Integrate and package Windows command sandboxing #36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Windows package | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [master] | |
| paths: | |
| - "src/**" | |
| - "script/**" | |
| - "bin/**" | |
| - "native/**" | |
| - "qlfile*" | |
| - "autolith.asd" | |
| - "tests/**" | |
| - "sbcl.version" | |
| - "sbcl-*-releases.sha256" | |
| - ".github/workflows/windows-package.yml" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: windows-package-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| unicode-runtime: | |
| runs-on: windows-2025 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Check Unicode runtime startup and core I/O | |
| shell: pwsh | |
| run: | | |
| & bin\autolith-runtime.ps1 --install --script script/runtime-requirement.lisp | |
| if ($LASTEXITCODE -ne 0) { throw 'Runtime installation failed.' } | |
| $version = (Get-Content -Raw sbcl.version).Trim() | |
| $installed = Join-Path $env:LOCALAPPDATA "autolith\data\runtimes\$version\installation" | |
| $runtime = Join-Path $env:RUNNER_TEMP 'runtime Lukáš-žluťoučký' | |
| Copy-Item -Recurse -LiteralPath $installed -Destination $runtime | |
| script\prepare-windows-runtime.ps1 -Runtime (Join-Path $runtime 'sbcl.exe') | |
| script\check-windows-runtime.ps1 -RuntimeDirectory $runtime | |
| package-windows-x86_64: | |
| needs: unicode-runtime | |
| runs-on: windows-2025 | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install build dependencies | |
| shell: pwsh | |
| run: | | |
| choco install llvm cmake make --yes --no-progress | |
| if (-not (Get-Command cargo.exe -ErrorAction SilentlyContinue)) { | |
| Invoke-WebRequest https://win.rustup.rs/x86_64 -OutFile "$env:RUNNER_TEMP\rustup-init.exe" | |
| & "$env:RUNNER_TEMP\rustup-init.exe" -y --profile minimal --default-toolchain 1.97.1 | |
| "$env:USERPROFILE\.cargo\bin" | Out-File -Append -Encoding utf8 $env:GITHUB_PATH | |
| } | |
| # Failing steps publish their output through check annotations, which the | |
| # public API serves while job logs need authentication. | |
| - name: Bootstrap | |
| id: bootstrap | |
| shell: pwsh | |
| run: | | |
| $log = Join-Path $env:RUNNER_TEMP 'bootstrap.log' | |
| $status = 0 | |
| try { | |
| & script\bootstrap.ps1 2>&1 | Tee-Object -FilePath $log | |
| if ($null -ne $LASTEXITCODE) { $status = $LASTEXITCODE } | |
| } catch { | |
| $_ | Out-String | Tee-Object -FilePath $log -Append | |
| $status = 1 | |
| } | |
| if ($status -ne 0) { | |
| script\ci-report-failure.ps1 -Title 'Windows bootstrap failed' -Log $log -Status $status | |
| exit $status | |
| } | |
| - name: Package Windows release | |
| shell: pwsh | |
| run: | | |
| $tag = "v0.50.0-dev.$env:GITHUB_RUN_NUMBER" | |
| script\package-windows-release.ps1 -OutputDirectory dist -Tag $tag | |
| script\validate-windows-release-artifact.ps1 -Archive (Get-ChildItem dist\*.zip).FullName | |
| # Exercise first-run builds with both release and data paths containing Unicode. | |
| - name: Smoke-test the packaged launcher | |
| shell: pwsh | |
| run: | | |
| $archive = (Get-ChildItem dist\*.zip).FullName | |
| $stage = Join-Path $env:RUNNER_TEMP 'release-smoke-Lukáš-žluťoučký' | |
| Expand-Archive -LiteralPath $archive -DestinationPath $stage | |
| $release = Join-Path $stage ([IO.Path]::GetFileNameWithoutExtension($archive)) | |
| $env:LOCALAPPDATA = Join-Path $env:RUNNER_TEMP 'release-smoke-Lukáš-žluťoučký-home' | |
| New-Item -ItemType Directory -Force -Path $env:LOCALAPPDATA | Out-Null | |
| $log = Join-Path $env:RUNNER_TEMP 'smoke.log' | |
| $status = 0 | |
| try { | |
| & (Join-Path $release 'bin\autolith.cmd') --version 2>&1 | Tee-Object -FilePath $log | |
| if ($null -ne $LASTEXITCODE) { $status = $LASTEXITCODE } | |
| } catch { | |
| $_ | Out-String | Tee-Object -FilePath $log -Append | |
| $status = 1 | |
| } | |
| if ($status -ne 0) { | |
| script\ci-report-failure.ps1 -Title 'Windows release smoke test failed' -Log $log -Status $status | |
| exit $status | |
| } | |
| - name: Verify packaged sandbox under a standard account | |
| shell: pwsh | |
| run: script\check-windows-sandbox.ps1 -Archive (Get-ChildItem dist\*.zip).FullName | |
| - name: Check | |
| if: ${{ !cancelled() && steps.bootstrap.outcome == 'success' }} | |
| shell: pwsh | |
| run: | | |
| $log = Join-Path $env:RUNNER_TEMP 'check.log' | |
| $status = 0 | |
| try { | |
| & script\check.ps1 --jobs 1 --timeout 900 2>&1 | Tee-Object -FilePath $log | |
| if ($null -ne $LASTEXITCODE) { $status = $LASTEXITCODE } | |
| } catch { | |
| $_ | Out-String | Tee-Object -FilePath $log -Append | |
| $status = 1 | |
| } | |
| if ($status -ne 0) { | |
| script\ci-report-failure.ps1 -Title 'Windows check failed' -Log $log -Status $status | |
| exit $status | |
| } | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: autolith-windows-${{ github.sha }} | |
| path: | | |
| dist/*.zip | |
| dist/*.zip.sha256 | |
| if-no-files-found: error | |
| retention-days: 14 |