ci: verbliebene GitHub-Workflow-Dateien entfernt (CFGMON-11)

Vollstaendig durch .gitlab-ci.yml ersetzt (Linux verifiziert gruen, Windows in Arbeit); Gitea Actions ist fuer dieses Repo deaktiviert, auf GitHub lag das Repo nie. Die Dateien bleiben als Uebersetzungsreferenz in der Git-Historie erhalten. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-31 12:00:00 +00:00
parent 0d0c1659c6
commit a8767583da
6 changed files with 0 additions and 1256 deletions
@@ -1,128 +0,0 @@
 # builds Element Web
 # builds Element Desktop (Linux) using the built Element Web
 #
 # Tries to use a matching js-sdk branch for the build.
 #
 # Produces a `webapp` artifact
 # Produces Desktop artifacts
 #
 # Fork-Anpassungen (siehe docs/axion1337-fork.md):
 # - runs-on-Labels auf die tatsaechlich registrierten Runner-Labels gemappt
 #   (builder-1 auf CFGMON: ubuntu-latest, linux-build, win-wine - KEIN
 #   ubuntu-24.04, kein macOS, kein natives Windows).
 # - playwright_ew/downstream-modules entfernt: brauchen Docker-Zugriff im
 #   Job-Container (Testcontainers) und Browser-Setups, die der aktuelle
 #   Runner nicht bereitstellt - als Folgearbeit in Issue #2 nachgehalten.
 # - build_ed_windows entfernt: build_desktop_windows.yaml ist fuer native
 #   Windows-Runner geschrieben (signtool-Pfade, MSVC-Targets, PowerShell).
 #   Das win-wine-Runner-Label existiert fuer eine kuenftige Wine-basierte
 #   Variante, die aber einen eigenen Workflow braucht.
 # - build_ed_macos entfernt: kein macOS-Runner vorhanden.
 name: Build & Test
 on:
    # CRON to run all Projects at 6am UTC
    schedule:
        - cron: "0 6 * * *"
    pull_request: {}
    push:
        branches: [main]
    # workflow_call entfernt: nichts in diesem Repo ruft build-and-test.yaml per
    # workflow_call auf (verifiziert), und die Kombination push+workflow_call im
    # selben on:-Block triggert auf Gitea Actions 1.27 nicht zuverlaessig bei push
    # (bekannter, als "not planned" geschlossener Gitea-Bug #33238).
 concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
    cancel-in-progress: true
 env:
    # fetchdep.sh needs to know our PR number
    PR_NUMBER: ${{ github.event.pull_request.number }}
    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes
 permissions: {} # No permissions required
 jobs:
    build_ew:
        name: "Build Element Web"
        runs-on: ubuntu-latest
        steps:
            - name: Checkout code
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: ${{ github.repository }}
                  persist-credentials: false
            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  cache: "pnpm"
                  node-version: "lts/*"
            # Upstream nutzt hier scripts/layered.sh, das eine zum Branch passende
            # matrix-js-sdk-Version klont - fuer diesen Fork falsch: es wuerde den
            # bewusst gepinnten js-sdk-Stand aus pnpm-lock.yaml (Issue #12) mit
            # Upstream-develop ueberschreiben. Der Lockfile-Stand ist hier autoritativ,
            # genau wie im Produktions-Docker-Build. (Nebenbei: layered.sh braucht jq,
            # das im node:20-Job-Container fehlt.)
            - name: Install dependencies
              run: pnpm install --frozen-lockfile
            - name: Copy config
              working-directory: apps/web
              run: cp element.io/develop/config.json config.json
            - name: Build
              env:
                  CI_PACKAGE: true
              working-directory: apps/web
              run: VERSION=$(scripts/get-version-from-git.sh) pnpm run build
            - name: Upload Artifact
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: webapp
                  path: apps/web/webapp
                  retention-days: 1
    prepare_ed:
        name: "Prepare Element Desktop"
        uses: ./.github/workflows/build_desktop_prepare.yaml
        needs: build_ew
        permissions:
            contents: read
        with:
            config: element.io/release
            webapp-artifact: webapp
    build_ed_linux:
        needs: prepare_ed
        name: "Desktop Linux"
        uses: ./.github/workflows/build_desktop_linux.yaml
        with:
