build-binaries.yml

name: Build Prebuilts

on:
  push:
    branches:
      - prebuilt
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  build-mac:
    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
    runs-on: macos-latest
    env:
      PR_TOKEN: ${{ secrets.GH_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Install system libraries (OpenSSL, Opus)
        if: runner.os == 'macOS'
        run: |
          brew update
          # libsrtp formula is not available on macOS runners; omit it.
          brew install openssl@3 opus pkg-config ninja cmake || true
      - name: Clone dependencies (no submodules)
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p deps
          if [[ ! -d deps/re ]]; then git clone --depth=1 https://github.com/baresip/re.git deps/re; fi
          if [[ ! -d deps/baresip ]]; then git clone --depth=1 https://github.com/baresip/baresip.git deps/baresip; fi
      - name: Install Node dependencies
        run: npm ci
      - name: Ensure GH_TOKEN is set (required to push to prebuilt)
        if: ${{ env.PR_TOKEN == '' }}
        run: |
          echo "ERROR: GH_TOKEN secret is not set. Create a PAT with 'repo' scope and add it as GH_TOKEN in repo secrets." >&2
          exit 1
      - name: Build libre (re) static and stage SDK
        shell: bash
        run: |
          set -euo pipefail
          ROOT="$GITHUB_WORKSPACE"
          OPENSSL_PREFIX=$(brew --prefix openssl@3 || echo "/opt/homebrew/opt/openssl@3")
          cd "$ROOT/deps/re"
          rm -rf build
          cmake -B build -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR="$OPENSSL_PREFIX"
          cmake --build build -j
          mkdir -p "$ROOT/local/re/lib" "$ROOT/local/re/include"
          if [[ -f build/libre.a ]]; then cp -a build/libre.a "$ROOT/local/re/lib/"; \
          elif [[ -f build/lib/libre.a ]]; then cp -a build/lib/libre.a "$ROOT/local/re/lib/"; \
          else echo "libre.a not found" >&2; exit 1; fi
          cp -a include/* "$ROOT/local/re/include/"
      - name: Build baresip static and stage SDK
        shell: bash
        run: |
          set -euo pipefail
          ROOT="$GITHUB_WORKSPACE"
          OPENSSL_PREFIX=$(brew --prefix openssl@3 || echo "/opt/homebrew/opt/openssl@3")
          cd "$ROOT/deps/baresip"
          rm -rf build
          cmake -B build -DSTATIC=ON -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR="$OPENSSL_PREFIX"
          cmake --build build -j
          mkdir -p "$ROOT/local/baresip/lib" "$ROOT/local/baresip/include"
          if [[ -f build/libbaresip.a ]]; then cp -a build/libbaresip.a "$ROOT/local/baresip/lib/"; \
          elif [[ -f build/lib/libbaresip.a ]]; then cp -a build/lib/libbaresip.a "$ROOT/local/baresip/lib/"; \
          else echo "libbaresip.a not found" >&2; exit 1; fi
          cp -a include/* "$ROOT/local/baresip/include/"
      - name: Build Node addon (cmake-js)
        shell: bash
        run: |
          set -euo pipefail
          rm -rf build
          npx cmake-js rebuild
      - name: Stage prebuilt binary
        shell: bash
        run: |
          set -euo pipefail
          PLATFORM=$(node -p "process.platform")
          ARCH=$(node -p "process.arch")
          OUTDIR="prebuilt/${PLATFORM}-${ARCH}/node"
          OUTROOT="prebuilt/${PLATFORM}-${ARCH}"
          SDKDIR="$OUTROOT/bin"
          mkdir -p "$OUTDIR"
          cp -a build/Release/baresip_node.node "$OUTDIR/"
          # Stage SDK (re/baresip static libs and headers) into prebuilt/<platform>-<arch>/bin
          mkdir -p "$SDKDIR/re/lib" "$SDKDIR/re/include" "$SDKDIR/baresip/lib" "$SDKDIR/baresip/include"
          if [[ -d local/re/lib ]]; then cp -a local/re/lib/* "$SDKDIR/re/lib/" || true; fi
          if [[ -d local/re/include ]]; then cp -a local/re/include/* "$SDKDIR/re/include/" || true; fi
