Skip to content

[codex] fix desktop update packaging integrity #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wizzoapp wants to merge 7 commits into
base: main
Choose a base branch
from
+2,276 −89
Open

[codex] fix desktop update packaging integrity #96

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
1893992
fix desktop update packaging integrity
wizzoapp[bot] Jul 6, 2026
1c7bef0
codex: fix desktop package linker unpack paths
wizzoapp[bot] Jul 6, 2026
9c0ba5c
codex: fix desktop update smoke packaging (#96)
wizzoapp[bot] Jul 6, 2026
018a75e
fix: harden desktop package smoke diagnostics
wizzoapp[bot] Jul 7, 2026
0aaff8f
fix: harden desktop package staging paths
wizzoapp[bot] Jul 7, 2026
83dbf19
test: preserve desktop smoke fatal output
wizzoapp[bot] Jul 7, 2026
fac5777
test: focus desktop smoke fatal snapshots
wizzoapp[bot] Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 48 additions & 13 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,8 @@ jobs:

- name: Verify preload bundle output
run: |
test -f apps/desktop/dist-electron/bootstrap.cjs
grep -n "packaged-integrity-manifest" apps/desktop/dist-electron/bootstrap.cjs
test -f apps/desktop/dist-electron/preload.cjs
grep -nE "desktopBridge|getLocalEnvironmentBootstrap|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.cjs
grep -n "__clerk_internal_electron_passkeys" apps/desktop/dist-electron/preload.cjs
Expand Down Expand Up @@ -143,7 +145,10 @@ jobs:
needs.build_wsl_node_pty_for_windows_smoke.result == 'success'
}}
runs-on: windows-latest
timeout-minutes: 60
timeout-minutes: 90
env:
DESKTOP_UPDATE_SMOKE_FROM_VERSION: "0.0.900"
DESKTOP_UPDATE_SMOKE_TO_VERSION: "0.0.901"
steps:
- name: Checkout
uses: actions/checkout@v6
Expand All @@ -164,27 +169,44 @@ jobs:
- name: Ensure Electron runtime is installed
run: vp run --filter @t3tools/desktop ensure:electron

- name: Build Windows desktop artifact
- name: Build previous Windows desktop artifact
shell: bash
run: |
set -euo pipefail
vp run dist:desktop:artifact \
--platform win \
--target nsis \
--arch x64 \
--build-version "$DESKTOP_UPDATE_SMOKE_FROM_VERSION" \
--output-dir release-prev \
--wsl-prebuild "$GITHUB_WORKSPACE/wsl-prebuild/pty.node" \
--verbose

- name: Build Windows desktop update artifact
shell: bash
run: |
set -euo pipefail
vp run dist:desktop:artifact \
--platform win \
--target nsis \
--arch x64 \
--build-version "$DESKTOP_UPDATE_SMOKE_TO_VERSION" \
--output-dir release \
--mock-updates \
--skip-build \
--wsl-prebuild "$GITHUB_WORKSPACE/wsl-prebuild/pty.node" \
--verbose

- id: install
name: Install Windows desktop artifact
name: Install previous Windows desktop artifact
shell: pwsh
run: |
$ErrorActionPreference = "Stop"
$installer = Get-ChildItem -Path release -Filter "*.exe" |
$installer = Get-ChildItem -Path release-prev -Filter "*.exe" |
Sort-Object Length -Descending |
Select-Object -First 1
if (-not $installer) {
throw "No NSIS installer found in release."
throw "No previous-version NSIS installer found in release-prev."
}

$installDir = Join-Path $env:RUNNER_TEMP "t3code-install"
Expand Down Expand Up @@ -212,11 +234,24 @@ jobs:
throw "No expected installed application executable found under $installDir. Expected one of: $($expectedExeNames -join ', '). Top-level executables: $($topLevelExecutables -join ', ')"
}

"installer_path=$($installer.FullName)" >> $env:GITHUB_OUTPUT
"app_exe=$($appExe.FullName)" >> $env:GITHUB_OUTPUT
"install_dir=$installDir" >> $env:GITHUB_OUTPUT
Write-Host "Installed desktop executable: $($appExe.FullName)"

- name: Assert launch smoke rejects missing packaged main dependency
- name: Update installed Windows desktop app through mock feed
shell: pwsh
run: |
$ErrorActionPreference = "Stop"
$updateRoot = Join-Path $env:GITHUB_WORKSPACE "release"
node apps/desktop/scripts/desktop-update-smoke.mjs `
--command "${{ steps.install.outputs.app_exe }}" `
--update-root "$updateRoot" `
--expected-from-version "$env:DESKTOP_UPDATE_SMOKE_FROM_VERSION" `
--expected-to-version "$env:DESKTOP_UPDATE_SMOKE_TO_VERSION" `
--timeout-ms 240000

- name: Assert launch smoke reports missing unpacked runtime file
shell: pwsh
run: |
$ErrorActionPreference = "Stop"
Expand All @@ -231,22 +266,22 @@ jobs:
Copy-Item -Recurse -Force (Join-Path $cleanInstallDir "*") $brokenInstallDir

