ci: 新增 Windows 桌面端内测构建

.github/workflows/client-quality-gates.yml

@@ -6,6 +6,8 @@ on:
       - "AGENTS.md"
       - "frontend/**"
       - ".github/workflows/client-quality-gates.yml"
+      - ".github/workflows/desktop-release-candidate.yml"
+      - ".github/workflows/desktop-windows-internal.yml"
       - "docs/branch-governance.md"
       - "docs/desktop-project-plan.md"
       - "docs/desktop-phase-1-design.md"
@@ -24,6 +26,8 @@ on:
       - "AGENTS.md"
       - "frontend/**"
       - ".github/workflows/client-quality-gates.yml"
+      - ".github/workflows/desktop-release-candidate.yml"
+      - ".github/workflows/desktop-windows-internal.yml"
       - "docs/branch-governance.md"
       - "docs/desktop-project-plan.md"
       - "docs/desktop-phase-1-design.md"

.github/workflows/desktop-windows-internal.yml

@@ -0,0 +1,114 @@
+name: Desktop Windows Internal Build
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: desktop-windows-internal-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  windows-internal:
+    name: Windows NSIS internal validation
+    runs-on: windows-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Resolve internal build metadata
+        id: build-metadata
+        shell: pwsh
+        run: |
+          if ($env:GITHUB_REF_TYPE -eq "tag") {
+            throw "Windows internal validation builds must run from a branch, not a release tag."
+          }
+
+          $channel = "dev"
+          if ($env:GITHUB_REF_NAME -in @("dev", "main", "release")) {
+            $channel = $env:GITHUB_REF_NAME
+          }
+
+          "channel=$channel" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+          "commit=$env:GITHUB_SHA" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check release build metadata
+        run: npm run release:env:check
+        env:
+          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
+          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
+
+      - name: Check synchronized client version
+        run: npm run version:check
+
+      - name: Check runtime boundary
+        run: npm run runtime:check
+
+      - name: Check desktop release and security gate
+        run: npm run desktop:release:check
+
+      - name: Check UI contract
+        run: npm run ui:contract
+
+      - name: Type check
+        run: npm run type-check
+
+      - name: Unit tests
+        run: npm run test:unit
+
+      - name: Build Web artifact
+        run: npm run build
+        env:
+          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
+          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
+
+      - name: Build unsigned Windows NSIS internal installer
+        run: npm run desktop:build -- --config '{"bundle":{"createUpdaterArtifacts":false}}' --bundles nsis
+        env:
+          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
+          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
+
+      - name: Create Windows installer checksum manifest
+        shell: pwsh
+        run: |
+          $bundleDir = "src-tauri/target/release/bundle/nsis"
+          $installers = Get-ChildItem -Path $bundleDir -Filter "*.exe" -File
+          if ($installers.Count -eq 0) {
+            throw "No Windows NSIS EXE installer was produced."
+          }
+
+          $checksums = foreach ($installer in $installers) {
+            $hash = Get-FileHash -Path $installer.FullName -Algorithm SHA256
+            "$($hash.Hash.ToLowerInvariant())  $($installer.Name)"
+          }
+
+          $manifest = Join-Path $bundleDir "SHA256SUMS.txt"
+          $checksums | Set-Content -Path $manifest -Encoding utf8
+          Get-Content $manifest
+
+      - name: Upload Windows internal installer
+        uses: actions/upload-artifact@v4
+        with:
+          name: ctms-windows-internal-${{ steps.build-metadata.outputs.channel }}-${{ steps.build-metadata.outputs.commit }}
+          path: |
+            frontend/src-tauri/target/release/bundle/nsis/*.exe
+            frontend/src-tauri/target/release/bundle/nsis/SHA256SUMS.txt
+          if-no-files-found: error

