS: '{{.EXTRA_TAGS}}'
          OBFUSCATED: '{{.OBFUSCATED}}'
          GARBLE_ARGS: '{{.GARBLE_ARGS}}'
    vars:
      # Default to CGO_ENABLED=0 if not explicitly set
      CGO_ENABLED: '{{.CGO_ENABLED | default "0"}}'

  build:native:
    summary: Builds the application using native Go cross-compilation
    internal: true
    deps:
      - task: common:go:mod:tidy
      - task: common:build:frontend
        vars:
          BUILD_FLAGS:
            ref: .BUILD_FLAGS
          OBFUSCATED:
            ref: .OBFUSCATED
          DEV:
            ref: .DEV
      - task: common:generate:icons
    preconditions:
      - sh: '{{if eq .OBFUSCATED "true"}}command -v garble >/dev/null 2>&1{{else}}true{{end}}'
        msg: "garble is required for obfuscated builds. Install it with: go install mvdan.cc/garble@v0.16.0 (requires Go 1.24+). See https://github.com/burrowers/garble/releases for version/toolchain compatibility."
    cmds:
      - task: generate:syso
        vars:
          ARCH: '{{.ARCH}}'
      - '{{if eq .OBFUSCATED "true"}}garble {{.GARBLE_ARGS}} build{{else}}go build{{end}} {{.BUILD_FLAGS}} -o "{{.BIN_DIR}}/{{.APP_NAME}}.exe"'
      - cmd: powershell Remove-item *.syso
        platforms: [windows]
      - cmd: rm -f *.syso
        platforms: [linux, darwin]
    vars:
      BUILD_FLAGS: '{{if eq .DEV "true"}}{{if or .EXTRA_TAGS (eq .OBFUSCATED "true")}}-tags {{if eq .OBFUSCATED "true"}}wails_obfuscated{{if .EXTRA_TAGS}},{{end}}{{end}}{{.EXTRA_TAGS}} {{end}}-buildvcs=false -gcflags=all="-l"{{else}}-tags production{{if eq .OBFUSCATED "true"}},wails_obfuscated{{end}}{{if .EXTRA_TAGS}},{{.EXTRA_TAGS}}{{end}} -trimpath -buildvcs=false -ldflags="-w -s -X git.monoexp.com/bajdev/mpckit/internal/app.Version={{.APP_VERSION}} -X git.monoexp.com/bajdev/mpckit/internal/app.Commit={{.COMMIT}} -H windowsgui"{{end}}'
    env:
      GOOS: windows
      CGO_ENABLED: '{{.CGO_ENABLED | default "0"}}'
      GOARCH: '{{.ARCH | default ARCH}}'

  package:
    summary: Packages the application
    cmds:
      - task: '{{if eq (.FORMAT | default "nsis") "msix"}}create:msix:package{{else}}create:nsis:installer{{end}}'
        vars:
          INSTALL_SCOPE: '{{.INSTALL_SCOPE | default "machine"}}'
    vars:
      FORMAT: '{{.FORMAT | default "nsis"}}'
      INSTALL_SCOPE: '{{.INSTALL_SCOPE | default "machine"}}'

  generate:syso:
    summary: Generates Windows `.syso` file
    dir: build
    cmds:
      - wails3 generate syso -arch {{.ARCH}} -icon windows/icon.ico -manifest windows/wails.exe.manifest -info windows/info.json -out ../wails_windows_{{.ARCH}}.syso
    vars:
      ARCH: '{{.ARCH | default ARCH}}'