          if [[ -d local/baresip/lib ]]; then cp -a local/baresip/lib/* "$SDKDIR/baresip/lib/" || true; fi
          if [[ -d local/baresip/include ]]; then cp -a local/baresip/include/* "$SDKDIR/baresip/include/" || true; fi
          # Bundle non-system dylibs into vendor/ and fix rpaths (macOS)
          if [[ "$PLATFORM" == "darwin" ]]; then
            NODE="$OUTDIR/baresip_node.node"
            VENDOR="$OUTDIR/vendor"
            mkdir -p "$VENDOR"
            # ensure rpath to vendor exists
            install_name_tool -add_rpath "@loader_path/vendor" "$NODE" 2>/dev/null || true
            # collect dependencies excluding system paths
            DYLIBS=$(otool -L "$NODE" | tail -n +2 | awk '{print $1}' | grep -E '^/' | grep -vE '^/usr/lib/|^/System/' || true)
            for lib in $DYLIBS; do
              base=$(basename "$lib")
              if [[ ! -f "$VENDOR/$base" ]]; then cp -a "$lib" "$VENDOR/$base"; fi
              install_name_tool -change "$lib" "@loader_path/vendor/$base" "$NODE" || true
              install_name_tool -id "@rpath/$base" "$VENDOR/$base" || true
            done
          fi
      - name: Add manifest and licenses (macOS)
        shell: bash
        run: |
          set -euo pipefail
          PLATFORM=$(node -p "process.platform")
          ARCH=$(node -p "process.arch")
          OUTDIR="prebuilt/${PLATFORM}-${ARCH}/node"
          mkdir -p "$OUTDIR/THIRD_PARTY"
          cp -f deps/re/LICENSE "$OUTDIR/THIRD_PARTY/LICENSE.re" || true
          cp -f deps/baresip/LICENSE "$OUTDIR/THIRD_PARTY/LICENSE.baresip" || true
          RE_SHA=$(git -C deps/re rev-parse --short HEAD 2>/dev/null || echo "unknown")
          BARE_SHA=$(git -C deps/baresip rev-parse --short HEAD 2>/dev/null || echo "unknown")
          NODEVER=$(node -v)
          DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          printf '{"platform":"%s","arch":"%s","node":"%s","builtAt":"%s","deps":{"re":{"repo":"https://github.com/baresip/re","commit":"%s"},"baresip":{"repo":"https://github.com/baresip/baresip","commit":"%s"}}}\n' "$PLATFORM" "$ARCH" "$NODEVER" "$DATE" "$RE_SHA" "$BARE_SHA" > "$OUTDIR/manifest.json"
      - name: Clean build artifacts (keep prebuilt)
        run: rm -rf build
      - name: Compute Node Info
        id: vars
        shell: bash
        run: |
          echo "nodever=$(node -v)" >> "$GITHUB_OUTPUT"
      - name: Commit prebuilts to prebuilt
        if: ${{ env.PR_TOKEN != '' }}
        shell: bash
        run: |
          set -euo pipefail
          git config user.name "prebuilt-bot"
          git config user.email "prebuilt-bot@users.noreply.github.com"
          git add prebuilt/**
          if git diff --staged --quiet; then
            echo "No prebuilt changes to commit."
            exit 0
          fi
          msg="chore: update prebuilt (darwin-arm64 ${{ steps.vars.outputs.nodever }}) [skip ci]"
          # Try push with rebase to avoid non-fast-forward when other jobs have pushed
          for attempt in 1 2 3; do
            # Commit if not already committed
            if ! git diff --cached --quiet; then git commit -m "$msg" || true; fi
            # Ensure tracking latest prebuilt
            git fetch --no-tags origin +refs/heads/prebuilt:refs/remotes/origin/prebuilt || true
            git pull --rebase "https://x-access-token:${{ env.PR_TOKEN }}@github.com/${{ github.repository }}.git" prebuilt || true
            # Push
            if git push "https://x-access-token:${{ env.PR_TOKEN }}@github.com/${{ github.repository }}.git" HEAD:prebuilt; then
              echo "Pushed prebuilts on attempt $attempt"
              exit 0
            fi
            echo "Push failed (attempt $attempt). Retrying after short backoff..."
