Add CI validations install and run Desktop client (Windows)

[neuronull]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-30132

📔 Objective

Adds validation step to install the Windows portable for Desktop, and run the client. The new check provides automated confirmation that what we built and packaged is installable and does not crash when executed on the Windows platform.

📸 Screenshots

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – dd7fcc1a-6afb-4b6e-8e06-3e3510e3e7cf

New Issues (5)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2025-14174	Npm-electron-39.2.6	details Description: Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory acce... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
2		CVE-2025-14765	Npm-electron-39.2.6	details Description: Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HT... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
3		CVE-2025-14766	Npm-electron-39.2.6	details Description: Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
4		CVE-2025-15284	Npm-qs-6.14.0	details Description: Improper Input Validation vulnerability in qs (parse modules) versions prior to 6.14.1 allows HTTP Denial-of-Service (DoS). The "arrayLimit" option... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
5		CVE-2025-15284	Npm-qs-6.13.0	details Description: Improper Input Validation vulnerability in qs (parse modules) versions prior to 6.14.1 allows HTTP Denial-of-Service (DoS). The "arrayLimit" option... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 42.27%. Comparing base (97d9f9b) to head (6ad6cb8).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                                       Coverage Diff                                        @@
##           autofill/pm-30131/add-ci-workflow-install-run-desktop-client   #18141      +/-   ##
================================================================================================
- Coverage                                                         42.27%   42.27%   -0.01%     
================================================================================================
  Files                                                              3592     3592              
  Lines                                                            104325   104325              
  Branches                                                          15734    15734              
================================================================================================
- Hits                                                              44105    44104       -1     
  Misses                                                            58345    58345              
- Partials                                                           1875     1876       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud