fix: gui ux 2

.github/scripts/release_gui_prepare.py

@@ -6,6 +6,7 @@
 import argparse
 import json
 import os
+import re
 import shutil
 import stat
 import subprocess
@@ -86,12 +87,38 @@ def discover_wix_bin() -> Path:
     fail("failed to locate WiX installation candidates")
 
 
-def validate_wix_tools(wix_bin: Path) -> None:
+def validate_wix_tools(wix_bin: Path) -> str:
+    detected_version: str | None = None
+    version_pattern = re.compile(r"version\s+([0-9]+(?:\.[0-9]+){1,3})", re.IGNORECASE)
+
     for executable in ("candle.exe", "light.exe"):
         command = str(wix_bin / executable)
         result = subprocess.run([command, "-?"], capture_output=True, text=True, check=False)
         if result.returncode != 0:
             fail(f"{command} failed self-check with exit code {result.returncode}")
+        if detected_version is None:
+            output = f"{result.stdout}\n{result.stderr}"
+            match = version_pattern.search(output)
+            if match:
+                detected_version = match.group(1)
+
+    if detected_version is None:
+        fail("failed to parse WiX version from candle/light self-check output")
+
+    return detected_version
+
+
+def validate_wix_major_version(version: str, expected_major: int) -> None:
+    major_raw = version.split(".", 1)[0]
+    try:
+        major = int(major_raw)
+    except ValueError as exc:
+        fail(f"failed to parse WiX major version from '{version}': {exc}")
+
+    if major != expected_major:
+        fail(
+            f"unexpected WiX major version: detected={version} expected_major={expected_major}"
+        )
 
 
 def resolve_icon_paths(config_dir: Path, icons: list[str]) -> list[Path]:
@@ -146,6 +173,7 @@ def parse_args() -> argparse.Namespace:
     parser.add_argument("--asset-suffix", required=True)
     parser.add_argument("--packager-config", required=True)
     parser.add_argument("--runner-os", required=True)
+    parser.add_argument("--expected-wix-major", type=int, default=3)
     return parser.parse_args()
 
 
@@ -207,10 +235,12 @@ def main() -> int:
 
     if runner_os == "Windows":
         wix_bin = discover_wix_bin()
-        validate_wix_tools(wix_bin)
+        wix_version = validate_wix_tools(wix_bin)
+        validate_wix_major_version(wix_version, args.expected_wix_major)
         wix_root = wix_bin.parent
         append_github_path(wix_bin)
         append_github_env("WIX", str(wix_root))
+        append_github_env("WIX_VERSION_DETECTED", wix_version)
 
     stage_runtime_binary(runner_os=runner_os, target=args.target, asset_suffix=args.asset_suffix)
 

