feat(desktop): add Windows preview distribution

2026-08-30 10:24:03 +08:00
1 parent 6582a891d7
commit 383bafa83f
@@ -4,7 +4,7 @@ on:
  workflow_dispatch:
    inputs:
      release_tag:
-        description: "Prepare macOS assets on this existing Draft Release (optional)"
+        description: "Prepare macOS and Windows assets on this existing Draft Release (optional)"
        required: false
        type: string
  release:
@@ -103,10 +103,10 @@ jobs:
        needs.release-plan.outputs.asset_ready == 'false' &&
        needs.release-plan.outputs.rebuild == 'false'
      }}
-    name: Reuse macOS release assets
+    name: Reuse desktop release assets
    runs-on: ubuntu-latest
    steps:
-      - name: Copy latest compatible macOS assets without renaming
+      - name: Copy latest compatible desktop assets without renaming
        env:
          CURRENT_TAG: ${{ inputs.release_tag || github.event.release.tag_name }}
          GH_TOKEN: ${{ github.token }}
@@ -124,8 +124,13 @@ jobs:
            --pattern 'EdgeEver-*-mac-x64.zip' \
            --pattern 'EdgeEver-*-mac-x64.zip.blockmap' \
            --pattern 'latest-mac.yml' \
+            --pattern 'EdgeEver-*-windows-x64.exe' \
+            --pattern 'latest.yml' \
+            --pattern 'latest-windows.json' \
+            --pattern 'latest-windows.json.sig' \
+            --pattern 'SHA256SUMS-windows.txt' \
            --dir "$RUNNER_TEMP/native-assets"
-          test "$(find "$RUNNER_TEMP/native-assets" -type f | wc -l | tr -d ' ')" = "9"
+          test "$(find "$RUNNER_TEMP/native-assets" -type f | wc -l | tr -d ' ')" = "14"
          gh release upload "$CURRENT_TAG" "$RUNNER_TEMP/native-assets/"* \
            --repo "$GITHUB_REPOSITORY" \
            --clobber
@@ -327,15 +332,137 @@ jobs:
          if-no-files-found: error
          retention-days: 14

-  native-build-timings:
-    needs: desktop
+  windows:
+    needs: release-plan
    if: >-
      ${{
        always() &&
        github.repository == 'tianma-if/edgeever' &&
-        needs.desktop.result != 'skipped'
+        (
+          (github.event_name == 'workflow_dispatch' && inputs.release_tag == '') ||
+          (
+            github.event_name == 'workflow_dispatch' &&
+            inputs.release_tag != '' &&
+            needs.release-plan.result == 'success' &&
+            needs.release-plan.outputs.asset_ready == 'false' &&
+            needs.release-plan.outputs.rebuild == 'true'
+          )
+        )
      }}
-    name: Report macOS build timings
+    name: Windows x64 unsigned Preview
+    runs-on: windows-latest
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v5
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Bun dependencies
+        uses: actions/cache@v5
+        with:
+          path: ~\AppData\Local\bun\install\cache
+          key: ${{ runner.os }}-x64-bun-${{ hashFiles('bun.lock') }}
+
+      - name: Cache Rust dependencies and sidecar builds
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~\.cargo\registry
+            ~\.cargo\git
+            crates\desktop-sidecar\target
+          key: ${{ runner.os }}-x64-rust-${{ hashFiles('crates/desktop-sidecar/Cargo.lock', 'crates/desktop-sidecar/**/*.rs') }}
+          restore-keys: |
+            ${{ runner.os }}-x64-rust-
+
+      - name: Cache Electron downloads
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~\AppData\Local\electron\Cache
+            ~\AppData\Local\electron-builder\Cache
+          key: ${{ runner.os }}-x64-electron-${{ hashFiles('bun.lock', 'apps/desktop/package.json') }}
+
+      - name: Install dependencies
+        shell: pwsh
+        run: |
+          for ($attempt = 1; $attempt -le 3; $attempt++) {
+            bun install --frozen-lockfile
+            $installExitCode = $LASTEXITCODE
+            if ($installExitCode -eq 0) { exit 0 }
+            if ($attempt -eq 3) { exit $installExitCode }
+            Write-Warning "Dependency installation failed on attempt $attempt; retrying."
+            Start-Sleep -Seconds (15 * $attempt)
+          }
+
+      - name: Build Web renderer
+        env:
+          EDGE_EVER_DESKTOP_BUILD: "1"
+        run: bun run build:web
+
+      - name: Build x64 Rust sidecar
+        run: cargo build --manifest-path crates/desktop-sidecar/Cargo.toml --release
+
+      - name: Package unsigned Windows installer
+        env:
+          EDGE_EVER_DESKTOP_ARCH: x64
+          EDGE_EVER_DESKTOP_TARGET: win
+        run: bun scripts/run-desktop-builder.mjs --publish never
+
+      - name: Verify Windows package contents and architecture
+        env:
+          EDGE_EVER_DESKTOP_ARCH: x64
+          EDGE_EVER_VERIFY_TARGET: win32
+        run: bun scripts/verify-desktop-package.mjs
+
+      - name: Verify that Preview executables are unsigned
+        shell: pwsh
+        run: |
+          $version = (Get-Content apps/desktop/package.json | ConvertFrom-Json).version
+          $paths = @(
+            "release/desktop/EdgeEver-$version-windows-x64.exe",
+            "release/desktop/win-unpacked/EdgeEver.exe",
+            "release/desktop/win-unpacked/resources/sidecar/edgeever-sidecar.exe"
+          )
+          foreach ($path in $paths) {
+            $signature = Get-AuthenticodeSignature -LiteralPath $path
+            if ($signature.Status -ne "NotSigned") {
+              throw "Unsigned Preview asset unexpectedly has an Authenticode signature: $path ($($signature.Status))"
+            }
+          }
+
+      - name: Create Windows update metadata
+        shell: pwsh
+        run: |
+          $version = (Get-Content apps/desktop/package.json | ConvertFrom-Json).version
+          node scripts/create-windows-update-metadata.mjs release/desktop $version
+
+      - name: Stage Windows Preview assets
+        uses: actions/upload-artifact@v6
+        with:
+          name: edgeever-desktop-Windows-x64-staging
+          path: |
+            release/desktop/EdgeEver-*-windows-x64.exe
+            release/desktop/latest.yml
+            release/desktop/latest-windows.json
+            release/desktop/SHA256SUMS-windows.txt
+          if-no-files-found: error
+          retention-days: 14
+
+  native-build-timings:
+    needs: [desktop, windows]
+    if: >-
+      ${{
+        always() &&
+        github.repository == 'tianma-if/edgeever' &&
+        (needs.desktop.result != 'skipped' || needs.windows.result != 'skipped')
+      }}
+    name: Report desktop build timings
    runs-on: ubuntu-latest
    steps:
      - name: Check out timing reporter
@@ -364,12 +491,13 @@ jobs:
          retention-days: 90

