deploy.yml

# ═══════════════════════════════════════════════════════════════════════════════
# WRAITH — Build & Release
#
# Trigger : push to main         →  prerelease build (v$NEXT-dev.$RUN, never latest)
#           push of v*.*.* tag   →  stable release   (latest gated by SemVer compare)
#
# To cut a stable release: bump VERSION on main, wait for the prerelease build to
# go green, then `git tag vX.Y.Z && git push origin vX.Y.Z`.
#
# Artifact: WRAITH-<version>-win-x64.zip
#   ├── WRAITH.exe        (self-contained, .NET runtime bundled — no SDK needed)
#   ├── START.bat         (click-to-run: Python venv → deps → launch)
#   ├── scanner/          (Python scan engine + YARA rules)
#   ├── quick-scan.ps1    (headless scan, no build required)
#   ├── README.md
#   └── LICENSE
# ═══════════════════════════════════════════════════════════════════════════════
name: Deploy

on:
  push:
    branches: [ main ]
    tags:     [ 'v[0-9]+.[0-9]+.[0-9]+' ]

permissions:
  contents:          write   
  security-events:   write   

jobs:
  build-and-release:
    name: Build & Release (Windows x64)
    runs-on: windows-latest

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            nuget.org:443
            api.nuget.org:443
            pypi.org:443
            files.pythonhosted.org:443
            timestamp.digicert.com:443
            dl.dod.certificate.gov:443

      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0        

      - name: Setup .NET 8
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '8.0.x'

      - name: Derive version
        id: ver
        shell: pwsh
        env:
          REF_TYPE: ${{ github.ref_type }}
          REF_NAME: ${{ github.ref_name }}
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          git fetch --tags --quiet

          if ($env:REF_TYPE -eq 'tag') {
            # ── Stable release path ───────────────────────────────────────
            # The pushed tag IS the version. Operator made the choice
            # intentionally; if it's a backport the GitHub server will
            # decline to mark it latest via make_latest=legacy.
            $v = $env:REF_NAME
            if ($v -notmatch '^v(\d+)\.(\d+)\.(\d+)$') {
              throw "Tag '$v' does not match vMAJOR.MINOR.PATCH (the trigger filter should have prevented this)."
            }
            $packVer      = $v.TrimStart('v')
            $assemblyVer  = "$packVer.0"
            $prerelease   = 'false'
            $makeLatest   = 'legacy'   # GitHub server picks latest by SemVer
            Write-Host "Stable release: $v"
          }
          else {
            # ── Prerelease build path (main push) ─────────────────────────
            $raw = (Get-Content VERSION -Raw).Trim()
            $parts = $raw.Split('.')
            if ($parts.Count -lt 2 -or $parts.Count -gt 3) {
              throw "VERSION must be 'major.minor' or 'major.minor.patch'. Got: '$raw'"
            }
            $major = [int]$parts[0]
            $minor = [int]$parts[1]
            $seedPatch = if ($parts.Count -eq 3) { [int]$parts[2] } else { 0 }

            # Next patch in this major.minor — only stable tags count,
            # prereleases (v*-dev.N) must not influence the patch number.
            $maxPatch = -1
            foreach ($t in (git tag -l "v${major}.${minor}.*" 2>$null)) {
              if ($t -match "^v(\d+)\.(\d+)\.(\d+)$" -and [int]$Matches[1] -eq $major -and [int]$Matches[2] -eq $minor) {
                $p = [int]$Matches[3]
                if ($p -gt $maxPatch) { $maxPatch = $p }
              }
            }
            $patch       = [Math]::Max($seedPatch, $maxPatch + 1)
            $nextStable  = [version]"$major.$minor.$patch"

            # Stale-VERSION guard against the highest existing stable tag.
            # Prevents the foot-gun where VERSION lags behind the latest
            # stable release — without this guard a main push could ship
            # a prerelease that, once promoted, would downgrade users.
            $maxTag = $null
            foreach ($t in (git tag -l "v*" 2>$null)) {
              if ($t -match '^v(\d+\.\d+\.\d+)$') {
                $tv = [version]$Matches[1]
                if ($null -eq $maxTag -or $tv -gt $maxTag) { $maxTag = $tv }
              }
            }
            if ($null -ne $maxTag -and $nextStable -le $maxTag) {
              $suggested = "$($maxTag.Major).$($maxTag.Minor + 1)"
              throw @"
VERSION file is stale.
  Would build prerelease for:   v$nextStable
  Highest existing stable tag:  v$maxTag

