ci(release): build and verify Windows desktop packages

2026-09-27 18:57:38 -04:00
parent ca1902e075
commit 1b9988a1ba
6 changed files with 253 additions and 1 deletions
@@ -0,0 +1,53 @@
+# Windows releases
+
+Git refs are owned by Gitea (`aj/OpenNest`) and push-mirrored to GitHub
+(`ajisaacs/OpenNest`). Create release branches and tags on Gitea, not GitHub.
+
+## Build a candidate
+
+1. Choose a committed source revision; never include uncommitted work implicitly.
+2. Push a `release/vX.Y.Z` branch containing the release workflow to Gitea and
+   verify that the push mirror delivered the same commit to GitHub. The mirror's
+   GitHub credential needs **Contents: read/write** and **Workflows: read/write**
+   to introduce or update `.github/workflows` files. Do not change credentials
+   or broaden permissions without the owner's approval.
+3. The `Windows release build` workflow uses a GitHub-hosted `windows-2022`
+   runner. It builds the solution, runs all four test projects in Release and
+   the main test project in Debug, then packages and smoke-tests the desktop app.
+   Optional local/proprietary fixture and opt-in measurement tests may skip;
+   inspect the uploaded TRX files rather than treating skips as passes.
+4. Download the `OpenNest-X.Y.Z-win-x64` artifact and verify its `.sha256`.
+   It contains `OpenNest.vX.Y.Z.win-x64.zip`, with the .NET runtime, native
+   dependencies, shipped configurations, all three post-processors, license,
+   and `build-info.json` identifying the exact source commit.
+
+The workflow has read-only repository permissions and does **not** publish
+releases. Once present on the default branch, it can also be dispatched manually
+with an `X.Y.Z` version. Running/dispatching via a PAT needs suitable Actions
+permissions; public run metadata alone does not prove dispatch access.
+
+For a local Windows build with PowerShell 7 and the .NET 8 SDK:
+
+```powershell
+./scripts/Publish-Windows.ps1 -Version X.Y.Z
+```
+
+Run the test suites separately before local packaging. The script refuses an
+existing output directory; use a fresh `-OutputDirectory` rather than deleting
+previous packages. CI also exercises this refusal and verifies the ZIP is unchanged.
+
+## Publish
+
+Review release notes, breaking API changes, and known limitations with the owner.
+After the candidate passes, integrate the release tooling into the chosen branch,
+create an annotated `vX.Y.Z` tag on the exact release commit, push to Gitea, and
+verify the same tag/commit on GitHub. Use the successful **tag build's** artifacts
+for the GitHub Release; do not substitute packages built from another commit.
+Verify the public asset names, sizes, download/checksum, and release status after
+upload. Do not overwrite an existing release/tag or asset silently.
+
+The automated desktop smoke test proves the extracted app opens its main window
+and discovers posts. It does not replace interactive CAD/nesting acceptance,
+physical CNC/serial verification, GPU execution, or real-model ONNX accuracy.
+Packages are unsigned; code signing and a fuller packaged-post execution test
+remain follow-up hardening.