agent-radar
7be535059e
Dependency audit / audit (push) Canceled after 0s
CI / plan (push) Canceled after 0s
Gitoxide helper admission / macos-latest (push) Canceled after 0s
Gitoxide helper admission / ubuntu-latest (push) Canceled after 0s
Gitoxide helper admission / windows-latest (push) Canceled after 0s
Runtime Host peer admission / quality (push) Canceled after 0s
Windows recovery / windows_recovery (push) Canceled after 0s
CI / heavy (push) Canceled after 0s
CI / test (push) Canceled after 0s
171 lines
7.3 KiB
YAML
171 lines
7.3 KiB
YAML
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
name: Release Windows check
|
|
|
|
# The Windows release path used to run for the first time on release day, on
|
|
# main, with a tag already reserved — so a defect in it was found at the worst
|
|
# possible moment. This runs the same packaging and verification on a pull
|
|
# request, without any release identity, whenever that path changes.
|
|
on:
|
|
pull_request:
|
|
# This list is every input whose correctness can only be observed on Windows,
|
|
# so it reaches past the release scripts themselves. `npm-spawn.mjs` holds the
|
|
# rule that lets npm resolve at all there, the notices generator is its other
|
|
# caller and runs only under `check:release`, `.gitattributes` decides whether
|
|
# generated bytes survive checkout, and the manifests own the command wiring
|
|
# and the native module graph. Each of those has already broken this path once.
|
|
paths:
|
|
- 'apps/desktop/electron-builder.config.mjs'
|
|
- 'apps/desktop/package.json'
|
|
- 'native/runtime-host-peer/**'
|
|
- 'packages/cli/RUNTIME_HOST_PEER_DEPENDENCIES.rust.tsv'
|
|
- 'packages/cli/RUNTIME_HOST_PEER_THIRD_PARTY_NOTICES.txt'
|
|
- 'scripts/package-windows-x64.mjs'
|
|
- 'scripts/generate-runtime-host-peer-dependencies.mjs'
|
|
- 'scripts/generate-runtime-host-peer-notices.mjs'
|
|
- 'scripts/verify-windows-x64.mjs'
|
|
- 'scripts/verify-windows-sandbox-e2e.mjs'
|
|
- 'scripts/verify-windows-installer-lifecycle.mjs'
|
|
- 'scripts/verify-windows-autoupdate.mjs'
|
|
- 'scripts/verify-windows-installer-rollback.mjs'
|
|
- 'scripts/package-windows-autoupdate-next.mjs'
|
|
# The Abort-path rollback hook ships inside the installer itself.
|
|
- 'apps/desktop/build/installer.nsh'
|
|
# The packaged updater's feed behavior — and the boot wiring that hands
|
|
# MAKA_UPDATE_TEST_FEED to it — is only observable on this path.
|
|
- 'apps/desktop/src/main/app-update-service.ts'
|
|
- 'apps/desktop/src/main/main-window.ts'
|
|
- 'apps/desktop/src/main/runtime-host-boot.ts'
|
|
- 'packages/runtime-host/src/client/connect-or-spawn.ts'
|
|
- 'packages/runtime-host/src/client/launcher.ts'
|
|
- 'apps/desktop/src/main/windows-maximize-renderer-sync.ts'
|
|
- 'scripts/prepare-windows-upgrade-baseline.mjs'
|
|
- 'scripts/windows-upgrade-baseline.json'
|
|
- 'scripts/verify-packaged-app.mjs'
|
|
- 'scripts/npm-spawn.mjs'
|
|
- 'scripts/generate-third-party-notices.mjs'
|
|
- 'scripts/generate-windows-cargo-notices.mjs'
|
|
- 'scripts/windows-package-source-closure.mjs'
|
|
- 'scripts/windows-package-source-closure.test.mjs'