Bump VERSION to '$suggested' (or higher) and push again.
"@
            }

            # Prereleases carry the run number so multiple main pushes for
            # the same upcoming stable version don't collide on the same tag.
            $v           = "v$nextStable-dev.$($env:RUN_NUMBER)"
            $packVer     = "$nextStable-dev.$($env:RUN_NUMBER)"
            # AssemblyVersion is the 4-part numeric and can't carry -dev.N.
            # Velopack's portable-mode fallback compares this against the
            # latest .nupkg version, so it must reflect the next-stable
            # target — not the previous stable, or the popup will fire
            # forever for portable users on the prior release.
            $assemblyVer = "$nextStable.0"
            $prerelease  = 'true'
            $makeLatest  = 'false'
            Write-Host "Prerelease build: $v (next stable would be v$nextStable)"
          }

          # NOTE: the tag is deliberately NOT pushed here. softprops/action-gh-release
          # creates it at release time, so a build failure leaves no orphan tag.
          # For tag-triggered runs the tag already exists and is reused as-is.

          Write-Output "version=$v"                       >> $env:GITHUB_OUTPUT
          Write-Output "pack_version=$packVer"            >> $env:GITHUB_OUTPUT
          Write-Output "assembly_version=$assemblyVer"    >> $env:GITHUB_OUTPUT
          Write-Output "zip=WRAITH-${v}-win-x64.zip"      >> $env:GITHUB_OUTPUT
          Write-Output "prerelease=$prerelease"           >> $env:GITHUB_OUTPUT
          Write-Output "make_latest=$makeLatest"          >> $env:GITHUB_OUTPUT


      - name: Publish WRAITH (self-contained, win-x64)
        shell: pwsh
        run: |
          # Stamp the real version into the binary. Without this the csproj
          # default (1.0.0) is what Velopack's portable-mode fallback reads
          # via Assembly.GetEntryAssembly().GetName().Version, so every
          # release-vs-installed comparison would be wrong for users who
          # downloaded the zip from the website.
          dotnet publish WRAITH/WRAITH.csproj `
            --configuration Release `
            --runtime win-x64 `
            --self-contained true `
            -p:PublishSingleFile=true `
            -p:IncludeNativeLibrariesForSelfExtract=true `
            -p:DebugType=None `
            -p:DebugSymbols=false `
            -p:Version=${{ steps.ver.outputs.pack_version }} `
            -p:AssemblyVersion=${{ steps.ver.outputs.assembly_version }} `
            -p:FileVersion=${{ steps.ver.outputs.assembly_version }} `
            -p:InformationalVersion=${{ steps.ver.outputs.pack_version }} `
            --output ./publish
          Write-Host "Published files:"
          Get-ChildItem ./publish | Select-Object Name, Length

      - name: Generate .NET SBOM (SPDX)
        uses: anchore/sbom-action@v0
        with:
          path:              ./publish
          artifact-name:     sbom-dotnet-${{ steps.ver.outputs.version }}.spdx.json
          output-file:       ./sbom-dotnet.spdx.json
          format:            spdx-json
          upload-artifact:   true

      - name: Generate .NET SBOM (CycloneDX)
        uses: anchore/sbom-action@v0
        with:
          path:              ./publish
          artifact-name:     sbom-dotnet-${{ steps.ver.outputs.version }}.cyclonedx.json
          output-file:       ./sbom-dotnet.cyclonedx.json
          format:            cyclonedx-json
          upload-artifact:   true

      - name: Sign WRAITH.exe
        env:
          SIGNING_CERT_PFX:      ${{ secrets.SIGNING_CERT_PFX }}
          SIGNING_CERT_PASSWORD: ${{ secrets.SIGNING_CERT_PASSWORD }}
        shell: pwsh
        run: |
          $exePath = "./publish/WRAITH.exe"

          if ($env:SIGNING_CERT_PFX) {
            # ── Trusted CA cert from repo secrets (production path) ────────────
            Write-Host "Signing with trusted CA certificate from secrets..."

