#Requires -Version 5.1
<#
.SYNOPSIS
  Production release build for Proxy God (ProxyChainManager.exe).

.DESCRIPTION
  Full pipeline:
    1. Resolve Python 3.10+
    2. Install pinned runtime + build deps
    3. Run compileall + unittest (gate)
    4. Stage SHA-verified bundled gost.exe
    5. Generate Windows VERSIONINFO for the exe
    6. PyInstaller one-file build (ProxyChainManager.spec)
    7. Optional Authenticode sign (SIGN_CERT_PATH / SIGN_CERT_PASSWORD)
    8. SHA256 sidecar + SBOM + RELEASE_MANIFEST.json
    9. Zip release folder -> releases/ProxyGod-v{version}-windows-amd64.zip

.PARAMETER Version
  Override semver (default: git tag > git describe > __version__).

.PARAMETER SkipTests
  Skip compileall/unittest (not recommended for production).

.PARAMETER SkipSign
  Skip Authenticode even if SIGN_CERT_PATH is set.

.PARAMETER NoZip
  Skip creating the release zip archive.

.EXAMPLE
  powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\release_build.ps1

.EXAMPLE
  powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\release_build.ps1 -Version 1.2.0
#>
[CmdletBinding()]
param(
    [string]$Version = "",
    [switch]$SkipTests,
    [switch]$SkipSign,
    [switch]$NoZip
)

$ErrorActionPreference = "Stop"
. "$PSScriptRoot\_build_common.ps1"

$root = Get-RepoRoot
Set-Location $root

$py = Resolve-PythonExe
Write-Host "Using: $py"
& $py -c "import sys; assert sys.version_info >= (3, 10); print(sys.version)"

$ver = Get-ReleaseVersion -Override $Version
$commit = Get-GitCommit
Write-Host "Release version: $ver  (commit $commit)"

Install-BuildDependencies -PythonExe $py -Root $root

if (-not $SkipTests) {
    Invoke-UnitTests -PythonExe $py -Root $root
} else {
    Write-Warning "Skipping test gate (-SkipTests)"
}

Invoke-StageBundledGost -Root $root
Invoke-GenerateVersionInfo -PythonExe $py -Root $root -Version $ver -Commit $commit

$exe = Invoke-PyInstallerBuild -PythonExe $py -Root $root

if (-not $SkipSign) {
    Invoke-CodeSign -ExePath $exe
}

$hashInfo = Write-ExeHashSidecar -ExePath $exe

# Assemble release directory (versioned folder under releases/)
$releaseDir = Join-Path $root "releases\v$ver"
if (Test-Path $releaseDir) { Remove-Item -Recurse -Force $releaseDir }
New-Item -ItemType Directory -Path $releaseDir | Out-Null

Copy-Item -LiteralPath $exe -Destination (Join-Path $releaseDir "ProxyChainManager.exe") -Force
Copy-Item -LiteralPath $hashInfo.Sidecar -Destination (Join-Path $releaseDir "ProxyChainManager.exe.sha256") -Force
Copy-Item -LiteralPath (Join-Path $root "LICENSE") -Destination $releaseDir -ErrorAction SilentlyContinue
Copy-Item -LiteralPath (Join-Path $root "docs\OPERATOR_RUNBOOK.md") -Destination $releaseDir -ErrorAction SilentlyContinue

$sbom = Write-Sbom -PythonExe $py -OutDir $releaseDir -Version $ver
Write-ReleaseManifest -OutDir $releaseDir -Version $ver -Commit $commit `
    -ExePath $exe -Sha256 $hashInfo.Hash -Extra @{
        sbom_file = (Split-Path -Leaf $sbom.Sbom)
        requirements_frozen = (Split-Path -Leaf $sbom.Freeze)
    }

# dist/ sidecar is already written by Write-ExeHashSidecar on $exe

if (-not $NoZip) {
    $zip = New-ReleaseZip -ReleaseDir $releaseDir -Version $ver -Root $root
    Write-Host "`n== Release complete =="
    Write-Host "  Folder: $releaseDir"
    Write-Host "  Zip:    $zip"
} else {
    Write-Host "`n== Release complete (no zip) =="
    Write-Host "  Folder: $releaseDir"
}

Write-Host "`nVerify:"
Write-Host "  Get-FileHash -Algorithm SHA256 releases\v$ver\ProxyChainManager.exe"