test: verify uiAccess token in CI; remove co_await from task.RequestE… #107
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Windows CI | |
| on: | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| branches: | |
| - master | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: Windows build test (${{ matrix.arch }}) | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: amd64 | |
| runner: windows-latest | |
| triplet: x64-windows-static | |
| vcvars_arch: amd64 | |
| - arch: arm64 | |
| runner: windows-11-arm | |
| triplet: arm64-windows-static | |
| vcvars_arch: arm64 | |
| concurrency: | |
| group: windows-ci-${{ matrix.arch }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| shell: pwsh | |
| env: | |
| CLIPP_RELEASE_TRIPLET: ${{ matrix.triplet }} | |
| VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-cache,readwrite | |
| steps: | |
| - name: Checkout clipp | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - name: Read vcpkg baseline | |
| id: vcpkg-baseline | |
| run: | | |
| $manifest = Get-Content -Raw src\vcpkg.json | ConvertFrom-Json | |
| $baseline = $manifest.'builtin-baseline' | |
| if (-not $baseline) { | |
| throw "src\vcpkg.json must define builtin-baseline for CI." | |
| } | |
| "ref=$baseline" >> $env:GITHUB_OUTPUT | |
| - name: Set vcpkg short root | |
| run: | | |
| $workspaceRoot = [System.IO.Path]::GetPathRoot($env:GITHUB_WORKSPACE) | |
| if (-not $workspaceRoot) { | |
| throw "Could not determine workspace drive from GITHUB_WORKSPACE='$env:GITHUB_WORKSPACE'." | |
| } | |
| $vcpkgRoot = Join-Path $workspaceRoot "v" | |
| if (Test-Path $vcpkgRoot) { | |
| throw "vcpkg short root already exists: $vcpkgRoot" | |
| } | |
| New-Item -ItemType Directory -Path $vcpkgRoot | Out-Null | |
| "VCPKG_ROOT=$vcpkgRoot" >> $env:GITHUB_ENV | |
| Write-Host "Using VCPKG_ROOT=$vcpkgRoot" | |
| - name: Checkout vcpkg | |
| run: | | |
| git clone --no-tags https://github.com/microsoft/vcpkg.git $env:VCPKG_ROOT | |
| git -C $env:VCPKG_ROOT checkout --detach ${{ steps.vcpkg-baseline.outputs.ref }} | |
| - name: Bootstrap vcpkg | |
| run: | | |
| $bootstrap = Join-Path $env:VCPKG_ROOT "bootstrap-vcpkg.bat" | |
| & $bootstrap -disableMetrics | |
| - name: Prepare vcpkg binary cache | |
| run: New-Item -ItemType Directory -Force vcpkg-cache | Out-Null | |
| - name: Cache vcpkg binaries | |
| uses: actions/cache@v5 | |
| with: | |
| path: vcpkg-cache | |
| key: ${{ runner.os }}-${{ runner.arch }}-vcpkg-${{ matrix.triplet }}-${{ hashFiles('src/vcpkg.json', 'src/vcpkg-triplets/**') }} | |
| restore-keys: | | |
| ${{ runner.os }}-${{ runner.arch }}-vcpkg-${{ matrix.triplet }}- | |
| - name: Build Release | |
| run: .\scripts\build_windows.ps1 -BuildType Release -Triplet $env:CLIPP_RELEASE_TRIPLET -VcVarsArch ${{ matrix.vcvars_arch }} -DisableCodeSigning | |
| - name: Verify Windows artifacts | |
| run: | | |
| $exe = ".\build\windows-release\clipp.exe" | |
| $shim = ".\build\windows-release\clipp.com" | |
| if (-not (Test-Path $exe)) { | |
| throw "Missing expected executable: $exe" | |
| } | |
| if (-not (Test-Path $shim)) { | |
| throw "Missing expected console shim: $shim" | |
| } | |
| - name: Verify static dependency closure | |
| run: | | |
| $exe = ".\build\windows-release\clipp.exe" | |
| $vswhere = Join-Path ${env:ProgramFiles(x86)} "Microsoft Visual Studio\Installer\vswhere.exe" | |
| $installPath = & $vswhere -latest -products * -property installationPath | |
| $vcvars = Join-Path $installPath "VC\Auxiliary\Build\vcvarsall.bat" | |
| $dump = & cmd.exe /d /s /c "call `"$vcvars`" ${{ matrix.vcvars_arch }} >nul && dumpbin /dependents `"$exe`"" | |
| $dump | |
| $blocked = $dump | Select-String -Pattern "VCRUNTIME|MSVCP|ucrtbase|libsodium|xxhash|zstd|lodepng" -CaseSensitive:$false | |
| if ($blocked) { | |
| throw "Release exe imports non-system runtime/dependency DLLs: $($blocked -join '; ')" | |
| } | |
| # NOTE: the launch/exit smoke test (scripts/exitcode_smoke.ps1) deliberately does NOT | |
| # run here. It has to drive a SIGNED binary — an unsigned uiAccess exe refuses to | |
| # launch — and signing on every push/PR would burn Trusted Signing operations for a | |
| # check that only matters at release time. It lives in _release.yml instead, where it | |
| # runs against the INSTALLED, signed MSIX: the only configuration in which uiAccess is | |
| # actually granted (WindowsApps is a secure path), which is what winget's validation | |
| # exercises. |