ci: setup windows with signing and gcs publish

.github/workflows/build-windows.yml

@@ -1,21 +1,13 @@
-# Phase 1: build unsigned Windows installers on demand, upload as run artifacts.
-#
-# To graduate to Phase 2 (signed + published to GCS):
-#   1. Add GCP auth step (`google-github-actions/auth@v2` via WIF) + `setup-gcloud`.
-#      Swap `yarn make:win` for a new `yarn release:win` script that runs
-#      `electron-forge publish` per arch and a gsutil cache-control step.
-#   2. Add an Azure Trusted Signing setup step that downloads the
-#      Microsoft.Trusted.Signing.Client dlib and writes a metadata JSON file,
-#      then exports AZURE_DLIB_PATH + AZURE_METADATA_JSON_PATH. Set
-#      AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET from secrets.
-#      The dormant `windowsSign` branch in js/forge.config.ts activates
-#      automatically once AZURE_METADATA_JSON_PATH is set.
-
 name: Build Windows
 
 on:
   workflow_dispatch:
 
+permissions:
+  # Azure Trusted Signing uses OIDC federated credentials from GitHub.
+  id-token: write
+  contents: read
+
 jobs:
   build:
     runs-on: windows-latest
@@ -24,6 +16,8 @@ jobs:
         working-directory: js
     env:
       APP_ENV: prod
+      AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
+      AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
 
     steps:
       - uses: actions/checkout@v4
@@ -42,12 +36,43 @@ jobs:
       - name: Install dependencies
         run: yarn install --frozen-lockfile --network-timeout 600000
 
-      - name: Build Windows installers (x64 + arm64, unsigned)
+      - name: Azure login (OIDC)
-        run: yarn make:win
+        uses: azure/login@v2
+        with:
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          allow-no-subscriptions: true
 
-      - name: Upload installers
+      - name: Install Trusted Signing client dlib
+        shell: pwsh
+        working-directory: .
+        run: |
+          nuget install Microsoft.Trusted.Signing.Client -Version 1.0.60 -OutputDirectory $env:RUNNER_TEMP\trusted-signing -ExcludeVersion
+          $dlib = Join-Path $env:RUNNER_TEMP "trusted-signing\Microsoft.Trusted.Signing.Client\bin\x64\Azure.CodeSigning.Dlib.dll"
+          if (-not (Test-Path $dlib)) { throw "Dlib not found at $dlib" }
+          "AZURE_DLIB_PATH=$dlib" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "AZURE_METADATA_JSON_PATH=$env:GITHUB_WORKSPACE\js\build\signing-metadata.json" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ secrets.PROD_GKE_SERVICE_ACCOUNT_KEY }}
+
+      - name: Set up gcloud
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Publish signed installer (x64)
+        run: yarn publish:win
+
+      - name: Invalidate RELEASES cache
+        shell: pwsh
+        working-directory: .
+        run: gsutil setmeta -h "Cache-Control:no-cache, no-store, must-revalidate" gs://flowy-releases/llink/win32/x64/RELEASES.json
+
+      - name: Upload installers (debug artifact)
+        if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: flowy-llink-windows-unsigned
+          name: flowy-llink-windows-signed
           path: js/out/make/**/*
-          if-no-files-found: error
+          if-no-files-found: warn

js/forge.config.ts

@@ -41,13 +41,7 @@ const config: ForgeConfig = {
   rebuildConfig: {},
   makers: [
     new MakerSquirrel((arch) => ({
-      // `remoteReleases` is only useful when producing delta packages against a
+      remoteReleases: `https://storage.googleapis.com/flowy-releases/llink/win32/${arch}`,
-      // previously-published build. During a plain `make` (no publish), Squirrel
-      // fetches this URL and fails with a 404 if nothing has been uploaded yet.
-      // Gate it on SQUIRREL_REMOTE_RELEASES=1 which the publish workflow sets.
-      ...(process.env.SQUIRREL_REMOTE_RELEASES === '1' ? {
-        remoteReleases: `https://storage.googleapis.com/flowy-releases/llink/win32/${arch}`,
-      } : {}),
       // Windows code signing via Azure Trusted Signing. Dormant unless the workflow
       // provisions the dlib + metadata file and exports these env vars, so local
       // `yarn make` and unsigned CI builds both work unchanged.

js/package.json

@@ -7,11 +7,12 @@
   "private": true,
   "scripts": {
     "start": "electron-forge start",
-    "package": "APP_ENV=prod electron-forge package --arch=arm64 && APP_ENV=prod electron-forge package --arch=x64",
+    "package:mac": "APP_ENV=prod electron-forge package --arch=arm64 && APP_ENV=prod electron-forge package --arch=x64",
-    "make": "APP_ENV=prod electron-forge make --arch=arm64 && APP_ENV=prod electron-forge make --arch=x64",
+    "make:mac": "APP_ENV=prod electron-forge make --arch=arm64 && APP_ENV=prod electron-forge make --arch=x64",
-    "make:win": "electron-forge make --platform=win32 --arch=x64 && electron-forge make --platform=win32 --arch=arm64",
+    "make:win": "electron-forge make --platform=win32 --arch=x64",
-    "release": "echo '\n⚠️  Have you bumped the version in package.json? (current: '$(node -p \"require('./package.json').version\")') [y/N]' && read -r answer && [ \"$answer\" = \"y\" ] && APP_ENV=prod electron-forge publish --arch=arm64 && APP_ENV=prod electron-forge publish --arch=x64 && gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/darwin/arm64/RELEASES.json && gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/darwin/x64/RELEASES.json",
+    "publish:win": "electron-forge publish --platform=win32 --arch=x64",
-    "invalidate-gcs-cache": "gsutil -h \"Cache-Control:no-cache, no-store, max-age=0\" cp gs://flowy-releases/llink/darwin/arm64/RELEASES.json gs://flowy-releases/llink/darwin/arm64/RELEASES.json ; gsutil -h \"Cache-Control:no-cache, no-store, max-age=0\" cp gs://flowy-releases/llink/darwin/x64/RELEASES.json gs://flowy-releases/llink/darwin/x64/RELEASES.json",
+    "publish:mac": "echo '\n⚠️  Have you bumped the version in package.json? (current: '$(node -p \"require('./package.json').version\")') [y/N]' && read -r answer && [ \"$answer\" = \"y\" ] && APP_ENV=prod electron-forge publish --arch=arm64 && APP_ENV=prod electron-forge publish --arch=x64",
+    "invalidate-gcs-cache": "gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/darwin/arm64/RELEASES.json && gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/darwin/x64/RELEASES.json && gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/win32/x64/RELEASES.json",
     "lint": "eslint --ext .ts,.tsx .",
     "compile": "npx tsc --noEmit 2>&1 | grep '^src/'"
   },