.github/workflows/release-gui.yml

@@ -23,7 +23,7 @@ on:
         default: false
         type: boolean
 permissions:
-  contents: write
+  contents: read
 concurrency:
   group: release-gui-${{ github.event_name }}-${{ github.ref_name || github.event.inputs.tag || github.run_id }}
   cancel-in-progress: false
@@ -38,7 +38,7 @@ jobs:
       source_mode: ${{ steps.resolve.outputs.source_mode }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 0
       - name: Resolve source
@@ -102,7 +102,7 @@ jobs:
           echo "source_ref=${SOURCE_REF}" >> "$GITHUB_OUTPUT"
           echo "resolved mode=${MODE} tag=${TAG} source_ref=${SOURCE_REF}"
       - name: Checkout resolved source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 0
           ref: ${{ steps.resolve.outputs.source_ref }}
@@ -133,16 +133,16 @@ jobs:
       SOURCE_REF: ${{ needs.resolve_tag.outputs.source_ref }}
     steps:
       - name: Checkout resolved source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 0
           ref: ${{ env.SOURCE_REF }}
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9  # master @ 2026-02-23
         with:
           toolchain: 1.89.0
       - name: Cache Rust build artifacts
-        uses: swatinem/rust-cache@v2
+        uses: swatinem/rust-cache@aa7c1c80a07a27a84c0aa76d0cef0aad3830e330  # v2.7.8
       - name: Build smoke binaries
         shell: bash
         run: |
@@ -242,42 +242,24 @@ jobs:
       SOURCE_REF: ${{ needs.resolve_tag.outputs.source_ref }}
       SOURCE_MODE: ${{ needs.resolve_tag.outputs.source_mode }}
     steps:
-      - name: Checkout workflow commit
-        uses: actions/checkout@v4
+      - name: Checkout build source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           fetch-depth: 0
-      - name: Sync source tree to release tag
-        if: env.SOURCE_MODE == 'release_tag'
-        shell: bash
-        run: |
-          set -euo pipefail
-          git fetch --force --tags origin
-          git checkout "refs/tags/${RESOLVED_TAG}" -- \
-            Cargo.toml \
-            Cargo.lock \
-            rust-toolchain.toml \
-            crates \
-            assets \
-            LICENSE
-
-          if git ls-tree -d --name-only "refs/tags/${RESOLVED_TAG}" packaging | grep -q '^packaging$'; then
-            git checkout "refs/tags/${RESOLVED_TAG}" -- packaging
-          else
-            echo "packaging/ not present in tag ${RESOLVED_TAG}; using workflow-ref packaging configs"
-          fi
-      - name: Use workflow ref source tree
-        if: env.SOURCE_MODE == 'current_ref'
+          ref: ${{ env.SOURCE_REF }}
+      - name: Summarize build source
         shell: bash
         run: |
           set -euo pipefail
           {
-            echo "### current_ref build source"
+            echo "### build source"
             echo
-            echo "Using source ref: ${SOURCE_REF}"
-            echo "Resolved packaging tag/version: ${RESOLVED_TAG}"
+            echo "source_mode=${SOURCE_MODE}"
+            echo "source_ref=${SOURCE_REF}"
+            echo "resolved_tag=${RESOLVED_TAG}"
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b  # v5.3.0
         with:
           python-version: "3.11"
       - name: Determine macOS signing/notarization availability
@@ -326,12 +308,12 @@ jobs:
             echo "missing=" >> "$GITHUB_OUTPUT"
           fi
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9  # master @ 2026-02-23
         with:
           toolchain: 1.89.0
           targets: ${{ matrix.target }}
       - name: Cache Rust build artifacts
-        uses: swatinem/rust-cache@v2
+        uses: swatinem/rust-cache@aa7c1c80a07a27a84c0aa76d0cef0aad3830e330  # v2.7.8
         with:
           key: release-gui-${{ matrix.target }}
       - name: Install Linux build dependencies
@@ -352,7 +334,7 @@ jobs:
       - name: Install WiX Toolset
         if: runner.os == 'Windows'
         shell: pwsh
-        run: choco install wixtoolset -y --no-progress
+        run: choco install wixtoolset --version=3.14.1 -y --no-progress
       - name: Install cargo-packager
         run: cargo install cargo-packager --version 0.11.8 --locked
       - name: Build GUI release binary
@@ -395,14 +377,76 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          python .github/scripts/release_gui_prepare.py \
-            --tag "${{ env.RESOLVED_TAG }}" \
-            --target "${{ matrix.target }}" \
-            --asset-suffix "${{ matrix.asset_suffix }}" \
-            --packager-config "${{ matrix.packager_config }}" \
+          prepare_args=(
+            --tag "${{ env.RESOLVED_TAG }}"
+            --target "${{ matrix.target }}"
+            --asset-suffix "${{ matrix.asset_suffix }}"
+            --packager-config "${{ matrix.packager_config }}"
             --runner-os "${{ runner.os }}"
+          )
+          if python .github/scripts/release_gui_prepare.py --help 2>&1 | grep -q -- "--expected-wix-major"; then
+            prepare_args+=(--expected-wix-major 3)
+          else
+            echo "release_gui_prepare.py does not support --expected-wix-major; skipping explicit WiX major assertion"
+          fi
+          python .github/scripts/release_gui_prepare.py "${prepare_args[@]}"