            sleep $((RANDOM % 5 + 3))
          done
          echo "Failed to push prebuilts after retries" >&2
          exit 1

  build-linux:
    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
    runs-on: ubuntu-latest
    env:
      PR_TOKEN: ${{ secrets.GH_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Install system libraries (OpenSSL, Opus, libsrtp)
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential cmake ninja-build pkg-config \
            libssl-dev libopus-dev libsrtp2-dev patchelf
      - name: Clone dependencies (no submodules)
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p deps
          if [[ ! -d deps/re ]]; then git clone --depth=1 https://github.com/baresip/re.git deps/re; fi
          if [[ ! -d deps/baresip ]]; then git clone --depth=1 https://github.com/baresip/baresip.git deps/baresip; fi
      - name: Install Node dependencies
        run: npm ci
      - name: Ensure GH_TOKEN is set (required to push to prebuilt)
        if: ${{ env.PR_TOKEN == '' }}
        run: |
          echo "ERROR: GH_TOKEN secret is not set. Create a PAT with 'repo' scope and add it as GH_TOKEN in repo secrets." >&2
          exit 1
      - name: Build libre (re) static and stage SDK
        shell: bash
        run: |
          set -euo pipefail
          ROOT="$GITHUB_WORKSPACE"
          cd "$ROOT/deps/re"
          rm -rf build
          cmake -B build \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
            -DCMAKE_C_FLAGS="-fPIC" \
            -DCMAKE_CXX_FLAGS="-fPIC"
          cmake --build build -j
          mkdir -p "$ROOT/local/re/lib" "$ROOT/local/re/include"
          if [[ -f build/libre.a ]]; then cp -a build/libre.a "$ROOT/local/re/lib/"; \
          elif [[ -f build/lib/libre.a ]]; then cp -a build/lib/libre.a "$ROOT/local/re/lib/"; \
          else echo "libre.a not found" >&2; exit 1; fi
          cp -a include/* "$ROOT/local/re/include/"
      - name: Build baresip static and stage SDK
        shell: bash
        run: |
          set -euo pipefail
          ROOT="$GITHUB_WORKSPACE"
          cd "$ROOT/deps/baresip"
          rm -rf build
          cmake -B build \
            -DSTATIC=ON \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
            -DCMAKE_C_FLAGS="-fPIC" \
            -DCMAKE_CXX_FLAGS="-fPIC"
          cmake --build build -j
          mkdir -p "$ROOT/local/baresip/lib" "$ROOT/local/baresip/include"
          if [[ -f build/libbaresip.a ]]; then cp -a build/libbaresip.a "$ROOT/local/baresip/lib/"; \
          elif [[ -f build/lib/libbaresip.a ]]; then cp -a build/lib/libbaresip.a "$ROOT/local/baresip/lib/"; \
          else echo "libbaresip.a not found" >&2; exit 1; fi
          cp -a include/* "$ROOT/local/baresip/include/"
      - name: Build Node addon (cmake-js)
        shell: bash
        run: |
          set -euo pipefail
          rm -rf build
          npx cmake-js rebuild
      - name: Stage prebuilt binary and vendor shared libs
        shell: bash
        run: |
          set -euo pipefail
          PLATFORM=$(node -p "process.platform")
          ARCH=$(node -p "process.arch")
          OUTDIR="prebuilt/${PLATFORM}-${ARCH}/node"
          OUTROOT="prebuilt/${PLATFORM}-${ARCH}"
          SDKDIR="$OUTROOT/bin"
          mkdir -p "$OUTDIR/vendor"
          cp -a build/Release/baresip_node.node "$OUTDIR/"
          # Stage SDK (re/baresip static libs and headers) into prebuilt/<platform>-<arch>/bin
          mkdir -p "$SDKDIR/re/lib" "$SDKDIR/re/include" "$SDKDIR/baresip/lib" "$SDKDIR/baresip/include"
