name: cryptopro-optin

on:
  workflow_dispatch:
    inputs:
      configuration:
        description: Build configuration
        default: Release
      run_tests:
        description: Run CryptoPro signer tests (requires CSP installed on runner)
        default: true

jobs:
  cryptopro:
    runs-on: windows-latest
    env:
      STELLAOPS_CRYPTO_PRO_ENABLED: "1"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Task Pack offline bundle fixtures
        run: python3 scripts/packs/run-fixtures-check.sh

      - name: Setup .NET 10 (preview)
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 10.0.100

      - name: Build CryptoPro plugin
        run: |
          dotnet build src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/StellaOps.Cryptography.Plugin.CryptoPro.csproj -c ${{ github.event.inputs.configuration || 'Release' }}

      - name: Run CryptoPro signer tests (requires CSP pre-installed)
        if: ${{ github.event.inputs.run_tests != 'false' }}
        run: |
          powershell -File scripts/crypto/run-cryptopro-tests.ps1 -Configuration ${{ github.event.inputs.configuration || 'Release' }}

    # NOTE: This workflow assumes the windows runner already has CryptoPro CSP installed and licensed.
    # Leave it opt-in to avoid breaking default CI lanes.