From 368d17fec69f3bd7946146a3bd0114a878f84212 Mon Sep 17 00:00:00 2001
From: azhui lab <fengseekling@gmail.com>
Date: Sun, 20 Sep 2026 03:38:32 -0700
Subject: [PATCH] ci: add temporary rc24 Windows preview artifact build

---
 .../rc24-windows-preview-artifact.yml         | 108 ++++++++++++++++++
 1 file changed, 108 insertions(+)
 create mode 100644 .github/workflows/rc24-windows-preview-artifact.yml

diff --git a/.github/workflows/rc24-windows-preview-artifact.yml b/.github/workflows/rc24-windows-preview-artifact.yml
new file mode 100644
index 0000000..9f74504
--- /dev/null
+++ b/.github/workflows/rc24-windows-preview-artifact.yml
@@ -0,0 +1,108 @@
+name: RC24 Windows Preview Artifact
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-windows-preview:
+    name: Build rc.24 Preview ZIP on windows-2022
+    runs-on: windows-2022
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - name: Checkout frozen rc.24 tag
+        uses: actions/checkout@v4
+        with:
+          ref: refs/tags/v0.2.1-rc.24
+          fetch-depth: 0
+
+      - name: Assert frozen release provenance
+        run: |
+          $expectedSha = '2ae15ec3e76d7ca08ac2053d73c6bea192f372da'
+          $actualSha = (git rev-parse HEAD).Trim()
+          if ($actualSha -ne $expectedSha) { throw "Unexpected HEAD: $actualSha" }
+
+          $tag = (git describe --tags --exact-match HEAD).Trim()
+          if ($tag -ne 'v0.2.1-rc.24') { throw "HEAD is not exactly v0.2.1-rc.24: $tag" }
+
+          $peeledTagSha = (git rev-parse 'v0.2.1-rc.24^{}').Trim()
+          if ($peeledTagSha -ne $expectedSha) { throw "Unexpected peeled tag SHA: $peeledTagSha" }
+
+          if (git status --porcelain) { throw 'Frozen tag checkout is not clean.' }
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - name: Install immutable dependencies
+        run: npm ci
+
+      - name: Build final Windows Preview ZIP
+        env:
+          MOSA_RELEASE_DISTRIBUTION: preview
+          MOSA_RELEASE_MANIFEST_PUBLIC_KEY: ${{ vars.MOSA_RC24_RELEASE_MANIFEST_PUBLIC_KEY }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:MOSA_RELEASE_MANIFEST_PUBLIC_KEY)) {
+            throw 'MOSA release-manifest public key variable is missing.'
+          }
+          npm run desktop:release:windows
+
+      - name: Verify final ZIP identity and Preview signing state
+        run: |
+          $expected = @{
+            productVersion = '0.2.1-rc.24'
+            gitSha = '2ae15ec3e76d7ca08ac2053d73c6bea192f372da'
+            distribution = 'preview'
+            uiFingerprint = '1aebe119fdb16e59435c2b7e5370fa70441734945aae06bc2fd4d4148c27cf7e'
+            runtimeFingerprint = 'd90710e269232ad044f6d1b5905707af428bb2116da0a0d60a73d16a0b82cb25'
+            keyId = '235d3651f80176bed99098cab6a4c6fe0581d0206e23f691af2c8bf88aa9839f'
+          }
+          $zip = 'out/make/zip/win32/x64/MOSA-win32-x64-0.2.1-rc.24.zip'
+          if (-not (Test-Path -LiteralPath $zip -PathType Leaf)) { throw "Final ZIP is missing: $zip" }
+
+          $inspect = Join-Path $env:RUNNER_TEMP 'mosa-rc24-windows-preview-inspect'
+          Expand-Archive -LiteralPath $zip -DestinationPath $inspect -Force
+          $asarFiles = @(Get-ChildItem -LiteralPath $inspect -Recurse -File -Filter app.asar)
+          if ($asarFiles.Count -ne 1) { throw "Expected exactly one app.asar, got $($asarFiles.Count)." }
+
+          $identityScript = @'
+          const asar = require('@electron/asar');
+          const identity = JSON.parse(asar.extractFile(process.argv[1], 'app/build-identity.json').toString('utf8'));
+          const expected = JSON.parse(process.argv[2]);
+          for (const [key, value] of Object.entries(expected)) {
+            const actual = key === 'keyId' ? identity.releaseManifestTrust?.keyId : identity[key];
+            if (actual !== value) throw new Error(`Unexpected ${key}: ${actual || '(missing)'}`);
+          }
+          console.log(JSON.stringify({
+            productVersion: identity.productVersion,
+            gitSha: identity.gitSha,
+            distribution: identity.distribution,
+            uiFingerprint: identity.uiFingerprint,
+            runtimeFingerprint: identity.runtimeFingerprint,
+            keyId: identity.releaseManifestTrust?.keyId,
+          }));
+          '@
+          node -e $identityScript $asarFiles[0].FullName ($expected | ConvertTo-Json -Compress)
+
+          $mosaExe = Get-ChildItem -LiteralPath $inspect -Recurse -File -Filter MOSA.exe | Select-Object -First 1
+          if ($null -eq $mosaExe) { throw 'MOSA.exe is missing from the final ZIP.' }
+          $authenticode = Get-AuthenticodeSignature -FilePath $mosaExe.FullName
+          if ($authenticode.Status -ne 'NotSigned') { throw "Preview executable expected NotSigned, got $($authenticode.Status)." }
+
+          $sha256 = (Get-FileHash -LiteralPath $zip -Algorithm SHA256).Hash.ToLowerInvariant()
+          "$sha256 *MOSA-win32-x64-0.2.1-rc.24.zip" | Set-Content -NoNewline -Encoding ascii SHA256SUMS.txt
+
+      - name: Upload final Windows Preview artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: mosa-0.2.1-rc.24-windows-preview-x64
+          if-no-files-found: error
+          path: |
+            out/make/zip/win32/x64/MOSA-win32-x64-0.2.1-rc.24.zip
+            SHA256SUMS.txt