wmantly
ba2a619db5
The Windows CI/CD story is now one idempotent script that both local dev and
GitHub Actions run, so they cannot drift.
scripts/setup-build-env.ps1:
- idempotent: skips anything already present/valid; safe to re-run (verified
no-op on second run)
- Go toolchain: pinned 1.22.2, user-space zip extract, no admin; accepts >= 1.22
- Inno Setup: pinned 7.0.2 from jrsoftware GitHub release, per-user install
(/CURRENTUSER, no admin), sha256-verified installer
- vendor assets: fetches WireGuard MSI, VC++ redist, OpenCredential CP into
installer/windows/vendor/ and verifies each against the pinned manifest;
writes .sha256 sidecars
- -Build: builds agent/tray/helper for windows amd64+arm64, runs go test, and
compiles the installer; -CI: fail loudly for workflows
installer/windows/vendor-manifest.json: pinned urls + sha256 for all three
third-party assets and the toolchain; nothing large is committed to git
(installer/windows/vendor/ is gitignored).
installer/windows/installer.iss: bundle + silently install the real
OpenCredential installer (Inno-built -> /VERYSILENT) and read /SERVER_URL and
/JOIN_KEY via {param:...}; validated by compiling with Inno Setup 7.0.2.
.github/workflows/build-windows.yml now delegates the entire build to the script
(setup-go + setup-build-env.ps1 -SkipGo -Build -CI), then hashes, optionally
signs with Azure Trusted Signing, attaches to the release, and publishes to the
SSO resource tree.
Built locally: dist/theta-agent-2.1.0-windows-amd64-setup.exe (63MB fully
offline bundle) plus windows amd64/arm64 agent, tray, and helper, all verified.
112 lines
4.2 KiB
YAML
112 lines
4.2 KiB
YAML
name: build-windows
|
|
|
|
# Builds the Windows agent, tray, session helper, and the fully-offline Inno
|
|
# installer; signs them with Azure Trusted Signing; generates SHA256SUMS; and
|
|
# publishes the artifacts to the SSO resource tree (DESIGN-WINDOWS.md §9).
|
|
#
|
|
# The build itself is driven by scripts/setup-build-env.ps1 (idempotent dev/build
|
|
# environment setup: pinned Go version, per-user Inno Setup, checksum-verified
|
|
# vendor assets). The workflow only adds signing and publishing on top.
|
|
#
|
|
# Signing requires GitHub OIDC federation to Azure. If the Azure secrets are
|
|
# not configured the workflow still builds and attaches unsigned artifacts.
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
GO_VERSION: "1.22.2"
|
|
VERSION: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'dev' }}
|
|
|
|
jobs:
|
|
build-windows:
|
|
runs-on: windows-latest
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
|
|
# One idempotent step sets up Inno Setup + fetches/verifies the vendor
|
|
# assets and builds binaries + installer + runs the test suite.
|
|
- name: Setup build environment and build
|
|
shell: pwsh
|
|
run: |
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts/setup-build-env.ps1 -SkipGo -Build -CI
|
|
if ($LASTEXITCODE -ne 0) { throw "setup-build-env failed" }
|
|
|
|
- name: Generate SHA256SUMS
|
|
shell: pwsh
|
|
run: |
|
|
Get-ChildItem dist -File | Where-Object {
|
|
$_.Name -match 'windows-.*\.exe$|setup\.exe$' -or $_.Name -eq 'SHA256SUMS'
|
|
} | ForEach-Object {
|
|
"{0} {1}" -f (Get-FileHash -Algorithm SHA256 $_.FullName).Hash.ToLower(), $_.Name
|
|
} | Set-Content -Path dist/SHA256SUMS
|
|
|
|
- name: Sign with Azure Trusted Signing
|
|
if: env.AZURE_TENANT_ID != ''
|
|
uses: azure/login@v2
|
|
with:
|
|
client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
|
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
|
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
|
|
|
- name: AzureSignTool (agent, tray, helper, CP, installer)
|
|
if: env.AZURE_TENANT_ID != ''
|
|
uses: azure/trusted-signing-action@v0.4.0
|
|
with:
|
|
endpoint: ${{ secrets.AZURE_TS_ENDPOINT }}
|
|
trusted-signing-account-name: ${{ secrets.AZURE_TS_ACCOUNT }}
|
|
certificate-profile-name: ${{ secrets.AZURE_TS_CERT_PROFILE }}
|
|
files: |
|
|
dist/theta-agent-windows-*.exe
|
|
dist/theta-agent-tray-windows-*.exe
|
|
dist/theta-agent-helper-windows-*.exe
|
|
dist/theta-agent-*-setup.exe
|
|
output-files: ""
|
|
|
|
- name: Upload artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: theta-agent-windows
|
|
path: |
|
|
dist/theta-agent-windows-*.exe
|
|
dist/theta-agent-helper-windows-*.exe
|
|
dist/theta-agent-tray-windows-*.exe
|
|
dist/theta-agent-*-setup.exe
|
|
dist/SHA256SUMS
|
|
|
|
- name: Attach to GitHub release
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
files: |
|
|
dist/theta-agent-windows-*.exe
|
|
dist/theta-agent-helper-windows-*.exe
|
|
dist/theta-agent-tray-windows-*.exe
|
|
dist/theta-agent-*-setup.exe
|
|
dist/SHA256SUMS
|
|
|
|
# DESIGN-WINDOWS.md §9: the SSO holds the release resources. Publish when
|
|
# an admin-gated upload endpoint is configured; otherwise the artifacts
|
|
# are available from the GitHub release above.
|
|
- name: Publish to SSO resource tree
|
|
if: env.SSO_RESOURCE_PUBLISH_URL != ''
|
|
shell: pwsh
|
|
run: |
|
|
$headers = @{ Authorization = "Bearer $env:SSO_RESOURCE_PUBLISH_TOKEN" }
|
|
foreach ($f in Get-ChildItem dist -File) {
|
|
if ($f.Name -notmatch "setup|windows-|SHA256SUMS") { continue }
|
|
Invoke-RestMethod -Method Post -Uri "$env:SSO_RESOURCE_PUBLISH_URL/$($f.Name)" -InFile $f.FullName -Headers $headers
|
|
}
|
|
env:
|
|
SSO_RESOURCE_PUBLISH_URL: ${{ secrets.SSO_RESOURCE_PUBLISH_URL }}
|
|
SSO_RESOURCE_PUBLISH_TOKEN: ${{ secrets.SSO_RESOURCE_PUBLISH_TOKEN }}
|