docs/desktop-project-plan.md

@@ -198,6 +198,20 @@
 
 如果后续任务试图新增离线登录、离线写入、本地业务队列、离线同步、内嵌后端、本地 API 镜像或绕过后端权限审计，应先修改并评审本计划书，不能直接实现。
 
+## 2026-07-09 Windows 内测构建流水线记录
+
+本次补充 Windows 第二阶段兼容性验证的手动构建入口，仍不改变“未获明确批准前不发布正式 Windows 安装包”的边界。
+
+已补齐的内部验证自动化：
+
+- 新增 `.github/workflows/desktop-windows-internal.yml`，通过 `workflow_dispatch` 手动触发，在 GitHub `windows-latest` 环境构建 Windows NSIS 安装器。
+- 工作流从用户在 GitHub Actions 页面选择的分支上下文注入 `VITE_BUILD_CHANNEL` 和 `VITE_BUILD_COMMIT`，并拒绝从 release tag 触发，避免和正式发布链路混用。
+- 工作流执行 `release:env:check`、`version:check`、`runtime:check`、`desktop:release:check`、`ui:contract`、`type-check`、`test:unit` 和 `build` 后，再构建 Windows NSIS 内测安装器。
+- Windows 内测构建显式关闭 updater artifacts，只上传 `.exe` 和 `SHA256SUMS.txt` GitHub artifact；不生成生产 `latest.json`，不创建 update feed，不替代 Windows 代码签名或正式发布审批。
+- `npm run desktop:release:check` 已纳入 Windows 内测 workflow 约束，防止该入口误加入 updater feed、签名 release 或生产发布逻辑。
+
+该 workflow 只用于内部测试和 Windows 兼容性验证。正式 Windows 发布仍需先完成 Windows 代码签名、安装器验收、更新链路和发布治理审批。
+
 ## 当前质量门禁
 
 前端或桌面端代码变更应按影响范围执行相关检查。发布、桌面端适配层、Tauri 配置或安全边界相关变更至少考虑：

docs/guides/client-release.md

@@ -154,6 +154,16 @@ Windows validation must cover:
 - notification and updater compilation;
 - future code-signing requirements.
 
+The manual internal Windows validation workflow lives at
+`.github/workflows/desktop-windows-internal.yml`. It is `workflow_dispatch`
+only, runs on `windows-latest`, injects `VITE_BUILD_CHANNEL` and
+`VITE_BUILD_COMMIT` from the selected branch context, executes the shared client
+and Desktop safety gates, builds an unsigned NSIS installer with updater
+artifacts disabled, and uploads the `.exe` plus `SHA256SUMS.txt` as a GitHub
+Actions artifact. This workflow is for internal compatibility verification
+only; it must not generate `latest.json`, update feeds, signed release
+directories, or formal Windows release artifacts.
+
 ## Required Checks
 
 ```bash

frontend/scripts/verify-desktop-release.mjs

@@ -308,6 +308,45 @@ const verifyWorkflowGates = async () => {
   for (const token of requiredReleaseWorkflowTokens) {
     assert(releaseWorkflow.includes(token), `Desktop release candidate workflow must include ${token}.`);
   }
+
+  const windowsInternalWorkflow = await readFile(resolve(rootDir, ".github/workflows/desktop-windows-internal.yml"), "utf8");
+  const requiredWindowsInternalWorkflowTokens = [
+    "workflow_dispatch",
+    "runs-on: windows-latest",
+    "VITE_BUILD_CHANNEL",
+    "VITE_BUILD_COMMIT",
+    "npm run release:env:check",
+    "npm run version:check",
+    "npm run runtime:check",
+    "npm run desktop:release:check",
+    "npm run ui:contract",
+    "npm run type-check",
+    "npm run test:unit",
+    "npm run build",
+    "npm run desktop:build",
+    "createUpdaterArtifacts",
+    "false",
+    "--bundles nsis",
+    "SHA256SUMS.txt",
+    "actions/upload-artifact",
+  ];
+
+  for (const token of requiredWindowsInternalWorkflowTokens) {
+    assert(windowsInternalWorkflow.includes(token), `Desktop Windows internal workflow must include ${token}.`);
+  }
+
+  const forbiddenWindowsInternalWorkflowTokens = [
+    "desktop:update-feed:create",
+    "desktop:update-feed:check",
+    "desktop:release-readiness:check",
+    "TAURI_SIGNING_PRIVATE_KEY",
+    "REQUIRE_DESKTOP_SIGNING",
+    "latest.json",
+  ];
+
+  for (const token of forbiddenWindowsInternalWorkflowTokens) {
+    assert(!windowsInternalWorkflow.includes(token), `Desktop Windows internal workflow must not include ${token}.`);
+  }
 };
 
 await verifyTauriConfig();