          if [[ -d local/re/lib ]]; then cp -a local/re/lib/* "$SDKDIR/re/lib/" || true; fi
          if [[ -d local/re/include ]]; then cp -a local/re/include/* "$SDKDIR/re/include/" || true; fi
          if [[ -d local/baresip/lib ]]; then cp -a local/baresip/lib/* "$SDKDIR/baresip/lib/" || true; fi
          if [[ -d local/baresip/include ]]; then cp -a local/baresip/include/* "$SDKDIR/baresip/include/" || true; fi
          # Set RUNPATH to find vendor and current dir at runtime
          patchelf --set-rpath '$ORIGIN:$ORIGIN/vendor' "$OUTDIR/baresip_node.node" || true
          # Copy non-system shared libs next to the addon
          DEPS=$(ldd "$OUTDIR/baresip_node.node" | awk '{print $3}' | grep -E '^/' | grep -vE '^/lib/|^/lib64/|^/usr/lib/|^/usr/lib64/' || true)
          for lib in $DEPS; do base=$(basename "$lib"); cp -n "$lib" "$OUTDIR/vendor/$base" || true; done
      - name: Add manifest and licenses (Linux)
        shell: bash
        run: |
          set -euo pipefail
          PLATFORM=$(node -p "process.platform")
          ARCH=$(node -p "process.arch")
          OUTDIR="prebuilt/${PLATFORM}-${ARCH}/node"
          mkdir -p "$OUTDIR/THIRD_PARTY"
          cp -f deps/re/LICENSE "$OUTDIR/THIRD_PARTY/LICENSE.re" || true
          cp -f deps/baresip/LICENSE "$OUTDIR/THIRD_PARTY/LICENSE.baresip" || true
          RE_SHA=$(git -C deps/re rev-parse --short HEAD 2>/dev/null || echo "unknown")
          BARE_SHA=$(git -C deps/baresip rev-parse --short HEAD 2>/dev/null || echo "unknown")
          NODEVER=$(node -v)
          DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          printf '{"platform":"%s","arch":"%s","node":"%s","builtAt":"%s","deps":{"re":{"repo":"https://github.com/baresip/re","commit":"%s"},"baresip":{"repo":"https://github.com/baresip/baresip","commit":"%s"}}}\n' "$PLATFORM" "$ARCH" "$NODEVER" "$DATE" "$RE_SHA" "$BARE_SHA" > "$OUTDIR/manifest.json"
      - name: Clean build artifacts (keep prebuilt)
        run: rm -rf build
      - name: Compute Node Info
        id: vars
        shell: bash
        run: |
          echo "nodever=$(node -v)" >> "$GITHUB_OUTPUT"
      - name: Commit prebuilts to prebuilt (Linux)
        if: ${{ env.PR_TOKEN != '' }}
        shell: bash
        run: |
          set -euo pipefail
          git config user.name "prebuilt-bot"
          git config user.email "prebuilt-bot@users.noreply.github.com"
          git add prebuilt/**
          if git diff --staged --quiet; then
            echo "No prebuilt changes to commit."
            exit 0
          fi
          msg="chore: update prebuilt (linux-${{ runner.arch }} ${{ steps.vars.outputs.nodever }}) [skip ci]"
          for attempt in 1 2 3; do
            if ! git diff --cached --quiet; then git commit -m "$msg" || true; fi
            git fetch --no-tags origin +refs/heads/prebuilt:refs/remotes/origin/prebuilt || true
            git pull --rebase "https://x-access-token:${{ env.PR_TOKEN }}@github.com/${{ github.repository }}.git" prebuilt || true
            if git push "https://x-access-token:${{ env.PR_TOKEN }}@github.com/${{ github.repository }}.git" HEAD:prebuilt; then
              echo "Pushed prebuilts on attempt $attempt"
              exit 0
            fi
            echo "Push failed (attempt $attempt). Retrying after short backoff..."
            sleep $((RANDOM % 5 + 3))
          done
          echo "Failed to push prebuilts after retries" >&2
          exit 1