            $pfxPath = Join-Path $env:TEMP "wraith-sign.pfx"
            [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:SIGNING_CERT_PFX))

            $secPwd = ConvertTo-SecureString $env:SIGNING_CERT_PASSWORD -AsPlainText -Force
            $cert   = Import-PfxCertificate -FilePath $pfxPath `
                        -CertStoreLocation Cert:\CurrentUser\My `
                        -Password $secPwd
            Remove-Item $pfxPath -Force   # never leave the PFX on disk

            $result = Set-AuthenticodeSignature `
                        -FilePath        $exePath `
                        -Certificate     $cert `
                        -TimestampServer "http://timestamp.digicert.com" `
                        -HashAlgorithm   SHA256

            if ($result.Status -notin @("Valid", "UnknownError")) {
              Write-Error "Signing failed: $($result.StatusMessage)"
              exit 1
            }
          } else {
            # ── Self-signed fallback (no secrets configured) ───────────────────
            # Binary is Authenticode-signed so the signature field is present.
            # Windows SmartScreen will show "Unknown Publisher" — users can click
            # through. Upgrade to a trusted cert by adding SIGNING_CERT_PFX secret.
            Write-Host "::warning::SIGNING_CERT_PFX not set — using self-signed certificate. Users will see 'Unknown Publisher' warning."

            $cert = New-SelfSignedCertificate `
                      -Subject         "CN=WRAITH Open Source, O=OpenSource-For-Freedom" `
                      -Type            CodeSigning `
                      -CertStoreLocation Cert:\CurrentUser\My `
                      -KeySpec         Signature `
                      -HashAlgorithm   SHA256 `
                      -KeyLength       4096 `
                      -NotAfter        (Get-Date).AddYears(1)

            $result = Set-AuthenticodeSignature `
                        -FilePath    $exePath `
                        -Certificate $cert `
                        -HashAlgorithm SHA256

            if ($result.Status -notin @("Valid", "UnknownError")) {
              Write-Error "Self-signing failed: $($result.StatusMessage)"
              exit 1
            }
          }

          # Verify embedded signature is readable regardless of cert type
          $sig = Get-AuthenticodeSignature $exePath
          Write-Host "Signed OK  status=$($sig.Status)  signer='$($sig.SignerCertificate.Subject)'"

      - name: Stage release bundle
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Path ./release -Force | Out-Null

          # Core exe
          Copy-Item ./publish/WRAITH.exe ./release/WRAITH.exe

          # Python scan engine + bundled YARA rules
          Copy-Item -Recurse ./scanner ./release/scanner

          # Automation scripts required by tray menu actions
          Copy-Item -Recurse ./automation ./release/automation

          # Headless quick-scan (no build needed, pure PowerShell)
          Copy-Item ./quick-scan.ps1 ./release/quick-scan.ps1

          # Docs
          Copy-Item ./README.md ./release/README.md
          Copy-Item ./LICENSE   ./release/LICENSE

          # Blank env template so the app never picks up a stale machine path
          '{ "python": "", "scanner_dir": "" }' |
            Set-Content ./release/wraith.env.json -Encoding UTF8

      - name: Generate Python scanner SBOM
        uses: anchore/sbom-action@v0
        with:
          path:              ./scanner
          artifact-name:     sbom-scanner-${{ steps.ver.outputs.version }}.spdx.json
          output-file:       ./sbom-scanner.spdx.json
          format:            spdx-json
          upload-artifact:   true

      - name: Write START.bat
        shell: pwsh
        run: |
          $bat = @'
          @echo off
          setlocal enabledelayedexpansion

          echo.
          echo  =======================================================================
          echo   W R A I T H  --  WINDOWS RUNTIME AUTOMATED INTELLIGENCE THREAT HUNTER
          echo  ==========================================
          echo.

