developer-preview.yml

name: Build unsigned Windows developer preview

on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: mesh-developer-preview-${{ github.ref }}
  cancel-in-progress: true

jobs:
  windows:
    name: Unsigned Windows developer preview
    runs-on: windows-latest
    timeout-minutes: 90
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: mesh/package-lock.json
      - uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0

      - name: Validate developer-preview source
        working-directory: mesh
        shell: pwsh
        run: |
          npm ci
          npm audit --audit-level=high
          npm run check:public-services
          npm run check:public-site
          npm run check:ipc-contract
          npm run check:ipc-arguments
          npm run check:ipc-types
          npm test -- --maxWorkers=4

      - name: Verify Matrix-only dependency tree
        working-directory: mesh/src-tauri
        shell: bash
        run: |
          set -o pipefail
          cargo check --no-default-features --features matrix-backend --locked --jobs 1
          if cargo tree --no-default-features --features matrix-backend -e normal,build --locked | grep -Eq '(^| )libp2p v'; then
            echo 'Developer preview unexpectedly contains legacy libp2p.' >&2
            exit 1
          fi

      - name: Build unsigned installers
        working-directory: mesh
        shell: pwsh
        run: npm run tauri -- build --features matrix-backend -- --no-default-features --locked --jobs 1

      - name: Verify compiled installer coexistence controls
        shell: pwsh
        run: ./mesh/scripts/check-compiled-installer-coexistence.ps1 -BundleRoot mesh/src-tauri/target/release/bundle

      - name: Generate SBOMs and preview evidence
        shell: pwsh
        run: |
          Push-Location mesh
          npm sbom --sbom-format=cyclonedx | Out-File mesh-node.cdx.json -Encoding utf8
          Pop-Location
          cargo install cargo-cyclonedx --version 0.5.9 --locked
          cargo cyclonedx --manifest-path mesh/src-tauri/Cargo.toml --format json

          $staging = Join-Path $PWD "mesh/developer-preview-staging"
          New-Item -ItemType Directory -Path $staging | Out-Null
          $installers = @(
            Get-ChildItem mesh/src-tauri/target/release/bundle -Recurse -File |
              Where-Object { $_.Extension -in @(".msi", ".exe") } |
              Sort-Object FullName
          )
          if ($installers.Count -eq 0) {
            throw "No Windows installers were produced."
          }
          foreach ($installer in $installers) {
            $previewName = "$($installer.BaseName)-UNSIGNED-DEVELOPER-PREVIEW$($installer.Extension)"
            Copy-Item -LiteralPath $installer.FullName -Destination (Join-Path $staging $previewName)
          }
          Copy-Item mesh/mesh-node.cdx.json $staging
          Copy-Item mesh/src-tauri/mesh.cdx.json $staging
          @"
          UNSIGNED DEVELOPER PREVIEW

          This package is not a consumer beta. Do not bypass Windows security
          warnings. Verify SHA256SUMS.txt and the GitHub build attestation, and
          use this artifact only in a controlled development environment.

          Source SHA: $env:GITHUB_SHA
          "@ | Out-File (Join-Path $staging "PREVIEW-NOTICE.txt") -Encoding utf8

          Get-ChildItem $staging -File |
            ForEach-Object {
              $hash = (Get-FileHash -LiteralPath $_.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
              "$hash  $($_.Name)"
            } |
            Sort-Object |
            Out-File (Join-Path $staging "SHA256SUMS.txt") -Encoding ascii

      - name: Attest developer-preview provenance
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
        with:
          subject-path: "mesh/developer-preview-staging/*"

      - name: Upload developer-preview artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Mesh-Windows-UNSIGNED-DEVELOPER-PREVIEW-${{ github.sha }}
          path: mesh/developer-preview-staging/
          if-no-files-found: error
          retention-days: 30