       - name: Build installer packages
         run: python -c "import os, subprocess; subprocess.run(['cargo', 'packager', '--config', os.environ['PACKAGER_CONFIG_PATH']], check=True)"
+      - name: Verify Windows MSI extraction and payload
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+          $packagerDir = "dist/packager/${{ matrix.asset_suffix }}"
+          $msi = Get-ChildItem -Path $packagerDir -Recurse -Filter *.msi | Select-Object -First 1
+          if (-not $msi) {
+            throw "failed to find .msi under $packagerDir"
+          }
+          if ($msi.Length -le 0) {
+            throw "MSI is empty: $($msi.FullName)"
+          }
+
+          $extractDir = Join-Path $env:RUNNER_TEMP "localpaste-msi-extract"
+          if (Test-Path $extractDir) {
+            Remove-Item -Recurse -Force $extractDir
+          }
+          New-Item -ItemType Directory -Path $extractDir | Out-Null
+
+          $args = @("/a", $msi.FullName, "/qn", "TARGETDIR=$extractDir")
+          $proc = Start-Process -FilePath msiexec.exe -ArgumentList $args -Wait -PassThru -NoNewWindow
+          if ($proc.ExitCode -ne 0) {
+            throw "msiexec extraction failed with exit code $($proc.ExitCode)"
+          }
+
+          $payload = Get-ChildItem -Path $extractDir -Recurse -Filter localpaste.exe | Select-Object -First 1
+          if (-not $payload) {
+            throw "failed to find localpaste.exe in extracted MSI payload"
+          }
+          if ($payload.Length -le 0) {
+            throw "extracted localpaste.exe is empty: $($payload.FullName)"
+          }
+      - name: Verify Linux AppImage runtime metadata
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          PACKAGER_DIR="dist/packager/${{ matrix.asset_suffix }}"
+          APPIMAGE_PATH="$(find "${PACKAGER_DIR}" -maxdepth 4 -type f -name '*.AppImage' | head -n 1)"
+          if [[ -z "${APPIMAGE_PATH}" ]]; then
+            echo "failed to find .AppImage under ${PACKAGER_DIR}" >&2
+            exit 1
+          fi
+          if [[ ! -s "${APPIMAGE_PATH}" ]]; then
+            echo "AppImage is empty: ${APPIMAGE_PATH}" >&2
+            exit 1
+          fi
+
+          chmod +x "${APPIMAGE_PATH}"
+          "${APPIMAGE_PATH}" --appimage-version > /tmp/localpaste-appimage-version.txt
+          if [[ ! -s /tmp/localpaste-appimage-version.txt ]]; then
+            echo "AppImage runtime did not report a version string" >&2
+            exit 1
+          fi
       - name: Sign, notarize, and verify macOS artifacts
         if: runner.os == 'macOS' && steps.mac_signing.outputs.enabled == 'true'
         shell: bash
@@ -447,6 +491,34 @@ jobs:
           xcrun stapler staple "${APP_BUNDLE}"
           xcrun stapler staple "${DMG_PATH}"
           spctl --assess --type open --verbose=4 "${DMG_PATH}"
+      - name: Verify signed app bundle inside DMG
+        if: runner.os == 'macOS' && steps.mac_signing.outputs.enabled == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          PACKAGER_DIR="dist/packager/${{ matrix.asset_suffix }}"
+          DMG_PATH="$(find "${PACKAGER_DIR}" -maxdepth 4 -type f -name '*.dmg' | head -n 1)"
+          if [[ -z "${DMG_PATH}" ]]; then
+            echo "failed to find .dmg under ${PACKAGER_DIR}" >&2
+            exit 1
+          fi
+
+          MOUNT_POINT="$(mktemp -d)"
+          cleanup() {
+            hdiutil detach "${MOUNT_POINT}" >/dev/null 2>&1 || true
+            rm -rf "${MOUNT_POINT}"
+          }
+          trap cleanup EXIT
+
+          hdiutil attach "${DMG_PATH}" -mountpoint "${MOUNT_POINT}" -nobrowse -quiet
+          MOUNTED_APP="$(find "${MOUNT_POINT}" -maxdepth 3 -type d -name '*.app' | head -n 1)"
+          if [[ -z "${MOUNTED_APP}" ]]; then
+            echo "failed to find .app inside mounted DMG ${DMG_PATH}" >&2
+            exit 1
+          fi
+
+          codesign --verify --deep --strict --verbose=2 "${MOUNTED_APP}"
+          spctl --assess --type execute --verbose=4 "${MOUNTED_APP}"
       - name: Verify macOS DMG usability
         if: runner.os == 'macOS'
         shell: bash
@@ -475,7 +547,7 @@ jobs:
             --asset-suffix "${{ matrix.asset_suffix }}" \
             --runner-os "${{ runner.os }}"
       - name: Upload release assets
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1  # v4.6.1
         with:
           name: release-assets-${{ matrix.asset_suffix }}
           path: dist/release/${{ matrix.asset_suffix }}/*
@@ -488,9 +560,11 @@ jobs:
       - build_package
     runs-on: ubuntu-22.04
     timeout-minutes: 15
+    permissions:
+      contents: write
     steps:
       - name: Download packaged assets
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806  # v4.1.9
         with:
           pattern: release-assets-*
           path: dist/release-assets
@@ -517,8 +591,6 @@ jobs:
         uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2.5.0
         with:
           tag_name: ${{ needs.resolve_tag.outputs.resolved_tag }}
-          name: LocalPaste ${{ needs.resolve_tag.outputs.resolved_tag }}
-          generate_release_notes: true
           overwrite_files: true
           fail_on_unmatched_files: true
           files: |