  # build-windows (TODO): Windows support needs dependency strategy (OpenSSL/Opus) and module selection.
  build-windows:
    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
    runs-on: windows-latest
    env:
      PR_TOKEN: ${{ secrets.GH_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Install tools and OpenSSL
        shell: powershell
        run: |
          $ErrorActionPreference = 'Continue'
          choco install -y ninja cmake git
          # Try light first, then full if not available
          choco install -y openssl.light
          if ($LASTEXITCODE -ne 0) { choco install -y openssl }
      - name: Locate OpenSSL
        id: openssl
        shell: powershell
        run: |
          $candidates = @(
            "C:\\Program Files\\OpenSSL-Win64",
            "C:\\Program Files\\OpenSSL",
            "C:\\Program Files (x86)\\OpenSSL-Win32"
          )
          $root = ''
          $bin  = ''
          foreach ($cand in $candidates) {
            if (Test-Path (Join-Path $cand 'bin')) { $root = $cand; $bin = (Join-Path $cand 'bin'); break }
          }
          if (-not $bin) {
            $pkgBase = 'C:\\ProgramData\\chocolatey\\lib'
            if (Test-Path $pkgBase) {
              $dll = Get-ChildItem -Path $pkgBase -Recurse -ErrorAction SilentlyContinue -Filter 'libcrypto*.dll' | Select-Object -First 1
              if ($dll) { $bin = $dll.DirectoryName; $root = Split-Path $bin -Parent }
            }
          }
          Write-Host "OpenSSL root: $root"
          Write-Host "OpenSSL bin: $bin"
          "openssl_root=$root" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          "openssl_bin=$bin"   | Out-File -FilePath $env:GITHUB_OUTPUT -Append
      - name: Show OpenSSL location
        shell: powershell
        run: |
          if ('${{ steps.openssl.outputs.openssl_bin }}' -ne '') {
            Get-ChildItem -Path "${{ steps.openssl.outputs.openssl_bin }}" -Filter libcrypto*.dll -ErrorAction SilentlyContinue
            Get-ChildItem -Path "${{ steps.openssl.outputs.openssl_bin }}" -Filter libssl*.dll -ErrorAction SilentlyContinue
          } else {
            Write-Host 'OpenSSL bin not found; continuing without listing.'
          }
      - name: Clone dependencies (no submodules)
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          New-Item -ItemType Directory -Force -Path deps | Out-Null
          if (!(Test-Path 'deps/re/.git')) { git clone --depth=1 https://github.com/baresip/re.git deps/re }
          if (!(Test-Path 'deps/baresip/.git')) { git clone --depth=1 https://github.com/baresip/baresip.git deps/baresip }
      - name: Configure and build libre (re) static
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $ROOT = "$env:GITHUB_WORKSPACE"
          Set-Location "$ROOT/deps/re"
          if (Test-Path build) { Remove-Item -Recurse -Force build }
          cmake -B build -G "Visual Studio 17 2022" -A x64 -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DBUILD_TESTING=OFF `
            -DUSE_OPENSSL=OFF -DOPENSSL_ROOT_DIR="${{ steps.openssl.outputs.openssl_root }}"
          cmake --build build --config Release --target re
          New-Item -ItemType Directory -Force -Path "$ROOT/local/re/lib","$ROOT/local/re/include" | Out-Null
          $candidates = @(
            'build/libre.lib',
            'build/lib/libre.lib',
            'build/re.lib',
            'build/re-static.lib',
            'build/Release/libre.lib',
            'build/Release/re.lib',
            'build/Release/re-static.lib'
          )
          $copied = $false
          foreach ($c in $candidates) {
            if (Test-Path $c) { Copy-Item $c "$ROOT/local/re/lib/libre.lib"; $copied = $true; break }
          }
          if (-not $copied) { throw 'libre.lib not found' }
          Copy-Item -Recurse -Force "include/*" "$ROOT/local/re/include/"
      - name: Configure and build baresip static (minimal modules)
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $ROOT = "$env:GITHUB_WORKSPACE"
