name: Relay Windows process-tree addons

# Why a reusable workflow: every desktop package ships relays for Windows SSH hosts,
# but only a Windows runner can compile the addon that launches a relay outside
# sshd's job. macOS and Linux packaging jobs download this artifact into
# .build/windows-process-tree before `pnpm build:release` stages it.
on:
  workflow_call:
    inputs:
      ref:
        description: Commit or tag to build; must match what the packaging job checks out.
        required: true
        type: string

permissions:
  contents: read

jobs:
  build:
    # Why windows-2022: windows-latest moved to VS 2026 before node-gyp could detect
    # it. GitHub-hosted, so release-cut's SignPath provenance rule still holds.
    runs-on: windows-2022
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}
          persist-credentials: false

      # Plain setup rather than a composite action: `uses: ./` resolves from the
      # checked-out ref, which may be a release tag that predates the action.
      - name: Setup pnpm
        uses: pnpm/setup@v2
        with:
          install: false

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      # Why host-only: the addon is compiled from the patched source pnpm
      # materializes, and arm64 cross-compiles through node-gyp --arch.
      - name: Install dependencies
        uses: nick-fields/retry@v4
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: pnpm install --frozen-lockfile

      # The build script refuses unpatched source and checks each output's PE
      # machine, ReadProcessMemory import, and spawnOutsideJob export.
      - name: Build Windows process-table addons for the relay
        shell: bash
        run: |
          node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=x64
          node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=arm64

      - name: Upload relay addons
        uses: actions/upload-artifact@v7
        with:
          name: relay-windows-process-tree
          path: .build/windows-process-tree/
          if-no-files-found: error
          retention-days: 7
          # A rerun attempt re-uploads under the same name, which is otherwise refused.
          overwrite: true