action.yml

name: Setup NSIS
description: Set up NSIS on Linux, macOS and Windows and expose it via NSISDIR

branding:
  color: purple
  icon: gift

inputs:
  version:
    description: NSIS version, e.g. 3.12, or "latest"
    default: latest
  large-strings:
    description: NSIS_MAX_STRLEN=8192
    default: "false"
  advanced-logging:
    description: NSIS_CONFIG_LOG=yes
    default: "false"

outputs:
  version:
    description: Resolved NSIS version
    value: ${{ steps.vars.outputs.version }}
  nsisdir:
    description: NSIS installation directory
    value: ${{ steps.vars.outputs.nsisdir }}

runs:
  using: composite
  steps:
    - name: Resolve version and paths
      id: vars
      shell: bash
      env:
        VERSION: ${{ inputs.version }}
        LARGE: ${{ inputs.large-strings }}
        LOG: ${{ inputs.advanced-logging }}
      run: |
        set -euo pipefail

        if [ "$VERSION" = latest ]; then
          # SourceForge has no "latest file" URL; its release JSON names the current one
          VERSION=$(curl -fsSL --retry 5 --retry-connrefused "https://sourceforge.net/projects/nsis/best_release.json" \
            | grep -o 'nsis-[0-9.]*-src\.tar\.bz2' | head -1 | sed 's/^nsis-//;s/-src.*//')
          [ -n "$VERSION" ] || { echo "could not resolve latest NSIS version"; exit 1; }
          echo "resolved latest NSIS version: $VERSION"
        fi

        if [ "${{ runner.os }}" = Windows ]; then
          # Windows uses upstream's prebuilt binaries, and there is no build that
          # combines both special builds
          if [ "$LARGE" = "true" ] && [ "$LOG" = "true" ]; then
            echo "large-strings and advanced-logging cannot be combined on Windows" >&2
            exit 1
          fi

          # Forward slashes: usable from bash and from PATH alike
          prefix=$(cygpath -m "$HOME/nsis")
          nsisdir=$prefix
          bindir=$prefix
        else
          prefix=$HOME/nsis
          nsisdir=$prefix/share/nsis
          bindir=$prefix/bin
        fi

        echo "version=$VERSION" >> "$GITHUB_OUTPUT"
        echo "prefix=$prefix" >> "$GITHUB_OUTPUT"
        echo "nsisdir=$nsisdir" >> "$GITHUB_OUTPUT"
        echo "bindir=$bindir" >> "$GITHUB_OUTPUT"
        echo "key=nsis-${{ runner.os }}-stripped-stubs-$VERSION-largeStrings=$LARGE-advancedLogging=$LOG" >> "$GITHUB_OUTPUT"

    - name: Restore cached NSIS build
      id: cache
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/nsis
        key: ${{ steps.vars.outputs.key }}

    - name: Download and verify NSIS
      if: steps.cache.outputs.cache-hit != 'true'
      shell: bash
      working-directory: ${{ runner.temp }}
      env:
        VERSION: ${{ steps.vars.outputs.version }}
        LARGE: ${{ inputs.large-strings }}
        LOG: ${{ inputs.advanced-logging }}
      run: |
        set -euo pipefail
        folder="NSIS%20${VERSION%%.*}/$VERSION"

        files=("nsis-$VERSION.zip")
        if [ "${{ runner.os }}" = Windows ]; then
          [ "$LARGE" = "true" ] && files+=("nsis-$VERSION-strlen_8192.zip")
          [ "$LOG" = "true" ] && files+=("nsis-$VERSION-log.zip")
        else
          files+=("nsis-$VERSION-src.tar.bz2")
        fi

