name: Windows Server 2012 R2 Offline Compatibility

on:
  workflow_dispatch:
    inputs:
      run_remote_smoke_test:
        description: Run the optional WinRM smoke test after building
        required: true
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: windows-server-2012-r2-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_INCREMENTAL: "0"
  RUSTFLAGS: -C debuginfo=line-tables-only -C target-feature=+crt-static

jobs:
  build-win7-server2012r2-offline:
    name: Build Win7 / Server 2012 R2 Offline Installer
    runs-on: windows-2022
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v5

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.27.0

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22.13.0
          cache: pnpm

      - name: Install frontend dependencies
        run: pnpm install --frozen-lockfile

      - name: Setup Rust compatibility toolchain
        uses: dtolnay/rust-toolchain@nightly
        with:
          toolchain: nightly-2026-07-22
          components: rust-src

      - name: Prepare WebView2 109 fixed runtime
        shell: pwsh
        run: ./.github/scripts/prepare-webview2-win7-runtime.ps1

      - name: Prepare Win7 / Server 2012 R2 WebView2 loader
        shell: pwsh
        run: ./.github/scripts/prepare-webview2-win7-loader.ps1

      - name: Build frontend
        run: pnpm build

      - name: Build DBX compatibility binary
        shell: pwsh
        run: |
          $env:TAURI_CONFIG = Get-Content src-tauri/tauri.webview2-win7-fixed.conf.json -Raw
          cargo build --locked --package dbx --release --features custom-protocol --target x86_64-win7-windows-msvc -Z build-std=std,panic_abort

      - name: Audit compatibility PE imports
        shell: pwsh
        run: ./.github/scripts/assert-win7-pe-compat.ps1 -BinaryPath target/x86_64-win7-windows-msvc/release/dbx.exe

      - name: Bundle Win7 / Server 2012 R2 offline installer
        shell: pwsh
        run: |
          $bundleDir = "target/x86_64-win7-windows-msvc/release/bundle/nsis"
          pnpm tauri bundle --bundles nsis --target x86_64-win7-windows-msvc `
            --config src-tauri/tauri.webview2-win7-fixed.conf.json
          $installer = Get-ChildItem $bundleDir -Filter "*.exe" |
            Sort-Object LastWriteTimeUtc -Descending |
            Select-Object -First 1
          if (!$installer) {
            throw "Missing Win7 / Server 2012 R2 fixed-runtime installer in $bundleDir"
          }
          Copy-Item -LiteralPath $installer.FullName `
            -Destination "DBX_${{ github.sha }}_x64-win7-server2012r2-webview2-109-offline-setup.exe" `
            -Force

      - name: Audit installer contents
        shell: pwsh
        run: |
          $installer = Get-ChildItem -Filter "DBX_*_x64-win7-server2012r2-webview2-109-offline-setup.exe" |
            Select-Object -First 1
          ./.github/scripts/assert-win7-installer-content.ps1 -InstallerPath $installer.FullName

      - name: Upload Win7 / Server 2012 R2 test installer
        uses: actions/upload-artifact@v4
        with:
          name: DBX-win7-server2012r2-offline-test
          path: DBX_*_x64-win7-server2012r2-webview2-109-offline-setup.exe
          if-no-files-found: error
          retention-days: 7

  smoke-test-on-server-2012-r2:
    name: Smoke Test Installer on Server 2012 R2
    if: ${{ inputs.run_remote_smoke_test }}
    needs: build-win7-server2012r2-offline
    runs-on: [self-hosted, Windows, X64, server-2012-r2-controller]
    environment: windows-server-2012-r2-testing
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v5

      - name: Download test installer
        uses: actions/download-artifact@v5
        with:
          name: DBX-win7-server2012r2-offline-test
          path: installer

      - name: Install and start DBX on Server 2012 R2
        shell: pwsh
        env:
          SERVER2012_HOST: ${{ secrets.SERVER2012_HOST }}
          SERVER2012_USERNAME: ${{ secrets.SERVER2012_USERNAME }}
          SERVER2012_PASSWORD: ${{ secrets.SERVER2012_PASSWORD }}
          SERVER2012_USE_SSL: ${{ vars.SERVER2012_USE_SSL }}
        run: |
          $installer = Get-ChildItem installer -Filter "*.exe" | Select-Object -First 1
          if (!$installer) {
            throw "The Win7 / Server 2012 R2 installer artifact is missing."
          }
          ./.github/scripts/invoke-server2012-remote-validation.ps1 `
            -ComputerName $env:SERVER2012_HOST `
            -UserName $env:SERVER2012_USERNAME `
            -Mode Installer `
            -InstallerPath $installer.FullName

      - name: Upload verified Win7 / Server 2012 R2 installer
        uses: actions/upload-artifact@v4
        with:
          name: DBX-win7-server2012r2-offline-verified
          path: installer/*.exe
          if-no-files-found: error
          retention-days: 14