continuum-proxy/.gitea/workflows/discover-windows.yml

# Builds `discover_printers` as a Windows executable, for trying SSDP
# discovery on a machine that shares the printers' network segment (multicast
# does not cross a router, so the development container cannot hear them).
#
# Runs on the `windows-latest` self-hosted runner that continuum-cad's
# pipeline also uses: a host executor running as SYSTEM, Windows PowerShell
# 5.1 (no pwsh), MSVC build tools present. The notes in
# continuum-cad/.gitea/workflows/ci.yml on that machine apply here too.
# Its artifact UPLOAD works (`upload-artifact@v3`); DOWNLOAD does not, which
# is why nothing here downloads one.
#
# A job whose label matches no registered runner is skipped silently, not
# failed - if this never runs, check that the runner is online.
#
# Cargo.lock is not committed in this repo, so this resolves dependencies
# fresh; the artifact is built from whatever versions that picks today.
name: Windows discovery tool

on:
  push:
    paths:
      - "src/**"
      - "examples/discover_printers.rs"
      - "Cargo.toml"
      - "Cargo.lock"
      - ".gitea/workflows/discover-windows.yml"
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: never
  # Outside the runner's deep work directory, and short, for the same MAX_PATH
  # reason continuum-cad gives. A directory of its own - not C:\vcpkg or
  # C:\ccad-target - so the two pipelines cannot step on each other's state
  # on the one machine.
  CARGO_TARGET_DIR: 'C:\continuum-proxy-target'
  VCPKG_ROOT: 'C:\continuum-vcpkg'
  # The same release tag continuum-cad pins, known to exist.
  VCPKG_REF: "2026.07.29"

jobs:
  windows:
    runs-on: windows-latest
    defaults:
      run:
        shell: powershell
        # Every `run` step below works in the proxy's checkout.
        working-directory: continuum-proxy
    timeout-minutes: 90
    steps:
      # Cargo.toml has path dependencies on two sibling repositories
      # (`../continuum-schemas`, `../continuum-common`), so all three are laid
      # out side by side inside the workspace - the checkout action will not
      # place a repo outside it, which is why the proxy is in a subdirectory
      # rather than at the root.
      - uses: actions/checkout@v4
        with:
          path: continuum-proxy

      # Plain git for the siblings, not a second `actions/checkout`: on this
      # Windows runner a second use of the action in one job fails syncing the
      # action's own cached clone ("...\.git\objects\pack\...idx: Access is
      # denied", run 413). Same branch name as this one, because the proxy's
      # code needs their unreleased commits. The job's token goes in a header
      # for the clone and is never written to a remote URL or a log.
      - name: Check out the sibling repositories
        shell: powershell
        working-directory: .
        env:
          CI_TOKEN: ${{ github.token }}
          CI_SERVER: ${{ github.server_url }}
          CI_BRANCH: ${{ github.ref_name }}
        run: |
          $auth = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("x-access-token:$($env:CI_TOKEN)"))
          foreach ($repo in @("continuum-schemas", "continuum-common")) {
            if (Test-Path $repo) { Remove-Item -Recurse -Force $repo }
            git -c "http.extraheader=AUTHORIZATION: basic $auth" clone --quiet --depth 1 --branch $env:CI_BRANCH "$($env:CI_SERVER)/Continuum/$repo.git" $repo
            if ($LASTEXITCODE -ne 0) { throw "could not clone $repo at branch $($env:CI_BRANCH)" }
            Write-Host "$repo at $(git -C $repo rev-parse --short HEAD)"
          }

      - name: Install the Rust MSVC toolchain
        shell: powershell
        run: |
          # Genuine no-BOM UTF-8: Windows PowerShell 5.1's `-Encoding utf8`
          # writes a BOM, which corrupts the first entry of GITHUB_PATH.
          $NoBom = New-Object System.Text.UTF8Encoding $false
          function Add-CiPath([string] $Value) {
            [System.IO.File]::AppendAllText($env:GITHUB_PATH, "$Value`r`n", $NoBom)
          }
          if (-not (Get-Command rustup -ErrorAction SilentlyContinue)) {
            [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
            Invoke-WebRequest -UseBasicParsing -Uri https://win.rustup.rs/x86_64 -OutFile rustup-init.exe
            .\rustup-init.exe -y --default-toolchain stable-x86_64-pc-windows-msvc
            if ($LASTEXITCODE -ne 0) { throw "rustup-init failed" }
            $cargoBin = Join-Path $env:USERPROFILE ".cargo\bin"
            if (-not (Test-Path (Join-Path $cargoBin "rustup.exe"))) {
              throw "rustup-init reported success but rustup.exe is not in $cargoBin"
            }
            # GITHUB_PATH only takes effect for later steps; the in-process
            # PATH is what the calls just below need.
            $env:PATH = "$cargoBin;$env:PATH"
            Add-CiPath $cargoBin
          }
          rustup default stable-x86_64-pc-windows-msvc
          if ($LASTEXITCODE -ne 0) { throw "could not select the MSVC toolchain" }
          rustc -vV

