117 lines
4.7 KiB
YAML
117 lines
4.7 KiB
YAML
name: Windows installer
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
preset:
|
|
description: 'Machine preset (configured on the packaging runner)'
|
|
type: choice
|
|
options: [test, production]
|
|
default: test
|
|
required: true
|
|
signing:
|
|
description: 'unsigned: test installer; signed: use the configured EV hardware token'
|
|
type: choice
|
|
options: [unsigned, signed]
|
|
default: unsigned
|
|
required: true
|
|
build_version:
|
|
description: 'Version: auto recommended; or checkout product version / e.g. 0.2.1-alpha.1.20261009.1 (prefix must match checkout)'
|
|
type: string
|
|
default: auto
|
|
required: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: windows-desktop-package
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
package:
|
|
runs-on: dsh-win-package-trial
|
|
timeout-minutes: 120
|
|
defaults:
|
|
run:
|
|
shell: pwsh
|
|
env:
|
|
DSH_TELEMETRY_DISABLED: '1'
|
|
DSH_PACKAGING_PRESET: ${{ inputs.preset }}
|
|
PACKAGE_SIGNING: ${{ inputs.signing }}
|
|
steps:
|
|
- name: Reset packaging checkout
|
|
working-directory: ${{ runner.temp }}
|
|
run: |
|
|
$workspace = [IO.Path]::GetFullPath($env:GITHUB_WORKSPACE)
|
|
$parent = [IO.Path]::GetFullPath($env:RUNNER_WORKSPACE)
|
|
if ([IO.Path]::GetDirectoryName($workspace) -ne $parent) { throw 'Checkout must be a direct child of RUNNER_WORKSPACE' }
|
|
for ($item = [IO.DirectoryInfo]::new($workspace); $null -ne $item; $item = $item.Parent) {
|
|
if ($item.Exists -and ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Checkout ancestors cannot be links' }
|
|
}
|
|
node -e "const fs = require('node:fs'); fs.rmSync(process.argv[1], { recursive: true, force: true, maxRetries: 3 }); fs.mkdirSync(process.argv[1])" $workspace
|
|
if ($LASTEXITCODE -ne 0) { throw 'Checkout cleanup failed' }
|
|
- uses: actions/[email protected]
|
|
id: checkout
|
|
with:
|
|
persist-credentials: false
|
|
clean: true
|
|
- uses: pnpm/[email protected]
|
|
with:
|
|
dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
|
|
- uses: actions/[email protected]
|
|
with:
|
|
node-version: '24'
|
|
- name: Install locked dependencies
|
|
run: |
|
|
pnpm install --frozen-lockfile
|
|
exit $LASTEXITCODE
|
|
- name: Validate preset and resolve build version
|
|
id: settings
|
|
env:
|
|
PACKAGE_BUILD_VERSION: ${{ inputs.build_version }}
|
|
run: node apps/desktop/scripts/prepare-windows-ci.mjs
|
|
- name: Check packaging configuration and toolchain
|
|
env:
|
|
PACKAGE_VERSION: ${{ steps.settings.outputs.version }}
|
|
run: |
|
|
$packageArgs = @('run', 'package:desktop:win:x64', '--check', '--build-version', $env:PACKAGE_VERSION)
|
|
if ($env:PACKAGE_SIGNING -eq 'unsigned') { $packageArgs += '--unsigned' }
|
|
pnpm @packageArgs
|
|
exit $LASTEXITCODE
|
|
- name: Build installer and verify packaged runtime
|
|
env:
|
|
PACKAGE_VERSION: ${{ steps.settings.outputs.version }}
|
|
run: |
|
|
$packageArgs = @('run', 'package:desktop:win:x64', '--build-version', $env:PACKAGE_VERSION)
|
|
if ($env:PACKAGE_SIGNING -eq 'unsigned') { $packageArgs += '--unsigned' }
|
|
pnpm @packageArgs
|
|
exit $LASTEXITCODE
|
|
- name: Retain packaging diagnostics
|
|
if: always() && steps.checkout.outcome == 'success'
|
|
uses: actions/[email protected]
|
|
with:
|
|
name: windows-package-logs-${{ github.run_id }}-${{ github.run_attempt }}
|
|
include-hidden-files: true
|
|
path: apps/desktop/.desktop-build/packaging-runs/
|
|
if-no-files-found: warn
|
|
retention-days: 14
|
|
- name: Retain verified unsigned installer
|
|
if: success() && inputs.signing == 'unsigned'
|
|
uses: actions/[email protected]
|
|
with:
|
|
name: windows-x64-unsigned-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}
|
|
include-hidden-files: true
|
|
path: apps/desktop/.desktop-build/targets/win-x64/unsigned-artifacts/*.exe
|
|
if-no-files-found: error
|
|
retention-days: 14
|
|
- name: Retain verified signed installer
|
|
if: success() && inputs.signing == 'signed'
|
|
uses: actions/[email protected]
|
|
with:
|
|
name: windows-x64-signed-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}
|
|
include-hidden-files: true
|
|
path: apps/desktop/.desktop-build/targets/win-x64/artifacts/*.exe
|
|
if-no-files-found: error
|
|
retention-days: 14
|