          set ROOT=%~dp0
          set VENV_DIR=%ROOT%.venv
          set VENV_PYTHON=%VENV_DIR%\Scripts\python.exe
          set VENV_PIP=%VENV_DIR%\Scripts\pip.exe
          set REQ=%ROOT%scanner\requirements.txt
          set EXE=%ROOT%WRAITH.exe

          :: ── Detect Windows version → choose most secure Python ──────────────
          set WIN_BUILD_NUM=19041
          for /f "tokens=3" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2^>nul ^| findstr /i "CurrentBuildNumber"') do set WIN_BUILD_NUM=%%a
          if %WIN_BUILD_NUM% GEQ 22000 (
              echo  [OS] Windows 11  Build %WIN_BUILD_NUM%  --  Python 3.14 selected
              set PY_WINGET=Python.Python.3.14
              set PY_WINGET_FB=Python.Python.3.13
              set PY_VER=3.14
              set PY_URL=https://www.python.org/ftp/python/3.14.0/python-3.14.0-amd64.exe
          ) else (
              echo  [OS] Windows 10  Build %WIN_BUILD_NUM%  --  Python 3.12 selected
              set PY_WINGET=Python.Python.3.12
              set PY_WINGET_FB=Python.Python.3.11
              set PY_VER=3.12
              set PY_URL=https://www.python.org/ftp/python/3.12.9/python-3.12.9-amd64.exe
          )

          :: ── Step 1: Verify / auto-install Python ──────────────────────────
          echo [1/3] Checking Python...
          where python >nul 2>&1
          if %ERRORLEVEL% NEQ 0 (
              echo  Python not found. Installing Python %PY_VER% automatically...
              echo.

              :: Try winget first (built into Windows 10 1709+ / Windows 11)
              where winget >nul 2>&1
              if !ERRORLEVEL! EQU 0 (
                  echo  Using winget to install %PY_WINGET%...
                  winget install --id %PY_WINGET% --source winget ^^
                    --silent --accept-package-agreements --accept-source-agreements
                  if !ERRORLEVEL! NEQ 0 (
                      echo  Trying fallback %PY_WINGET_FB%...
                      winget install --id %PY_WINGET_FB% --source winget ^^
                        --silent --accept-package-agreements --accept-source-agreements
                  )
              ) else (
                  echo  winget not available. Downloading Python %PY_VER% installer...
                  powershell -NoProfile -Command ^^
                    "Invoke-WebRequest -Uri '%PY_URL%' -OutFile '%TEMP%\python-setup.exe'; Write-Host '  Download complete.'"

                  :: ── Authenticode integrity check before execution ───────────
                  powershell -NoProfile -Command ^^
                    "$f='%TEMP%\python-setup.exe'; $sig=Get-AuthenticodeSignature $f; if ($sig.Status -ne 'Valid') { Write-Error ('Installer signature invalid: ' + $sig.Status); exit 1 }; $subj=$sig.SignerCertificate.Subject; if ($subj -notmatch 'Python Software Foundation') { Write-Error ('Unexpected signer: ' + $subj); exit 1 }; Write-Host '  Signature OK: ' $subj"
                  if !ERRORLEVEL! NEQ 0 (
                      echo  ERROR: Python installer failed signature verification. Aborting install.
                      del /f /q "%TEMP%\python-setup.exe" >nul 2>&1
                      pause
                      exit /b 1
                  )

                  echo  Running silent installer (this may take a minute)...
                  "%TEMP%\python-setup.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1
                  del /f /q "%TEMP%\python-setup.exe" >nul 2>&1
              )

              :: Reload user PATH so python is visible without reopening the shell
              for /f "tokens=*" %%P in ('powershell -NoProfile -Command ^^
                "[Environment]::GetEnvironmentVariable('PATH','User')"') do set "PATH=%%P;%PATH%"

              where python >nul 2>&1
              if !ERRORLEVEL! NEQ 0 (
                  echo.
                  echo  Python was installed but is not on PATH yet.
                  echo  Please close this window and run START.bat again.
                  pause
                  exit /b 1
              )
              echo  Python installed successfully.
          )
          python --version
          echo  Python OK.