  create:nsis:installer:
    summary: Creates an NSIS installer
    dir: build/windows/nsis
    deps:
      - task: build
    preconditions:
      - sh: '[ "{{.INSTALL_SCOPE}}" = "user" ] || [ "{{.INSTALL_SCOPE}}" = "machine" ]'
        msg: "INSTALL_SCOPE must be 'user' or 'machine', got '{{.INSTALL_SCOPE}}'"
    cmds:
      # Create the Microsoft WebView2 bootstrapper if it doesn't exist
      - wails3 generate webview2bootstrapper -dir "{{.ROOT_DIR}}/build/windows/nsis"
      - |
        {{if eq OS "windows"}}
        makensis {{if eq .INSTALL_SCOPE "user"}}-DWAILS_INSTALL_SCOPE=user -DREQUEST_EXECUTION_LEVEL=user {{end}}-DARG_WAILS_{{.ARG_FLAG}}_BINARY="{{.ROOT_DIR}}\{{.BIN_DIR}}\{{.APP_NAME}}.exe" project.nsi
        {{else}}
        makensis {{if eq .INSTALL_SCOPE "user"}}-DWAILS_INSTALL_SCOPE=user -DREQUEST_EXECUTION_LEVEL=user {{end}}-DARG_WAILS_{{.ARG_FLAG}}_BINARY="{{.ROOT_DIR}}/{{.BIN_DIR}}/{{.APP_NAME}}.exe" project.nsi
        {{end}}
    vars:
      ARCH: '{{.ARCH | default ARCH}}'
      ARG_FLAG: '{{if eq .ARCH "amd64"}}AMD64{{else}}ARM64{{end}}'
      INSTALL_SCOPE: '{{.INSTALL_SCOPE | default "machine"}}'

  create:msix:package:
    summary: Creates an MSIX package
    deps:
      - task: build
    cmds:
      - |-
        wails3 tool msix \
          --config "{{.ROOT_DIR}}/build/config.yml" \
          --name "{{.APP_NAME}}.exe" \
          --executable "{{.ROOT_DIR}}/{{.BIN_DIR}}/{{.APP_NAME}}.exe" \
          --arch "{{.ARCH}}" \
          --out "{{.ROOT_DIR}}/{{.BIN_DIR}}/{{.APP_NAME}}-{{.ARCH}}.msix" \
          {{if .CERT_PATH}}--cert "{{.CERT_PATH}}"{{end}} \
          {{if .PUBLISHER}}--publisher "{{.PUBLISHER}}"{{end}} \
          {{if eq .USE_MSIX_TOOL "true"}}--use-msix-tool{{else}}--use-makeappx{{end}}
    vars:
      ARCH: '{{.ARCH | default ARCH}}'
      CERT_PATH: '{{.CERT_PATH | default ""}}'
      PUBLISHER: '{{.PUBLISHER | default ""}}'
      USE_MSIX_TOOL: '{{.USE_MSIX_TOOL | default "false"}}'

  install:msix:tools:
    summary: Installs tools required for MSIX packaging
    cmds:
      - wails3 tool msix-install-tools

  run:
    cmds:
      - '{{.BIN_DIR}}/{{.APP_NAME}}.exe'

  sign:
    summary: Signs the Windows executable
    desc: |
      Signs the .exe with an Authenticode certificate.
      Set SIGN_CERTIFICATE or SIGN_THUMBPRINT to override the certificate
      configured globally via `wails3 setup` (~/.config/wails/defaults.yaml).
      Password is retrieved from system keychain (run: wails3 setup signing)
    deps:
      - task: build
    cmds:
      # Certificate vars are optional: if unset, `wails3 tool sign` falls back to
      # the certificate configured globally via `wails3 setup`.
      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}.exe" {{if .SIGN_CERTIFICATE}}--certificate "{{.SIGN_CERTIFICATE}}"{{end}} {{if .SIGN_THUMBPRINT}}--thumbprint "{{.SIGN_THUMBPRINT}}"{{end}} {{if .TIMESTAMP_SERVER}}--timestamp "{{.TIMESTAMP_SERVER}}"{{end}}

  sign:installer:
    summary: Signs the NSIS installer
    desc: |
      Creates and signs the NSIS installer.
      Set SIGN_CERTIFICATE or SIGN_THUMBPRINT to override the certificate
      configured globally via `wails3 setup` (~/.config/wails/defaults.yaml).
      Password is retrieved from system keychain (run: wails3 setup signing)
    deps:
      - task: create:nsis:installer
        vars:
          INSTALL_SCOPE: '{{.INSTALL_SCOPE | default "machine"}}'
    vars:
      INSTALL_SCOPE: '{{.INSTALL_SCOPE | default "machine"}}'
    cmds:
      - wails3 tool sign --input "build/windows/nsis/{{.APP_NAME}}-installer.exe" {{if .SIGN_CERTIFICATE}}--certificate "{{.SIGN_CERTIFICATE}}"{{end}} {{if .SIGN_THUMBPRINT}}--thumbprint "{{.SIGN_THUMBPRINT}}"{{end}} {{if .TIMESTAMP_SERVER}}--timestamp "{{.TIMESTAMP_SERVER}}"{{end}}