  desktop-assets:
-    needs: [release-plan, desktop]
+    needs: [release-plan, desktop, windows]
    if: >-
      ${{
        always() &&
        github.repository == 'tianma-if/edgeever' &&
        needs.desktop.result == 'success' &&
+        needs.windows.result == 'success' &&
        (
          (github.event_name == 'workflow_dispatch' && inputs.release_tag == '') ||
          (
@@ -381,16 +509,16 @@ jobs:
          )
        )
      }}
-    name: Finalize macOS release assets
+    name: Finalize desktop release assets
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@v5

-      - name: Download architecture-specific assets
+      - name: Download platform-specific assets
        uses: actions/download-artifact@v7
        with:
-          pattern: edgeever-desktop-macOS-*-staging
+          pattern: edgeever-desktop-*-staging
          path: release/desktop
          merge-multiple: true

@@ -400,7 +528,7 @@ jobs:
          node scripts/create-mac-update-metadata.mjs release/desktop "$version"
          asset_ready="$(
            find release/desktop -maxdepth 1 -type f -exec basename {} \; |
-              node scripts/check-native-release-assets.mjs desktop true "v${version}" "$version"
+              node scripts/check-native-release-assets.mjs desktop true "v${version}" "$version" allow-missing-windows-signature
          )"
          test "$asset_ready" = "true"

@@ -417,7 +545,44 @@ jobs:
      - name: Upload combined desktop installers and metadata
        uses: actions/upload-artifact@v6
        with:
-          name: edgeever-desktop-macOS-arm64-x64
+          name: edgeever-desktop-macOS-and-Windows-x64
          path: release/desktop/*
          if-no-files-found: error
          retention-days: 14
+
+  windows-update-audit:
+    needs: release-plan
+    if: >-
+      ${{
+        always() &&
+        github.repository == 'tianma-if/edgeever' &&
+        needs.release-plan.result == 'success' &&
+        needs.release-plan.outputs.asset_ready == 'true' &&
+        (
+          github.event_name == 'release' ||
+          (github.event_name == 'workflow_dispatch' && inputs.release_tag != '')
+        )
+      }}
+    name: Audit signed Windows update
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v5
+
+      - name: Download Windows release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag || github.event.release.tag_name }}
+        run: |
+          mkdir -p release/desktop
+          gh release download "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --pattern 'EdgeEver-*-windows-x64.exe' \
+            --pattern 'latest.yml' \
+            --pattern 'latest-windows.json' \
+            --pattern 'latest-windows.json.sig' \
+            --pattern 'SHA256SUMS-windows.txt' \
+            --dir release/desktop
+
+      - name: Verify signature and installer digests
+        run: node scripts/verify-windows-update-release.mjs release/desktop