          :: ── Register Python in user PATH permanently (idempotent) ───────────
          for /f "delims=" %%P in ('python -c "import os,sys; print(os.path.dirname(sys.executable))" 2^>nul') do set "PY_INSTALL_DIR=%%P"
          if defined PY_INSTALL_DIR powershell -NoProfile -Command "$d='%PY_INSTALL_DIR%'; $s=$d+'\Scripts'; $p=[Environment]::GetEnvironmentVariable('PATH','User'); if (($p -split ';') -notcontains $d) { [Environment]::SetEnvironmentVariable('PATH', $d+';'+$s+';'+$p, 'User') }" >nul 2>&1

          :: ── Step 2: Python venv + dependencies ────────────────────────────
          echo.
          echo [2/3] Setting up Python environment...
          if not exist "%VENV_PYTHON%" (
              echo  Creating virtual environment...
              python -m venv "%VENV_DIR%"
              if %ERRORLEVEL% NEQ 0 (
                  echo  ERROR: Failed to create venv.
                  pause
                  exit /b 1
              )
          ) else (
              echo  Reusing existing venv.
          )

          echo  Installing scan dependencies (first run may take a minute)...
          "%VENV_PYTHON%" -m pip install --upgrade pip --quiet --disable-pip-version-check
          "%VENV_PIP%" install -r "%REQ%" --quiet --disable-pip-version-check
          if %ERRORLEVEL% NEQ 0 (
              echo  WARNING: Some packages failed. YARA scanning may be unavailable.
              echo  All other modules will still run.
          ) else (
              echo  Dependencies OK.
          )

          :: Write env config so WRAITH.exe finds the correct python
          powershell -NoProfile -Command ^
            "@{ python = '%VENV_PYTHON:\=\\%'; scanner_dir = '%ROOT:\=\\%scanner' } | ConvertTo-Json | Set-Content '%ROOT:\=\\%wraith.env.json' -Encoding UTF8"

          :: ── Step 3: Launch ─────────────────────────────────────────────────
          echo.
          echo [3/3] Launching WRAITH...
          if not exist "%EXE%" (
              echo  ERROR: WRAITH.exe not found at %EXE%
              pause
              exit /b 1
          )

          taskkill /F /T /IM WRAITH.exe >nul 2>&1

          start "" "%EXE%"
          echo  WRAITH launched.
          timeout /t 2 >nul
          '@

          # Trim the leading spaces that the heredoc indentation adds
          $lines = $bat -split "`n" | ForEach-Object { $_ -replace '^\s{10}', '' }
          $lines -join "`r`n" | Set-Content ./release/START.bat -Encoding ASCII

      - name: Install Velopack CLI
        run: dotnet tool install -g vpk

      # Velopack requires a NORMAL (non-single-file) publish to work correctly.
      # Single-file merges all assemblies into one blob that Velopack cannot
      # introspect, sign delta patches against, or bootstrap its update hooks into.
      # We keep the single-file publish above for the ZIP/START.bat distribution,
      # and produce a separate multi-file output purely for the Velopack installer.
      - name: Publish WRAITH for Velopack (multi-file, win-x64)
        shell: pwsh
        run: |
          dotnet publish WRAITH/WRAITH.csproj `
            --configuration Release `
            --runtime win-x64 `
            --self-contained true `
            -p:DebugType=None `
            -p:DebugSymbols=false `
            -p:Version=${{ steps.ver.outputs.pack_version }} `
            -p:AssemblyVersion=${{ steps.ver.outputs.assembly_version }} `
            -p:FileVersion=${{ steps.ver.outputs.assembly_version }} `
            -p:InformationalVersion=${{ steps.ver.outputs.pack_version }} `
            --output ./publish-velopack
          Write-Host "Velopack publish files:"
          Get-ChildItem ./publish-velopack | Select-Object Name, Length

      - name: Package with Velopack
        shell: pwsh
        run: |
          # pack_version is the bare SemVer (no 'v'), with -dev.N suffix on
          # prereleases. Velopack accepts SemVer2 with prerelease suffixes.
          $v = "${{ steps.ver.outputs.pack_version }}"
          if ($v -notmatch '^\d+\.\d+\.\d+(-[A-Za-z0-9.-]+)?$') {
            throw "--packVersion must be SemVer2. Got: '$v'"
          }

