From 8c2e1fdde24dd2703dd34b27f4998bf108ece2a8 Mon Sep 17 00:00:00 2001
From: ApolloF <98666317+ApolloF@users.noreply.github.com>
Date: Tue, 20 Oct 2026 17:04:04 +0200
Subject: [PATCH] Add a script that builds the personal build with its
 installer

---
 AGENTS.md                  |  2 +-
 RELEASING.md               |  2 ++
 scripts/build-personal.ps1 | 49 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 scripts/build-personal.ps1

diff --git a/AGENTS.md b/AGENTS.md
index 86c4123..f0d9a14 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -12,7 +12,7 @@ Windows desktop app that syncs game saves between a user's PCs (via a bundled/lo
 - Install: `cd frontend && npm install` (Wails also runs this on build)
 - Dev: `wails dev`
 - Build: `wails build` → `build/bin/Syncer.exe` (`-nsis` for the installer). This is the public release: no mods, Google sign-in or launcher integration.
-- Personal build: `wails build -tags personal` (the owner's build with all of those; it never installs the public release over itself). Dev with it: `wails dev -tags personal`.
+- Personal build: `scripts/build-personal.ps1` (runs `wails build -tags personal -nsis` with the Google client from `.env.personal`; the owner's build with all of those; it never installs the public release over itself). Dev with it: `wails dev -tags personal`.
 - Typecheck: `cd frontend && npm run check` (svelte-check)
 - Test: `go test ./...` and `go test -tags personal ./...` and `cd frontend && npm test` (Vitest)
 - Full gate before a PR (what CI runs): the check command below without `-short`, plus `wails build`
diff --git a/RELEASING.md b/RELEASING.md
index 0548312..277efef 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -17,3 +17,5 @@ If a published release is bad, mark it as a draft again (or delete it) so the up
 ## Personal build
 
 `wails build -tags personal` makes the maintainer's build (see [CONTRIBUTING.md](CONTRIBUTING.md#builds-public-vs-personal)). It is built locally, with the Google client passed through `-ldflags`, and is never published or attached to a release. CI only builds the public one.
+
+`scripts/build-personal.ps1` builds it with its installer into `build\bin`. It reads the Google client from `.env.personal` at the repo root (gitignored; `GDRIVE_CLIENT_ID=…` and `GDRIVE_CLIENT_SECRET=…` on their own lines) or from environment variables of the same names, and stamps the version as the last tag plus the commit (`v1.0.0+personal.3a79b1e`). The personal build doesn't update itself: when it says a new release is out, pull `main` and run the script again. The exe contains the Google client, so don't share it.
diff --git a/scripts/build-personal.ps1 b/scripts/build-personal.ps1
new file mode 100644
index 0000000..b848ac6
--- /dev/null
+++ b/scripts/build-personal.ps1
@@ -0,0 +1,49 @@
+# Builds the personal build (mods, Google sign-in, launcher API) with its
+# installer into build\bin. It never updates itself, so pull and run this again
+# to update. See RELEASING.md, "Personal build".
+#
+# The Google client comes from .env.personal at the repo root (gitignored):
+#   GDRIVE_CLIENT_ID=...
+#   GDRIVE_CLIENT_SECRET=...
+# or from environment variables of the same names. Without it the build hides
+# Sign in with Google.
+$ErrorActionPreference = 'Stop'
+$root = Split-Path -Parent $PSScriptRoot
+Set-Location $root
+
+$client = @{ GDRIVE_CLIENT_ID = $env:GDRIVE_CLIENT_ID; GDRIVE_CLIENT_SECRET = $env:GDRIVE_CLIENT_SECRET }
+$file = Join-Path $root '.env.personal'
+if (Test-Path $file) {
+    foreach ($line in Get-Content $file) {
+        if ($line -match '^\s*(GDRIVE_CLIENT_ID|GDRIVE_CLIENT_SECRET)\s*=\s*(.*?)\s*$') {
+            $client[$Matches[1]] = $Matches[2].Trim('"', "'")
+        }
+    }
+}
+if (-not $client.GDRIVE_CLIENT_ID -or -not $client.GDRIVE_CLIENT_SECRET) {
+    Write-Warning 'No Google client (.env.personal or GDRIVE_CLIENT_ID/GDRIVE_CLIENT_SECRET): Sign in with Google will be hidden.'
+}
+
+# The last release tag plus this commit, e.g. v1.0.0+personal.3a79b1e. Build
+# metadata is ignored when versions are compared, so the app still says when a
+# newer release is out: the cue to rebuild.
+$tag = git describe --tags --abbrev=0 --match 'v*' 2>$null
+if (-not $tag) { $tag = 'v0.0.0' }
+$commit = git rev-parse --short HEAD
+# Ignores what wails build itself rewrites (installer template, dist, line endings).
+git diff --quiet HEAD -- . ':!build/windows/installer' ':!frontend/dist'
+if ($LASTEXITCODE -ne 0) { $commit += '.dirty' }
+$version = "$tag+personal.$commit"
+
+$ldflags = "-s -w -X main.version=$version"
+if ($client.GDRIVE_CLIENT_ID -and $client.GDRIVE_CLIENT_SECRET) {
+    $ldflags += " -X main.gdriveClientID=$($client.GDRIVE_CLIENT_ID) -X main.gdriveClientSecret=$($client.GDRIVE_CLIENT_SECRET)"
+}
+
+Write-Host "Building Syncer $version (personal)"
+wails build -clean -nsis -trimpath -tags personal -ldflags $ldflags
+if ($LASTEXITCODE -ne 0) { throw "wails build failed ($LASTEXITCODE)" }
+if (-not (Test-Path build\bin\Syncer-amd64-installer.exe)) {
+    Write-Warning 'No installer: install NSIS (winget install NSIS.NSIS) and run this again, or use build\bin\Syncer.exe as is.'
+}
+Get-ChildItem build\bin\Syncer*.exe | ForEach-Object { Write-Host "Built $($_.FullName)" }