      # The proxy links OpenSSL directly (Ed25519 verification, SHA-256, and
      # reading a printer's certificate), and Windows has none. vcpkg builds
      # it, fetching its own Perl and NASM. `x64-windows-static-md` links it
      # into the .exe, so the tool needs no DLL beside it; openssl-sys finds
      # it through VCPKG_ROOT with no further settings.
      - name: Build OpenSSL with vcpkg
        shell: powershell
        run: |
          git config --global core.longpaths true
          if (-not (Test-Path "$env:VCPKG_ROOT\.git")) {
            git clone --depth 1 --branch $env:VCPKG_REF https://github.com/microsoft/vcpkg $env:VCPKG_ROOT
            if ($LASTEXITCODE -ne 0) { throw "could not clone vcpkg at $env:VCPKG_REF" }
          }
          Push-Location $env:VCPKG_ROOT
          try {
            if (-not (Test-Path .\vcpkg.exe)) {
              .\bootstrap-vcpkg.bat -disableMetrics
              if ($LASTEXITCODE -ne 0) { throw "bootstrap-vcpkg failed" }
            }
            .\vcpkg.exe install openssl:x64-windows-static-md
            if ($LASTEXITCODE -ne 0) { throw "vcpkg failed to build OpenSSL" }
          } finally {
            Pop-Location
          }

      - name: Build discover_printers
        shell: powershell
        run: |
          $env:VCPKGRS_TRIPLET = "x64-windows-static-md"
          cargo build --release --example discover_printers
          if ($LASTEXITCODE -ne 0) { throw "cargo build failed" }

          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Copy-Item "$env:CARGO_TARGET_DIR\release\examples\discover_printers.exe" dist\
          Copy-Item scripts\discover-windows-README.txt dist\README.txt

          # It must run on a machine with nothing installed. No arguments
          # prints the usage and exits non-zero, which proves the binary
          # loads (no missing DLL) without touching the network.
          $ErrorActionPreference = "Continue"
          $out = cmd /c "dist\discover_printers.exe 2>&1" | Out-String
          if ($out -notmatch "identify") { throw "discover_printers.exe did not print its usage: $out" }
          Write-Host "usage text looks right"

          # Imports of the .exe, so a DLL that a clean machine lacks shows up
          # in the log (the VC++ runtime is the one that commonly does).
          if (Get-Command dumpbin -ErrorAction SilentlyContinue) {
            & dumpbin /dependents dist\discover_printers.exe | Select-String "\.dll" |
              ForEach-Object { Write-Host $_.Line.Trim() }
          }

          $hash = (Get-FileHash dist\discover_printers.exe -Algorithm SHA256).Hash.ToLower()
          Set-Content -Path dist\SHA256.txt -Value "$hash  discover_printers.exe" -Encoding ASCII
          Write-Host "sha256 $hash"

          # The usage run above exits 1 on purpose, and PowerShell hands the
          # last native command's exit code to the runner when a script ends -
          # so without this a build that passed every check was reported
          # failed (run 414).
          exit 0

      - name: Upload the executable
        uses: actions/upload-artifact@v3
        with:
          name: continuum-discover-printers-windows
          path: continuum-proxy/dist/*
          if-no-files-found: error

      # After the upload on purpose: the executable is useful even if a test
      # that only breaks on Windows fails, and a red job still says so.
      - name: Run the discovery tests on Windows
        shell: powershell
        run: |
          $env:VCPKGRS_TRIPLET = "x64-windows-static-md"
          cargo test --lib discovery
          if ($LASTEXITCODE -ne 0) { throw "discovery tests failed on Windows" }