|
|
# The packaged worker and its Windows boundary driver are built from
|
|
# these sources, so changes here must reach the packaged lifecycle gate.
|
|
- 'apps/desktop/scripts/copy-runtime-filesystem-worker.mjs'
|
|
- 'packages/runtime/scripts/build-filesystem-worker.mjs'
|
|
- 'packages/runtime/src/filesystem-worker/**'
|
|
- 'packages/runtime/src/sandbox/**'
|
|
- 'packages/runtime/src/path-containment.ts'
|
|
- 'packages/runtime/src/sandbox-boundary-path.ts'
|
|
- 'packages/runtime/src/apply-patch-file.ts'
|
|
- 'packages/runtime/src/child-fd-input.ts'
|
|
- 'packages/runtime/src/child-process-lifecycle.ts'
|
|
- 'packages/runtime/src/edit-replace.ts'
|
|
- 'packages/runtime/src/file-stable-write.ts'
|
|
- 'packages/runtime/src/image-file.ts'
|
|
- 'packages/runtime/src/process-tree-terminator.ts'
|
|
- 'packages/runtime/src/unified-diff.ts'
|
|
- 'packages/core/src/absolute-path.ts'
|
|
- 'packages/core/src/artifacts.ts'
|
|
- 'packages/core/src/attachments.ts'
|
|
- 'packages/core/src/permission-profile.ts'
|
|
- 'packages/core/src/permission-profile-compiler.ts'
|
|
- 'packages/core/src/sandbox-boundary.ts'
|
|
- 'packages/core/src/serialized-byte-length.ts'
|
|
- 'packages/core/src/windows-path.ts'
|
|
- 'experiments/windows-sandbox/launcher/**'
|
|
- 'experiments/windows-sandbox/*.ps1'
|
|
- '.gitattributes'
|
|
- 'package.json'
|
|
- 'package-lock.json'
|
|
- 'apps/desktop/resources/licenses/cargo/THIRD_PARTY_NOTICES.txt'
|
|
- '.github/workflows/release.yml'
|
|
- '.github/workflows/release-windows-check.yml'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: release-windows-check-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
package:
|
|
runs-on: windows-2025
|
|
timeout-minutes: 45
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: '24'
|
|
cache: npm
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Update stable Rust for Desktop native artifacts
|
|
run: rustup update stable --no-self-update
|
|
|
|
- name: Package the Windows installer and ZIP
|
|
run: npm run package:windows-x64
|
|
|
|
- name: Verify the Windows release
|
|
run: |
|
|
version="$(node -p "require('./apps/desktop/package.json').version")"
|
|
npm run verify:windows-x64 -- "apps/desktop/release/Maka-${version}-win-x64.exe"
|
|
|
|
- name: Download and verify the pinned Windows upgrade baseline
|
|
id: previous
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
version="$(node -p "require('./apps/desktop/package.json').version")"
|
|
previous_exe="$(node scripts/prepare-windows-upgrade-baseline.mjs \
|
|
"$version" artifacts/windows-upgrade-baseline)"
|
|
echo "exe=$previous_exe" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Exercise pinned-version upgrade and uninstall
|
|
run: |
|
|
version="$(node -p "require('./apps/desktop/package.json').version")"
|
|
npm run verify:windows-installer -- \
|
|
"apps/desktop/release/Maka-${version}-win-x64.exe" \
|
|
"${{ steps.previous.outputs.exe }}"
|
|
|
|
- name: Build the version-bumped autoupdate installer
|
|
run: npm run package:windows-autoupdate-next
|
|
|
|
- name: Verify automatic update end to end
|
|
run: |
|
|
version="$(node -p "require('./apps/desktop/package.json').version")"
|
|
npm run verify:windows-autoupdate -- \
|
|
"apps/desktop/release/Maka-${version}-win-x64.exe" \
|
|
apps/desktop/release-autoupdate-next
|
|
|
|
- name: Prove deterministic mid-install failure rollback
|
|
run: |
|
|
version="$(node -p "require('./apps/desktop/package.json').version")"
|
|
npm run verify:windows-installer-rollback -- \
|
|
"apps/desktop/release/Maka-${version}-win-x64.exe" \
|
|
apps/desktop/release-autoupdate-next
|