build: production Windows release pipeline (PyInstaller, SBOM, CI, signing hook)

scripts/setup_and_build.ps1

@@ -1,75 +1,48 @@
 #Requires -Version 5.1
 <#
 .SYNOPSIS
-  After git pull: upgrade pip, install deps, build ProxyChainManager.exe, copy to Desktop, create "Proxy God.lnk".
+  Developer build: deps, tests (optional), PyInstaller, copy to Desktop, shortcut.
 
 .DESCRIPTION
-  Requires Python 3.10+ on PATH (python.exe) or the Windows py launcher (py -3).
-  Does not auto-install Python; see README for winget one-liner if needed.
-#>
-$ErrorActionPreference = "Stop"
-$root = Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.Path)
-Set-Location $root
+  Lighter than release_build.ps1 — skips SBOM/zip/manifest. For daily dev iteration.
+  Production releases: use scripts\release_build.ps1 or build_release.bat
 
-function Resolve-PythonExe {
-    if (Get-Command py -ErrorAction SilentlyContinue) {
-        try {
-            $out = (& py -3 -c "import sys; print(sys.executable)" 2>$null).Trim()
-            if ($out -and (Test-Path -LiteralPath $out)) { return $out }
-        } catch { }
-    }
-    $p = Get-Command python.exe -ErrorAction SilentlyContinue
-    if ($p) { return $p.Source }
-    throw (
-        "Python 3.10+ not found (tried 'py -3' and 'python'). Install, then re-run:`n" +
-        "  winget install Python.Python.3.12 --accept-package-agreements --accept-source-agreements`n" +
-        "Or https://www.python.org/downloads/ (enable 'Add python.exe to PATH')."
-    )
-}
+.PARAMETER SkipTests
+  Skip unittest gate (faster iteration).
+#>
+[CmdletBinding()]
+param([switch]$SkipTests)
+
+$ErrorActionPreference = "Stop"
+. "$PSScriptRoot\_build_common.ps1"
+
+$root = Get-RepoRoot
+Set-Location $root
 
 $py = Resolve-PythonExe
 Write-Host "Using: $py"
-& $py -c "import sys; assert sys.version_info >= (3, 10), 'Need Python 3.10+'; print(sys.version)"
+& $py -c "import sys; assert sys.version_info >= (3, 10); print(sys.version)"
 
-Write-Host "`n== pip (upgrade) =="
-& $py -m pip install --upgrade pip
+$ver = Get-ReleaseVersion
+Install-BuildDependencies -PythonExe $py -Root $root
 
-Write-Host "`n== dependencies + PyInstaller =="
-& $py -m pip install -r "$root\requirements.txt"
-# Pinned dev dep (PyInstaller version) so builds are reproducible.
-& $py -m pip install -r "$root\dev-requirements.txt"
-
-Write-Host "`n== Stage bundled GOST binary =="
-& powershell -NoProfile -ExecutionPolicy Bypass -File "$root\scripts\prepare_bundled_gost.ps1"
-if ($LASTEXITCODE -ne 0) { throw "prepare_bundled_gost.ps1 failed (exit $LASTEXITCODE)" }
-
-Write-Host "`n== PyInstaller (using ProxyChainManager.spec) =="
-# Always build from the spec — it bundles signup_extension/, world_map.png,
-# customtkinter assets, and the right hidden imports. Do NOT override with
-# CLI flags or the data files will be missing from the .exe.
-$spec = Join-Path $root "ProxyChainManager.spec"
-if (-not (Test-Path $spec)) { throw "Spec not found: $spec" }
-& $py -m PyInstaller --noconfirm --clean $spec
-if ($LASTEXITCODE -ne 0) { throw "PyInstaller failed (exit $LASTEXITCODE)" }
-
-$distExe = Join-Path $root "dist\ProxyChainManager.exe"
-if (-not (Test-Path $distExe)) {
-    throw "Build failed: missing $distExe"
+if (-not $SkipTests) {
+    Invoke-UnitTests -PythonExe $py -Root $root
 }
 
-# SHA256 sidecar so the release artifact is self-verifiable.
-$distHashFile = "$distExe.sha256"
-$distHash = (Get-FileHash -Algorithm SHA256 -LiteralPath $distExe).Hash.ToLower()
-"$distHash *ProxyChainManager.exe" | Out-File -FilePath $distHashFile -Encoding ascii -Force
-Write-Host "SHA256: $distHash → $distHashFile"
+Invoke-StageBundledGost -Root $root
+Invoke-GenerateVersionInfo -PythonExe $py -Root $root -Version $ver -Commit (Get-GitCommit)
+
+$exe = Invoke-PyInstallerBuild -PythonExe $py -Root $root
+$hashInfo = Write-ExeHashSidecar -ExePath $exe
 
 $desk = [Environment]::GetFolderPath("Desktop")
 $deskExe = Join-Path $desk "ProxyChainManager.exe"
-Copy-Item -LiteralPath $distExe -Destination $deskExe -Force
-Copy-Item -LiteralPath $distHashFile -Destination "$deskExe.sha256" -Force
+Copy-Item -LiteralPath $exe -Destination $deskExe -Force
+Copy-Item -LiteralPath $hashInfo.Sidecar -Destination "$deskExe.sha256" -Force
 Write-Host "Copied: $deskExe (+ .sha256)"
 
 Write-Host "`n== Desktop shortcut =="
-& powershell -NoProfile -ExecutionPolicy Bypass -File "$root\scripts\create_desktop_shortcut.ps1"
+& powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $root "scripts\create_desktop_shortcut.ps1")
 
 Write-Host "`nDone. Launch from Desktop: Proxy God.lnk (or ProxyChainManager.exe)"