          # Locate built libre (.lib) to satisfy FindRE.cmake on Windows (multi-config generators place libs under build/Release)
          $RE_ROOT = Join-Path $ROOT 'deps/re'
          $RE_BUILD = Join-Path $RE_ROOT 'build'
          $RE_CANDIDATES = @(
            (Join-Path $RE_BUILD 'Release/re-static.lib'),
            (Join-Path $RE_BUILD 'Release/re.lib'),
            (Join-Path $RE_BUILD 'Release/libre.lib'),
            (Join-Path $RE_BUILD 're-static.lib'),
            (Join-Path $RE_BUILD 're.lib'),
            (Join-Path $RE_BUILD 'libre.lib'),
            (Join-Path $RE_BUILD 'Debug/re-static.lib'),
            (Join-Path $RE_BUILD 'Debug/re.lib'),
            (Join-Path $RE_BUILD 'Debug/libre.lib')
          )
          $RE_LIB = $null
          foreach ($p in $RE_CANDIDATES) { if (Test-Path $p) { $RE_LIB = (Resolve-Path $p).Path; break } }
          if (-not $RE_LIB) { throw 'Could not locate built libre library (re.lib/libre.lib)' }
          Set-Location "$ROOT/deps/baresip"
          if (Test-Path build) { Remove-Item -Recurse -Force build }
          cmake -B build -G "Visual Studio 17 2022" -A x64 -DSTATIC=ON -DCMAKE_BUILD_TYPE=Release -DMODULES="g711;g722;wasapi" -DBUILD_TESTING=OFF `
            -DUSE_OPENSSL=OFF -DOPENSSL_ROOT_DIR="${{ steps.openssl.outputs.openssl_root }}" `
            -DRE_LIBRARY="$RE_LIB" `
            -DRE_INCLUDE_DIR="$(Join-Path $RE_ROOT 'include')"
          cmake --build build --config Release --target baresip
          New-Item -ItemType Directory -Force -Path "$ROOT/local/baresip/lib","$ROOT/local/baresip/include" | Out-Null
          $candidates = @(
            'build/baresip.lib',
            'build/lib/baresip.lib',
            'build/baresip-static.lib',
            'build/Release/baresip.lib',
            'build/Release/baresip-static.lib',
            'build/libbaresip.lib',
            'build/Release/libbaresip.lib',
            'build/lib/libbaresip.lib'
          )
          $copied = $false
          foreach ($c in $candidates) {
            if (Test-Path $c) { Copy-Item $c "$ROOT/local/baresip/lib/libbaresip.lib"; $copied = $true; break }
          }
          if (-not $copied) { throw 'libbaresip.lib not found' }
          Copy-Item -Recurse -Force "include/*" "$ROOT/local/baresip/include/"
      - name: Install Node dependencies
        run: npm ci
      - name: Ensure GH_TOKEN is set (required to push to prebuilt)
        if: ${{ env.PR_TOKEN == '' }}
        shell: bash
        run: |
          echo "ERROR: GH_TOKEN secret is not set. Create a PAT with 'repo' scope and add it as GH_TOKEN in repo secrets." >&2
          exit 1
      - name: Build Node addon (cmake-js)
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          if (Test-Path build) { Remove-Item -Recurse -Force build }
          # Provide OPENSSL_ROOT_DIR to CMake configure so addon can find import libs
          $env:OPENSSL_ROOT_DIR = "${{ steps.openssl.outputs.openssl_root }}"
          npx cmake-js rebuild
      - name: Stage prebuilt and vendor DLLs
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $PLATFORM = (node -p "process.platform").Trim()
          $ARCH = (node -p "process.arch").Trim()
          $OUTDIR = "prebuilt/$PLATFORM-$ARCH/node"
          $OUTROOT = "prebuilt/$PLATFORM-$ARCH"
          $SDKDIR = Join-Path $OUTROOT 'bin'
          New-Item -ItemType Directory -Force -Path "$OUTDIR/vendor" | Out-Null
          Copy-Item "build/Release/baresip_node.node" "$OUTDIR/"
          # Stage SDK (re/baresip static libs and headers) into prebuilt/<platform>-<arch>/bin
          New-Item -ItemType Directory -Force -Path (Join-Path $SDKDIR 're/lib'),(Join-Path $SDKDIR 're/include'),(Join-Path $SDKDIR 'baresip/lib'),(Join-Path $SDKDIR 'baresip/include') | Out-Null
          if (Test-Path 'local/re/lib') { Copy-Item 'local/re/lib/*' (Join-Path $SDKDIR 're/lib') -Force -ErrorAction SilentlyContinue }
          if (Test-Path 'local/re/include') { Copy-Item 'local/re/include/*' (Join-Path $SDKDIR 're/include') -Recurse -Force -ErrorAction SilentlyContinue }
