Merge pull request #5952 from deepseek-harness/build/windows-ci-presets-signing

build(windows): add machine presets and EV-signed Actions packaging

.github/workflows/windows-package.yml

@@ -1,27 +1,25 @@
-name: Windows installer (unsigned)
+name: Windows installer
 
 on:
   workflow_dispatch:
     inputs:
-      build_version:
-        description: 'Build version: auto generates a version; otherwise enter a full version'
-        type: string
-        default: auto
-        required: true
-      deployment:
-        description: Update policy deployment
+      preset:
+        description: 'Machine preset (configured on the packaging runner)'
         type: choice
         options: [test, production]
         default: test
         required: true
-      policy_origin:
-        description: 'Required update policy HTTPS origin (no path)'
-        type: string
+      signing:
+        description: 'unsigned: test installer; signed: use the configured EV hardware token'
+        type: choice
+        options: [unsigned, signed]
+        default: unsigned
         required: true
-      login_origins:
-        description: 'Required for test: comma-separated allowed login HTTPS origins'
+      build_version:
+        description: 'Version: auto recommended; or checkout product version / e.g. 0.2.1-alpha.1.20261009.1 (prefix must match checkout)'
         type: string
-        required: false
+        default: auto
+        required: true
 
 permissions:
   contents: read
@@ -39,7 +37,20 @@ jobs:
         shell: pwsh
     env:
       DSH_TELEMETRY_DISABLED: '1'
+      DSH_PACKAGING_PRESET: ${{ inputs.preset }}
+      PACKAGE_SIGNING: ${{ inputs.signing }}
     steps:
+      - name: Reset packaging checkout
+        working-directory: ${{ runner.temp }}
+        run: |
+          $workspace = [IO.Path]::GetFullPath($env:GITHUB_WORKSPACE)
+          $parent = [IO.Path]::GetFullPath($env:RUNNER_WORKSPACE)
+          if ([IO.Path]::GetDirectoryName($workspace) -ne $parent) { throw 'Checkout must be a direct child of RUNNER_WORKSPACE' }
+          for ($item = [IO.DirectoryInfo]::new($workspace); $null -ne $item; $item = $item.Parent) {
+            if ($item.Exists -and ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Checkout ancestors cannot be links' }
+          }
+          node -e "const fs = require('node:fs'); fs.rmSync(process.argv[1], { recursive: true, force: true, maxRetries: 3 }); fs.mkdirSync(process.argv[1])" $workspace
+          if ($LASTEXITCODE -ne 0) { throw 'Checkout cleanup failed' }
       - uses: actions/[email protected]
         id: checkout
         with:
@@ -55,25 +66,26 @@ jobs:
         run: |
           pnpm install --frozen-lockfile
           exit $LASTEXITCODE
-      - name: Validate inputs and prepare public package settings
+      - name: Validate preset and resolve build version
         id: settings
         env:
           PACKAGE_BUILD_VERSION: ${{ inputs.build_version }}
-          PACKAGE_DEPLOYMENT: ${{ inputs.deployment }}
-          PACKAGE_POLICY_ORIGIN: ${{ inputs.policy_origin }}
-          PACKAGE_LOGIN_ORIGINS: ${{ inputs.login_origins }}
         run: node apps/desktop/scripts/prepare-windows-ci.mjs
       - name: Check packaging configuration and toolchain
         env:
           PACKAGE_VERSION: ${{ steps.settings.outputs.version }}
         run: |
-          pnpm run package:desktop:win:x64:unsigned --check --build-version "$env:PACKAGE_VERSION"
+          $packageArgs = @('run', 'package:desktop:win:x64', '--check', '--build-version', $env:PACKAGE_VERSION)
+          if ($env:PACKAGE_SIGNING -eq 'unsigned') { $packageArgs += '--unsigned' }
+          pnpm @packageArgs
           exit $LASTEXITCODE
       - name: Build installer and verify packaged runtime
         env:
           PACKAGE_VERSION: ${{ steps.settings.outputs.version }}
         run: |
-          pnpm run package:desktop:win:x64:unsigned --build-version "$env:PACKAGE_VERSION"
+          $packageArgs = @('run', 'package:desktop:win:x64', '--build-version', $env:PACKAGE_VERSION)
+          if ($env:PACKAGE_SIGNING -eq 'unsigned') { $packageArgs += '--unsigned' }
+          pnpm @packageArgs
           exit $LASTEXITCODE
       - name: Retain packaging diagnostics
         if: always() && steps.checkout.outcome == 'success'
@@ -84,7 +96,8 @@ jobs:
           path: apps/desktop/.desktop-build/packaging-runs/
           if-no-files-found: warn
           retention-days: 14
-      - name: Retain verified installer
+      - name: Retain verified unsigned installer
+        if: success() && inputs.signing == 'unsigned'
         uses: actions/[email protected]
         with:
           name: windows-x64-unsigned-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}
@@ -92,9 +105,12 @@ jobs:
           path: apps/desktop/.desktop-build/targets/win-x64/unsigned-artifacts/*.exe
           if-no-files-found: error
           retention-days: 14
-      - name: Remove generated package settings
-        if: always() && steps.checkout.outcome == 'success'
-        run: |
-          if (Test-Path -LiteralPath apps/desktop/.env.windows) {
-            Remove-Item -LiteralPath apps/desktop/.env.windows
-          }
+      - name: Retain verified signed installer
+        if: success() && inputs.signing == 'signed'
+        uses: actions/[email protected]
+        with:
+          name: windows-x64-signed-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}
+          include-hidden-files: true
+          path: apps/desktop/.desktop-build/targets/win-x64/artifacts/*.exe
+          if-no-files-found: error
+          retention-days: 14