d99cfaf51a
Added Windows ARM64 support to the desktop build pipeline, introducing separate target architecture arrays for x64 and ARM64, configuring electron-builder to produce artifacts for both platforms, and adding tests to assert the correct architecture names. Fusion-Task-Id: FN-5594 Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai> Fusion-Task-Id: FN-5594
70 lines
2.5 KiB
YAML
70 lines
2.5 KiB
YAML
name: Desktop Windows Build
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build-windows-exe:
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build desktop package
|
|
run: pnpm --filter @fusion/desktop build
|
|
|
|
# Code-signing hardening is intentionally deferred to FN-5592.
|
|
- name: Package signed Windows EXE
|
|
if: ${{ env.WINDOWS_CERTIFICATE_BASE64 != '' }}
|
|
run: pnpm --filter @fusion/desktop exec electron-builder --win --x64 --arm64 --publish never
|
|
env:
|
|
WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
|
|
CSC_LINK: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
|
|
CSC_KEY_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
|
|
CSC_IDENTITY_AUTO_DISCOVERY: "false"
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Package unsigned Windows EXE
|
|
if: ${{ env.WINDOWS_CERTIFICATE_BASE64 == '' }}
|
|
run: pnpm --filter @fusion/desktop exec electron-builder --win --x64 --arm64 --publish never
|
|
env:
|
|
WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
|
|
CSC_IDENTITY_AUTO_DISCOVERY: "false"
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Verify signed artifacts
|
|
if: ${{ env.WINDOWS_CERTIFICATE_BASE64 != '' }}
|
|
shell: pwsh
|
|
env:
|
|
WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
|
|
run: |
|
|
$exes = Get-ChildItem packages/desktop/dist-electron -Filter *.exe
|
|
if ($exes.Count -eq 0) { Write-Error "No EXE artifacts produced"; exit 1 }
|
|
foreach ($exe in $exes) {
|
|
$sig = Get-AuthenticodeSignature $exe.FullName
|
|
Write-Host "$($exe.Name): $($sig.Status)"
|
|
if ($sig.Status -ne 'Valid') { Write-Error "Signature invalid: $($exe.Name) ($($sig.Status))"; exit 1 }
|
|
}
|
|
|
|
# Automated publish is intentionally deferred to FN-5593.
|
|
# Keep a single artifact; filenames include -x64 / -arm64 so both arches are captured.
|
|
- name: Upload Windows artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: fusion-desktop-windows
|
|
path: |
|
|
packages/desktop/dist-electron/*.exe
|
|
packages/desktop/dist-electron/*.blockmap
|