$brokenAppExe = Join-Path $brokenInstallDir (Split-Path -Leaf $cleanAppExe)
$removedDependency = Join-Path $brokenInstallDir "resources/app.asar.unpacked/node_modules/electron-updater"
if (-not (Test-Path $removedDependency)) {
throw "Negative launch-smoke fixture could not find packaged dependency to remove: $removedDependency"
$removedRuntimeFile = Join-Path $brokenInstallDir "resources/app.asar.unpacked/apps/server/dist/bin.mjs"
if (-not (Test-Path $removedRuntimeFile)) {
throw "Negative launch-smoke fixture could not find packaged runtime file to remove: $removedRuntimeFile"
}
Remove-Item -Recurse -Force $removedDependency
Remove-Item -Force $removedRuntimeFile

$output = & node scripts/desktop-launch-smoke.mjs --command "$brokenAppExe" --timeout-ms 45000 --stability-ms 1000 2>&1
$exitCode = $LASTEXITCODE
$outputText = $output | Out-String
$output | ForEach-Object { Write-Host $_ }

if ($exitCode -eq 0) {
throw "Launch smoke passed against a packaged artifact with electron-updater removed; the gate is not trustworthy."
throw "Launch smoke passed against a packaged artifact with a required unpacked runtime file removed; the gate is not trustworthy."
}
if ($outputText -notmatch "(?i)(electron-updater|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND|Cannot find module)") {
throw "Launch smoke failed against the broken packaged artifact, but did not report the expected missing electron-updater dependency."
if ($outputText -notmatch "(?i)(installation is incomplete|apps/server/dist/bin\\.mjs)") {
throw "Launch smoke failed against the broken packaged artifact, but did not report the expected incomplete-installation diagnostic."
}

Write-Host "Launch smoke rejected the deliberately broken packaged artifact with exit code $exitCode."
Expand Down
37 changes: 29 additions & 8 deletions .github/workflows/reusable-build-release-artifacts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -457,11 +457,12 @@ jobs:
throw "No expected installed application executable found under $installDir. Expected one of: $($expectedExeNames -join ', '). Top-level executables: $($topLevelExecutables -join ', ')"
}

"installer_path=$($installer.FullName)" >> $env:GITHUB_OUTPUT
"app_exe=$($appExe.FullName)" >> $env:GITHUB_OUTPUT
"install_dir=$installDir" >> $env:GITHUB_OUTPUT
Write-Host "Installed desktop executable: $($appExe.FullName)"

- name: Assert launch smoke rejects missing packaged main dependency
- name: Assert launch smoke reports missing unpacked runtime file
shell: pwsh
run: |
$ErrorActionPreference = "Stop"
Expand All @@ -476,27 +477,47 @@ jobs:
Copy-Item -Recurse -Force (Join-Path $cleanInstallDir "*") $brokenInstallDir

$brokenAppExe = Join-Path $brokenInstallDir (Split-Path -Leaf $cleanAppExe)
$removedDependency = Join-Path $brokenInstallDir "resources/app.asar.unpacked/node_modules/electron-updater"
if (-not (Test-Path $removedDependency)) {
throw "Negative launch-smoke fixture could not find packaged dependency to remove: $removedDependency"
$removedRuntimeFile = Join-Path $brokenInstallDir "resources/app.asar.unpacked/apps/server/dist/bin.mjs"
if (-not (Test-Path $removedRuntimeFile)) {
throw "Negative launch-smoke fixture could not find packaged runtime file to remove: $removedRuntimeFile"
}
Remove-Item -Recurse -Force $removedDependency
Remove-Item -Force $removedRuntimeFile

$output = & node scripts/desktop-launch-smoke.mjs --command "$brokenAppExe" --timeout-ms 45000 --stability-ms 1000 2>&1
$exitCode = $LASTEXITCODE
$outputText = $output | Out-String
$output | ForEach-Object { Write-Host $_ }

if ($exitCode -eq 0) {
throw "Launch smoke passed against a packaged artifact with electron-updater removed; the gate is not trustworthy."
throw "Launch smoke passed against a packaged artifact with a required unpacked runtime file removed; the gate is not trustworthy."
}
if ($outputText -notmatch "(?i)(electron-updater|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND|Cannot find module)") {
throw "Launch smoke failed against the broken packaged artifact, but did not report the expected missing electron-updater dependency."
if ($outputText -notmatch "(?i)(installation is incomplete|apps/server/dist/bin\\.mjs)") {
throw "Launch smoke failed against the broken packaged artifact, but did not report the expected incomplete-installation diagnostic."
}

Write-Host "Launch smoke rejected the deliberately broken packaged artifact with exit code $exitCode."
exit 0

- name: Install Windows desktop artifact over existing install
shell: pwsh
run: |
$ErrorActionPreference = "Stop"
$installerPath = "${{ steps.install.outputs.installer_path }}"
$installDir = "${{ steps.install.outputs.install_dir }}"

$process = Start-Process `
-FilePath $installerPath `
-ArgumentList @("/S", "/D=$installDir") `
-Wait `
-PassThru
if ($process.ExitCode -ne 0) {
throw "NSIS over-existing-install run exited with code $($process.ExitCode)."
}

if (-not (Test-Path "${{ steps.install.outputs.app_exe }}")) {
throw "Application executable is missing after over-existing-install run."
}

- name: Launch installed Windows desktop app
shell: pwsh
run: node scripts/desktop-launch-smoke.mjs --command "${{ steps.install.outputs.app_exe }}" --timeout-ms 90000
Expand Down
Loading
Loading