|
| 1 | +name: Package verified Windows preview |
| 2 | +on: |
| 3 | + workflow_dispatch: |
| 4 | + inputs: |
| 5 | + source_run_id: |
| 6 | + description: Successful Windows native dictation run containing the tested preview |
| 7 | + required: true |
| 8 | + default: '34675859921' |
| 9 | + type: string |
| 10 | + push: |
| 11 | + branches: [feat/windows-native-dictation] |
| 12 | + paths: |
| 13 | + - '.github/workflows/windows-package-verified.yml' |
| 14 | +permissions: |
| 15 | + contents: read |
| 16 | +jobs: |
| 17 | + package: |
| 18 | + runs-on: windows-2025 |
| 19 | + timeout-minutes: 10 |
| 20 | + env: |
| 21 | + SOURCE_RUN: ${{ inputs.source_run_id || '34675859921' }} |
| 22 | + GH_TOKEN: ${{ github.token }} |
| 23 | + steps: |
| 24 | + - uses: actions/checkout@v6 |
| 25 | + with: |
| 26 | + fetch-depth: 0 |
| 27 | + - name: Verify the source build and unchanged native implementation |
| 28 | + shell: pwsh |
| 29 | + run: | |
| 30 | + if ($env:SOURCE_RUN -notmatch '^\d+$') { throw 'Invalid source run' } |
| 31 | + $run = gh api "repos/$env:GITHUB_REPOSITORY/actions/runs/$env:SOURCE_RUN" | ConvertFrom-Json |
| 32 | + if ($run.conclusion -ne 'success' -or $run.head_repository.full_name -ne $env:GITHUB_REPOSITORY -or $run.name -ne 'Windows native dictation') { throw 'Source build was not successfully validated' } |
| 33 | + $changed = git diff --name-only $run.head_sha HEAD -- src packaging/windows/setup-models.ps1 packaging/windows/models.json packaging/windows/build-funasr.ps1 |
| 34 | + if ($LASTEXITCODE -ne 0 -or $changed) { throw "Native implementation changed; run the full inference workflow first: $changed" } |
| 35 | + "SOURCE_COMMIT=$($run.head_sha)" >> $env:GITHUB_ENV |
| 36 | + - uses: actions/download-artifact@v5 |
| 37 | + with: |
| 38 | + name: VocoType-Windows-x64-preview |
| 39 | + path: verified-input |
| 40 | + run-id: ${{ env.SOURCE_RUN }} |
| 41 | + github-token: ${{ github.token }} |
| 42 | + - name: Add notices without changing tested binaries |
| 43 | + shell: pwsh |
| 44 | + run: | |
| 45 | + $archive = @(Get-ChildItem verified-input -Filter '*.zip') |
| 46 | + if ($archive.Count -ne 1) { throw 'Expected exactly one tested portable archive' } |
| 47 | + Expand-Archive $archive[0].FullName -DestinationPath stage |
| 48 | + $root = (Resolve-Path stage).Path |
| 49 | + $metadata = Get-Content stage/build-info.json -Raw | ConvertFrom-Json |
| 50 | + if ($metadata.git_commit -ne $env:SOURCE_COMMIT) { throw 'Archive source metadata mismatch' } |
| 51 | + foreach ($entry in Get-Content stage/SHA256SUMS) { |
| 52 | + if ($entry -notmatch '^([a-f0-9]{64}) (.+)$') { throw 'Invalid original checksum manifest' } |
| 53 | + $expected = $Matches[1]; $path = Join-Path $root $Matches[2] |
| 54 | + if (-not ([IO.Path]::GetFullPath($path).StartsWith($root + [IO.Path]::DirectorySeparatorChar))) { throw 'Unsafe manifest path' } |
| 55 | + if ((Get-FileHash $path -Algorithm SHA256).Hash.ToLowerInvariant() -ne $expected) { throw "Source checksum mismatch: $path" } |
| 56 | + } |
| 57 | + $before = @{} |
| 58 | + Get-ChildItem stage -Recurse -File | Where-Object Extension -in '.exe', '.dll' | ForEach-Object { $before[$_.FullName] = (Get-FileHash $_.FullName -Algorithm SHA256).Hash } |
| 59 | + New-Item -ItemType Directory -Force stage/share/licenses | Out-Null |
| 60 | + Copy-Item resources/licenses/windows-runtime/* stage/share/licenses -Force |
| 61 | + if (Test-Path stage/licenses) { Copy-Item stage/licenses/* stage/share/licenses -Force; Remove-Item stage/licenses -Recurse } |
| 62 | + Copy-Item docs/integrations/windows.md stage/README.md -Force |
| 63 | + $metadata | Add-Member -NotePropertyName packaging_git_commit -NotePropertyValue $env:GITHUB_SHA |
| 64 | + $metadata | Add-Member -NotePropertyName validated_inference_run -NotePropertyValue $env:SOURCE_RUN |
| 65 | + $metadata | ConvertTo-Json | Set-Content stage/build-info.json -Encoding utf8NoBOM |
| 66 | + foreach ($file in $before.Keys) { if ((Get-FileHash $file -Algorithm SHA256).Hash -ne $before[$file]) { throw 'Tested executable or DLL changed' } } |
| 67 | + ./stage/vocotype-windows.exe --self-test |
| 68 | + if ($LASTEXITCODE) { throw 'Packaged executable failed' } |
| 69 | + ./stage/vocotype-offline-worker.exe --help |
| 70 | + if ($LASTEXITCODE) { throw 'Packaged native runtime failed' } |
| 71 | + Get-ChildItem stage -Recurse -File | Where-Object Name -ne 'SHA256SUMS' | Sort-Object FullName | ForEach-Object { "$((Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLowerInvariant()) $([IO.Path]::GetRelativePath($root, $_.FullName))" } | Set-Content stage/SHA256SUMS -Encoding utf8NoBOM |
| 72 | + New-Item -ItemType Directory -Force dist | Out-Null |
| 73 | + Compress-Archive stage/* "dist/VocoType-Windows-x64-preview-$($env:GITHUB_SHA.Substring(0,7)).zip" |
| 74 | + Copy-Item verified-input/real-asr-report.json dist/ |
| 75 | + Get-FileHash dist/*.zip -Algorithm SHA256 | Format-List |
| 76 | + - uses: actions/upload-artifact@v7 |
| 77 | + with: |
| 78 | + name: VocoType-Windows-x64-preview |
| 79 | + path: dist/* |
| 80 | + if-no-files-found: error |
0 commit comments