          if (Test-Path 'local/baresip/lib') { Copy-Item 'local/baresip/lib/*' (Join-Path $SDKDIR 'baresip/lib') -Force -ErrorAction SilentlyContinue }
          if (Test-Path 'local/baresip/include') { Copy-Item 'local/baresip/include/*' (Join-Path $SDKDIR 'baresip/include') -Recurse -Force -ErrorAction SilentlyContinue }
          $cands = @(
            "${{ steps.openssl.outputs.openssl_bin }}",
            'C:\\Program Files\\OpenSSL-Win64\\bin',
            'C:\\Program Files\\OpenSSL\\bin',
            'C:\\Program Files (x86)\\OpenSSL-Win32\\bin'
          )
          foreach ($d in $cands) {
            if (![string]::IsNullOrEmpty($d) -and (Test-Path $d)) {
              Copy-Item (Join-Path $d 'libcrypto*.dll') "$OUTDIR/vendor" -ErrorAction SilentlyContinue
              Copy-Item (Join-Path $d 'libssl*.dll') "$OUTDIR/vendor" -ErrorAction SilentlyContinue
              break
            }
          }
      - name: Add manifest and licenses (Windows)
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $PLATFORM = (node -p "process.platform").Trim()
          $ARCH = (node -p "process.arch").Trim()
          $OUTDIR = "prebuilt/$PLATFORM-$ARCH/node"
          New-Item -ItemType Directory -Force -Path "$OUTDIR/THIRD_PARTY" | Out-Null
          Copy-Item "deps/re/LICENSE" "$OUTDIR/THIRD_PARTY/LICENSE.re" -ErrorAction SilentlyContinue
          Copy-Item "deps/baresip/LICENSE" "$OUTDIR/THIRD_PARTY/LICENSE.baresip" -ErrorAction SilentlyContinue
          $RE_SHA = (git -C deps/re rev-parse --short HEAD) 2>$null
          if (-not $RE_SHA) { $RE_SHA = 'unknown' }
          $BARE_SHA = (git -C deps/baresip rev-parse --short HEAD) 2>$null
          if (-not $BARE_SHA) { $BARE_SHA = 'unknown' }
          $NODEVER = (node -v).Trim()
          $DATE = [DateTime]::UtcNow.ToString("yyyy-MM-ddTHH:mm:ssZ")
          $obj = @{ platform=$PLATFORM; arch=$ARCH; node=$NODEVER; builtAt=$DATE; deps=@{ re=@{ repo='https://github.com/baresip/re'; commit=$RE_SHA }; baresip=@{ repo='https://github.com/baresip/baresip'; commit=$BARE_SHA } } }
          $json = $obj | ConvertTo-Json -Depth 5
          $json | Out-File -FilePath "$OUTDIR/manifest.json" -Encoding utf8
      - name: Clean build artifacts (keep prebuilt)
        shell: pwsh
        run: |
          if (Test-Path build) { Remove-Item -Recurse -Force build }
      - name: Compute Node Info
        id: vars
        shell: bash
        run: |
          echo "nodever=$(node -v)" >> "$GITHUB_OUTPUT"
      - name: Commit prebuilts to prebuilt (Windows)
        if: ${{ env.PR_TOKEN != '' }}
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          git config user.name "prebuilt-bot"
          git config user.email "prebuilt-bot@users.noreply.github.com"
          git add prebuilt/**
          if ($LASTEXITCODE -ne 0) { Write-Host "git add returned error code: $LASTEXITCODE" }
          git diff --staged --quiet
          if ($LASTEXITCODE -eq 0) {
            Write-Host "No prebuilt changes to commit."
            exit 0
          }
          $msg = "chore: update prebuilt (win32-${{ runner.arch }} ${{ steps.vars.outputs.nodever }}) [skip ci]"
          for ($i = 1; $i -le 3; $i++) {
            git diff --cached --quiet; if ($LASTEXITCODE -ne 0) { git commit -m "$msg" | Out-Null }
            git fetch --no-tags origin +refs/heads/prebuilt:refs/remotes/origin/prebuilt | Out-Null
            git pull --rebase "https://x-access-token:${{ env.PR_TOKEN }}@github.com/${{ github.repository }}.git" prebuilt | Out-Null
            git push "https://x-access-token:${{ env.PR_TOKEN }}@github.com/${{ github.repository }}.git" HEAD:prebuilt
            if ($LASTEXITCODE -eq 0) { Write-Host "Pushed prebuilts on attempt $i"; exit 0 }
            Write-Host "Push failed (attempt $i). Retrying after short backoff..."; Start-Sleep -Seconds (Get-Random -Minimum 3 -Maximum 8)
          }
          Write-Error "Failed to push prebuilts after retries"