Cheng Zhou
129 lines
4.1 KiB
YAML
129 lines
4.1 KiB
YAML
name: Desktop Windows Internal Build
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: desktop-windows-internal-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
windows-internal:
|
|
name: Windows NSIS internal validation
|
|
runs-on: windows-latest
|
|
env:
|
|
VITE_DESKTOP_SERVER_URL: ${{ vars.VITE_DESKTOP_SERVER_URL }}
|
|
defaults:
|
|
run:
|
|
working-directory: frontend
|
|
steps:
|
|
- name: Checkout source
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22.13"
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Setup Rust
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
- name: Resolve internal build metadata
|
|
id: build-metadata
|
|
shell: pwsh
|
|
run: |
|
|
if ($env:GITHUB_REF_TYPE -eq "tag") {
|
|
throw "Windows internal validation builds must run from a branch, not a release tag."
|
|
}
|
|
|
|
$channel = "dev"
|
|
if ($env:GITHUB_REF_NAME -in @("dev", "main", "release")) {
|
|
$channel = $env:GITHUB_REF_NAME
|
|
}
|
|
|
|
"channel=$channel" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
|
|
"commit=$env:GITHUB_SHA" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Check release build metadata
|
|
run: npm run release:env:check
|
|
env:
|
|
VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
|
|
VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
|
|
|
|
- name: Check synchronized client version
|
|
run: npm run version:check
|
|
|
|
- name: Check runtime boundary
|
|
run: npm run runtime:check
|
|
|
|
- name: Check desktop release and security gate
|
|
run: npm run desktop:release:check
|
|
|
|
- name: Check UI contract
|
|
run: npm run ui:contract
|
|
|
|
- name: Type check
|
|
run: npm run type-check
|
|
|
|
- name: Unit tests
|
|
run: npm run test:unit
|
|
|
|
- name: Build Web artifact
|
|
run: npm run build
|
|
env:
|
|
VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
|
|
VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
|
|
|
|
- name: Write Windows internal Tauri config
|
|
shell: pwsh
|
|
run: |
|
|
$config = @{
|
|
bundle = @{
|
|
createUpdaterArtifacts = $false
|
|
}
|
|
} | ConvertTo-Json -Depth 8
|
|
Set-Content -Path "tauri.windows.internal.conf.json" -Value $config -Encoding utf8
|
|
Get-Content "tauri.windows.internal.conf.json"
|
|
|
|
- name: Build unsigned Windows NSIS internal installer
|
|
timeout-minutes: 30
|
|
run: npm run desktop:build -- --config tauri.windows.internal.conf.json --bundles nsis --ci
|
|
env:
|
|
VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
|
|
VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
|
|
|
|
- name: Create Windows installer checksum manifest
|
|
shell: pwsh
|
|
run: |
|
|
$bundleDir = "src-tauri/target/release/bundle/nsis"
|
|
$installers = Get-ChildItem -Path $bundleDir -Filter "*.exe" -File
|
|
if ($installers.Count -eq 0) {
|
|
throw "No Windows NSIS EXE installer was produced."
|
|
}
|
|
|
|
$checksums = foreach ($installer in $installers) {
|
|
$hash = Get-FileHash -Path $installer.FullName -Algorithm SHA256
|
|
"$($hash.Hash.ToLowerInvariant()) $($installer.Name)"
|
|
}
|
|
|
|
$manifest = Join-Path $bundleDir "SHA256SUMS.txt"
|
|
$checksums | Set-Content -Path $manifest -Encoding utf8
|
|
Get-Content $manifest
|
|
|
|
- name: Upload Windows internal installer
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: ctms-windows-internal-${{ steps.build-metadata.outputs.channel }}-${{ steps.build-metadata.outputs.commit }}
|
|
path: |
|
|
frontend/src-tauri/target/release/bundle/nsis/*.exe
|
|
frontend/src-tauri/target/release/bundle/nsis/SHA256SUMS.txt
|
|
if-no-files-found: error
|