          # Pull the [Unreleased] section out of CHANGELOG.md and write it next to
          # the publish dir so vpk embeds it in the nupkg. The in-app update dialog
          # surfaces this text via TargetFullRelease.NotesMarkdown — without it the
          # user just sees "No release notes were provided for this version."
          $notes = ""
          if (Test-Path CHANGELOG.md) {
            $lines = Get-Content CHANGELOG.md
            $start = ($lines | Select-String -Pattern '^##\s' | Select-Object -First 1).LineNumber
            if ($start) {
              $tail  = $lines[$start..($lines.Length - 1)]
              $stop  = ($tail | Select-String -Pattern '^##\s' | Select-Object -First 1).LineNumber
              $notes = if ($stop) { $tail[0..($stop - 2)] -join "`n" } else { $tail -join "`n" }
            }
          }
          if ([string]::IsNullOrWhiteSpace($notes)) {
            $notes = "Release $v — see https://github.com/OpenSource-For-Freedom/wraith/releases/tag/v$v"
          }
          $notesPath = "./release-notes.md"
          Set-Content -Path $notesPath -Value $notes -Encoding UTF8

          vpk pack `
            --packId WRAITH `
            --packVersion $v `
            --packDir ./publish-velopack `
            --mainExe WRAITH.exe `
            --releaseNotes $notesPath `
            --outputDir ./velopack-out
          Write-Host "Velopack output:"
          Get-ChildItem ./velopack-out | Select-Object Name, Length

      - name: Create ZIP
        shell: pwsh
        run: |
          $zip = "${{ steps.ver.outputs.zip }}"
          Compress-Archive -Path ./release/* -DestinationPath $zip -CompressionLevel Optimal
          $size = [math]::Round((Get-Item $zip).Length / 1MB, 1)
          Write-Host "Created ${zip}  (${size} MB)"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name:              ${{ steps.ver.outputs.version }}
          name:                  WRAITH ${{ steps.ver.outputs.version }}
          draft:                 false
          prerelease:            ${{ steps.ver.outputs.prerelease }}
          # 'legacy' = GitHub server decides latest by SemVer compare, so a
          # backport tag (e.g. v1.0.6 while v2.x is current) won't demote v2.x.
          # Prereleases force 'false' so dev builds never become latest.
          make_latest:           ${{ steps.ver.outputs.make_latest }}
          files: |
            ${{ steps.ver.outputs.zip }}
            sbom-dotnet.spdx.json
            sbom-dotnet.cyclonedx.json
            sbom-scanner.spdx.json
          generate_release_notes: true
          body: |
            <p align="center"><img src="WRAITH/Assets/wraith.png" alt="WRAITH" width="480"/></p>

            ## WRAITH — Expecto Patronum · Windows Threat Hunter

            ### Install
            1. Download **`${{ steps.ver.outputs.zip }}`** below
            2. Extract anywhere (e.g. `C:\Tools\WRAITH\`)
            3. Double-click **`START.bat`**

            `START.bat` will:
            - **Auto-install the most secure Python for your OS** — Python 3.14 on Windows 11, Python 3.12 on Windows 10 (via winget or direct download)
            - Add Python to your PATH permanently
            - Create a local `.venv` and install all scan dependencies
            - Launch **WRAITH.exe** — no .NET SDK required (runtime is bundled)

            > **Requires Administrator** — UAC prompt will appear on first launch.

            ### Requirements
            | | |
            |---|---|
            | OS | Windows 10 / 11 x64 |
            | Python | Auto-installed by START.bat (3.14 on Win 11 · 3.12 on Win 10) |
            | .NET runtime | **Not needed** — bundled inside WRAITH.exe |

            ### Headless scan (no GUI)
            ```powershell
            .\quick-scan.ps1
            .\quick-scan.ps1 -Hours 168 -OutPath C:\report.json
            ```

      - name: Upload Velopack assets to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ steps.ver.outputs.version }} ./velopack-out/* --clobber