From 028adee0467938acd9b1a10152d08de06bdaac0c Mon Sep 17 00:00:00 2001
From: AJ Isaacs <ajisaacs27@gmail.com>
Date: Thu, 8 Oct 2026 19:42:13 -0400
Subject: [PATCH] ci(release): pin Poppler for Windows PDF verification

---
 .github/workflows/windows-release.yml          | 14 ++++++++++++++
 OpenNest.Tests/Reporting/NestPdfWriterTests.cs |  8 --------
 docs/nest-reports.md                           |  5 ++++-
 docs/releasing.md                              |  4 +++-
 4 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/windows-release.yml b/.github/workflows/windows-release.yml
index 8445557..ed00eb4 100644
--- a/.github/workflows/windows-release.yml
+++ b/.github/workflows/windows-release.yml
@@ -49,6 +49,20 @@ jobs:
         run: |
           dotnet build OpenNest.sln -c Release
           if ($LASTEXITCODE -ne 0) { throw 'Solution build failed.' }
+      - name: Install pinned Poppler for PDF report tests
+        run: |
+          $zip = Join-Path $env:RUNNER_TEMP 'poppler-26.09.0.zip'
+          Invoke-WebRequest 'https://github.com/oschwartz10612/poppler-windows/releases/download/v26.09.0-0/Release-26.09.0-0.zip' -OutFile $zip
+          $actual = (Get-FileHash $zip -Algorithm SHA256).Hash.ToLowerInvariant()
+          if ($actual -ne '7a6f256a0ddf7536182246a5733331bf4677cbcc34f4663774947ad34556c8d0') { throw 'Poppler archive hash mismatch.' }
+          $destination = Join-Path $env:RUNNER_TEMP 'poppler-release-tests'
+          Expand-Archive $zip -DestinationPath $destination
+          $bin = Join-Path $destination 'poppler-26.09.0/Library/bin'
+          $tool = Join-Path $bin 'pdftotext.exe'
+          if (-not (Test-Path $tool)) { throw 'Pinned pdftotext.exe is missing.' }
+          & $tool -v
+          if ($LASTEXITCODE -ne 0) { throw 'Pinned pdftotext.exe cannot start.' }
+          $bin >> $env:GITHUB_PATH
       - name: Run all test projects on Windows
         # A test silent for 5 minutes is killed and named in the log, with a
         # mini dump in TestResults, instead of holding the runner until the
diff --git a/OpenNest.Tests/Reporting/NestPdfWriterTests.cs b/OpenNest.Tests/Reporting/NestPdfWriterTests.cs
index dbeae1c..996e1d5 100644
--- a/OpenNest.Tests/Reporting/NestPdfWriterTests.cs
+++ b/OpenNest.Tests/Reporting/NestPdfWriterTests.cs
@@ -37,15 +37,7 @@ public sealed class NestPdfWriterTests : IDisposable
     public void Write_PdfTextCarriesDocumentLocalIdsQuantitiesAndPageNumbers()
     {
         var path = WriteReport(NestReportTestData.CreateNest());
-        if (OperatingSystem.IsWindows() && Environment.GetEnvironmentVariable("GITHUB_ACTIONS") == "true")
-        {
-            var results = Path.Combine(Environment.GetEnvironmentVariable("GITHUB_WORKSPACE")!, "TestResults");
-            Directory.CreateDirectory(results);
-            File.Copy(path, Path.Combine(results, "pdf-report-text-diagnostic.pdf"), overwrite: true);
-        }
         var summary = ReportPdf.Text(path, 1);
-        if (OperatingSystem.IsWindows() && Environment.GetEnvironmentVariable("GITHUB_ACTIONS") == "true")
-            File.WriteAllText(Path.Combine(Environment.GetEnvironmentVariable("GITHUB_WORKSPACE")!, "TestResults", "pdf-report-text-windows.txt"), summary);
         var plate = ReportPdf.Text(path, 2);
 
         Assert.Contains("Report test job", summary);
diff --git a/docs/nest-reports.md b/docs/nest-reports.md
index 92113d7..d19dbeb 100644
--- a/docs/nest-reports.md
+++ b/docs/nest-reports.md
@@ -133,7 +133,10 @@ dotnet test OpenNest.Tests/OpenNest.Tests.csproj --filter FullyQualifiedName~Rep
 The writer tests read page sizes and content streams with PDFsharp. Text
 assertions use Poppler's `pdftotext -bbox` coordinates to rebuild visual rows;
 `-layout` can return columns in a different order on Windows. They are skipped,
-not passed, when poppler-utils is absent. For manual inspection also use `pdfinfo`,
+not passed, when poppler-utils is absent. The Windows release workflow installs
+an SHA-256-pinned Poppler binary because the runner's built-in `pdftotext` lacks
+`-bbox`; no PDF text test is skipped for that reason in a release candidate.
+For manual inspection also use `pdfinfo`,
 `pdffonts` and `pdftoppm -png` (Linux verification baseline: poppler-utils
 24.02.0). Confirm page sizes, quantity rows, page X of Y, embedded fonts, native
 vector curves, unfilled holes and visible tab gaps with no connecting stroke.
diff --git a/docs/releasing.md b/docs/releasing.md
index ccd7d11..0b4c1c6 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -15,7 +15,9 @@ pulls from GitHub every hour; it refuses pushes.
    runner. It builds the solution, runs all six test projects in Release and
    the main test project in Debug, then packages and smoke-tests the desktop app.
    A test that is silent for five minutes is killed and named in the log, with a
-   mini dump in the uploaded `windows-test-results` artifact.
+   mini dump in the uploaded `windows-test-results` artifact. The release job
+   installs a SHA-256-pinned Poppler Windows binary for PDF text/column tests;
+   the runner's older `pdftotext` lacks the required `-bbox` option.
    Optional local/proprietary fixture and opt-in measurement tests may skip;
    inspect the uploaded TRX files rather than treating skips as passes.
 4. Download the `OpenNest-X.Y.Z-win-x64` artifact and verify its `.sha256`.