Build-Release.ps1

<# Build the portable ZIP and IExpress-based current-user EXE installer. #>
[CmdletBinding()]
param()

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
$version = (Get-Content -Raw -LiteralPath (Join-Path $PSScriptRoot 'VERSION')).Trim()
$product = "PythonGuardian-$version"
$buildRoot = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot 'build'))
$distRoot = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot 'dist'))
$payloadRoot = Join-Path $buildRoot $product

foreach ($target in $buildRoot, $distRoot) {
    $base = [System.IO.Path]::GetFullPath($PSScriptRoot).TrimEnd('\') + '\'
    if (-not $target.StartsWith($base, [System.StringComparison]::OrdinalIgnoreCase)) {
        throw "Unsafe release target: $target"
    }
    if (Test-Path -LiteralPath $target) { Remove-Item -LiteralPath $target -Recurse -Force }
    New-Item -ItemType Directory -Path $target | Out-Null
}
New-Item -ItemType Directory -Path $payloadRoot | Out-Null

$files = @(
    'guardian_client.py', 'guardian_common.py', 'guardian_ctl.py', 'guardian_panic.py',
    'guardian_report_viewer.pyw', 'python_arg_launcher.pyw', 'python_console_runner.py',
    'python_guardian_broker.pyw', 'pyguard.py', 'Install-PythonFileLauncher.ps1',
    'Install-PythonGuardianRuntime.ps1', 'Install-PythonGuardian.ps1',
    'Uninstall-PythonGuardian.ps1', 'Remove-PythonGuardianFiles.ps1',
    'Build-Release.ps1', 'requirements-build.txt', 'test_python_arg_launcher.py',
    'LICENSE', 'README.md', 'readme.txt', 'CHANGELOG.md', 'CONTRIBUTING.md',
    'RELEASE_NOTES.md', 'SECURITY.md', 'PRIVACY.md', 'TERMS.md',
    'THIRD_PARTY_NOTICES.txt', 'VERSION', '.gitignore', '.gitattributes'
)
foreach ($name in $files) {
    Copy-Item -LiteralPath (Join-Path $PSScriptRoot $name) -Destination $payloadRoot
}
New-Item -ItemType Directory -Path (Join-Path $payloadRoot 'guardian_inject') | Out-Null
Copy-Item -LiteralPath (Join-Path $PSScriptRoot 'guardian_inject\sitecustomize.py') `
    -Destination (Join-Path $payloadRoot 'guardian_inject\sitecustomize.py')
New-Item -ItemType Directory -Path (Join-Path $payloadRoot 'installer') | Out-Null
Copy-Item -LiteralPath (Join-Path $PSScriptRoot 'installer\bootstrap_exe.py') `
    -Destination (Join-Path $payloadRoot 'installer\bootstrap_exe.py')

$zip = Join-Path $distRoot "$product.zip"
Compress-Archive -LiteralPath $payloadRoot -DestinationPath $zip -CompressionLevel Optimal

$exe = Join-Path $distRoot "$product-Setup.exe"
$buildEnvironment = Join-Path $PSScriptRoot 'build_tools\pyinstaller_venv'
$buildPython = Join-Path $buildEnvironment 'Scripts\python.exe'
if (-not (Test-Path -LiteralPath $buildPython -PathType Leaf)) {
    $systemPython = (Get-Command python.exe -ErrorAction SilentlyContinue).Source
    if (-not $systemPython) {
        $pyLauncher = Get-Command py.exe -ErrorAction SilentlyContinue
        if ($pyLauncher) {
            $systemPython = & $pyLauncher.Source -3 -c 'import sys; print(sys.executable)'
        }
    }
    if (-not $systemPython) { throw 'Python 3.10+ is required to build the installer.' }
    & $systemPython -m venv $buildEnvironment
    if ($LASTEXITCODE) { throw 'Could not create the isolated build environment.' }
    & $buildPython -m pip install -r (Join-Path $PSScriptRoot 'requirements-build.txt')
    if ($LASTEXITCODE) { throw 'Could not install the pinned build dependency.' }
}
$pyinstaller = Join-Path $buildEnvironment 'Scripts\pyinstaller.exe'
& $pyinstaller --noconfirm --clean --onefile --console `
    --name "$product-Setup" `
    --distpath $distRoot --workpath (Join-Path $buildRoot 'pyinstaller-work') `
    --specpath $buildRoot `
    --add-data "${zip};." `
    --add-data "$(Join-Path $PSScriptRoot 'LICENSE');." `
    (Join-Path $PSScriptRoot 'installer\bootstrap_exe.py')
if (-not (Test-Path -LiteralPath $exe -PathType Leaf)) {
    throw 'PyInstaller did not produce the installer executable.'
}

$hashes = foreach ($artifact in $zip, $exe) {
    $hash = Get-FileHash -LiteralPath $artifact -Algorithm SHA256
    "{0}  {1}" -f $hash.Hash.ToLowerInvariant(), (Split-Path $artifact -Leaf)
}
$checksumPath = Join-Path $distRoot 'SHA256SUMS.txt'
Set-Content -LiteralPath $checksumPath -Value $hashes -Encoding ASCII
Write-Output "Built: $zip"
Write-Output "Built: $exe"
Write-Output "Checksums: $checksumPath"