        # SourceForge's file feed lists each file's MD5; the files themselves come from a mirror
        curl -fsSL --retry 5 --retry-connrefused -o nsis-files.rss \
          "https://sourceforge.net/projects/nsis/rss?path=/$folder"

        for file in "${files[@]}"; do
          curl -fsSL --retry 5 --retry-connrefused -O \
            "https://downloads.sourceforge.net/project/nsis/$folder/$file"
          md5=$(grep -o "/$folder/$file/download\"[^>]*><media:hash algo=\"md5\">[0-9a-f]*" nsis-files.rss \
            | grep -o '[0-9a-f]\{32\}$' || true)
          [ -n "$md5" ] || { echo "SourceForge lists no MD5 for $file" >&2; exit 1; }
          echo "$md5  $file"
        done > nsis-files.md5

        md5sum -c nsis-files.md5

    # Upstream ships prebuilt Windows binaries, including for both special builds,
    # so there is nothing to compile here
    - name: Install NSIS (Windows)
      if: steps.cache.outputs.cache-hit != 'true' && runner.os == 'Windows'
      shell: bash
      working-directory: ${{ runner.temp }}
      env:
        VERSION: ${{ steps.vars.outputs.version }}
        LARGE: ${{ inputs.large-strings }}
        LOG: ${{ inputs.advanced-logging }}
        PREFIX: ${{ steps.vars.outputs.prefix }}
      run: |
        set -euo pipefail
        7z x -y -bso0 "nsis-$VERSION.zip"

        mkdir -p "$PREFIX"
        cp -R "nsis-$VERSION/." "$PREFIX/"

        # Special builds are overlays: makensis.exe plus matching stubs, no top-level dir
        variant=""
        [ "$LARGE" = "true" ] && variant="strlen_8192"
        [ "$LOG" = "true" ] && variant="log"

        if [ -n "$variant" ]; then
          7z x -y -bso0 -o"$PREFIX" "nsis-$VERSION-$variant.zip"
        fi

    - name: Install build dependencies (Linux)
      if: steps.cache.outputs.cache-hit != 'true' && runner.os == 'Linux'
      shell: bash
      run: |
        set -euo pipefail
        sudo apt-get update
        sudo apt-get install -y --no-install-recommends scons mingw-w64 zlib1g-dev

    # No zlib: macOS ships the headers in the SDK, as Homebrew's own nsis formula relies on
    - name: Install build dependencies (macOS)
      if: steps.cache.outputs.cache-hit != 'true' && runner.os == 'macOS'
      shell: bash
      run: |
        set -euo pipefail
        brew install scons mingw-w64

    - name: Build NSIS
      if: steps.cache.outputs.cache-hit != 'true' && runner.os != 'Windows'
      shell: bash
      working-directory: ${{ runner.temp }}
      env:
        VERSION: ${{ steps.vars.outputs.version }}
        LARGE: ${{ inputs.large-strings }}
        LOG: ${{ inputs.advanced-logging }}
        PREFIX: ${{ steps.vars.outputs.prefix }}
      run: |
        set -euo pipefail
        tar xf "nsis-$VERSION-src.tar.bz2"
        unzip -q "nsis-$VERSION.zip"

        # Prebuilt distribution (Include, Plugins, Examples, ...); stubs get overwritten below
        mkdir -p "$PREFIX/share/nsis"
        cp -R "nsis-$VERSION/." "$PREFIX/share/nsis/"

        args=(
          CC=gcc
          CXX=g++
          PREFIX="$PREFIX"
          SKIPMISC=all
          SKIPPLUGINS=all
          SKIPUTILS=all
          # Don't strip makensis, see https://github.com/Homebrew/homebrew/issues/28718;
          # the Win32 stubs must be stripped, their debug sections break the installers
          STRIP_CP=0
          VERSION="$VERSION"
        )

        [ "$LARGE" = "true" ] && args+=(NSIS_MAX_STRLEN=8192)
        [ "$LOG" = "true" ] && args+=(NSIS_CONFIG_LOG=yes)

        # Stubs are rebuilt too: the prebuilt ones don't match the build options above
        cd "nsis-$VERSION-src"
        scons install-compiler install-stubs "${args[@]}"

    - name: Export NSISDIR and verify
      shell: bash
      env:
        NSISDIR: ${{ steps.vars.outputs.nsisdir }}
        BINDIR: ${{ steps.vars.outputs.bindir }}
      run: |
        set -euo pipefail
        echo "NSISDIR=$NSISDIR" >> "$GITHUB_ENV"
        echo "$BINDIR" >> "$GITHUB_PATH"
        echo "makensis $("$BINDIR/makensis" -VERSION)"
        echo
        "$BINDIR/makensis" -HDRINFO