            # Wir shippen static-sqlcipher-amd64-Builds; arm64/system-Varianten
            # sind auf dem einzigen x86-Runner nicht sinnvoll baubar.
            sqlcipher: static
            arch: amd64
            runs-on: linux-build
            # Desktop-Playwright-Tests brauchen Display-/Browser-Setup, das der
            # Runner (noch) nicht bietet - gleiche Folgearbeit wie playwright_ew.
            test: false
    complete:
        name: build-complete
        needs:
            - build_ew
            - prepare_ed
            - build_ed_linux
        if: always()
        runs-on: ubuntu-latest
        steps:
            # Explizite Einzel-Checks statt contains(needs.*.result, ...): die
            # Objekt-Filter-Syntax wertete auf Gitea/act falsch aus - das Gate war
            # "success", obwohl build_ew fehlgeschlagen (und der Rest geskippt) war.
            - name: Check all builds succeeded
              run: |
                  [ "${{ needs.build_ew.result }}" = "success" ] || { echo "build_ew: ${{ needs.build_ew.result }}"; exit 1; }
                  [ "${{ needs.prepare_ed.result }}" = "success" ] || { echo "prepare_ed: ${{ needs.prepare_ed.result }}"; exit 1; }
                  [ "${{ needs.build_ed_linux.result }}" = "success" ] || { echo "build_ed_linux: ${{ needs.build_ed_linux.result }}"; exit 1; }
@@ -1,265 +0,0 @@
 # This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
 # Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
 # the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
 on:
    workflow_call:
        inputs:
            ref:
                type: string
                required: false
                description: "The git ref to checkout, defaults to the default branch"
            arch:
                type: string
                required: true
                description: "The architecture to build for, one of 'amd64' | 'arm64'"
            version:
                type: string
                required: false
                description: "Version string to override the one in package.json, used for non-release builds"
            sqlcipher:
                type: string
                required: true
                description: "How to link sqlcipher, one of 'system' | 'static'"
            blob_report:
                type: boolean
                required: false
                description: "Whether to run the blob report"
            prepare-artifact-name:
                type: string
                required: false
                description: |
                    The name of the prepare artifact to use, defaults to 'desktop-prepare'.
                    The artifact must contain the following:
                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
                    + electronVersion - the version of electron to use for cache keying
                    + hakHash - the hash of the .hak directory to use for cache keying
                    + changelog.Debian - the changelog file to embed in the Debian package
                    + variant.json - the variant configuration to use for the build
                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
                    for example icons in the `build/` directory to override the app icons.
                default: "desktop-prepare"
            test:
                type: boolean
                required: false
                default: true
                description: "Whether to run the test stage after building"
            test-args:
                type: string
                required: false
                description: "Additional arguments to pass to playwright"
            runs-on:
                type: string
                required: false
                description: "The runner image to use, normally set for you, may be needed for running in private repos."
            artifact-prefix:
                type: string
                required: false
                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
                default: ""
            targets:
                type: string
                required: false
                description: "List of targets to build"
                default: "tar.gz deb"
 env:
    SQLCIPHER_BUNDLED: ${{ inputs.sqlcipher == 'static' && '1' || '' }}
    MAX_GLIBC: 2.31 # bullseye-era glibc, used by glibc-check.sh
 permissions: {} # No permissions required
 jobs:
    build:
        name: Build Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
        # We build on native infrastructure as matrix-seshat fails to cross-compile properly
        # https://github.com/matrix-org/seshat/issues/135
        runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
        env:
            HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-web/desktop-build-env:${{ case(github.event_name == 'push', inputs.ref || github.ref_name, github.event_name == 'release', 'staging', 'develop') }}
        steps:
            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
              id: config
              with:
                  key: "${{ inputs.arch }}"
                  export_to: output
                  map: |
                      {
                        "amd64": {
                          "arch": "x86-64"
                        },
                        "arm64": {
                          "arch": "aarch64",
                          "build-args": "--arm64"
                        }
                      }
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-web
                  ref: ${{ inputs.ref }}
                  persist-credentials: false
            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: ${{ inputs.prepare-artifact-name }}
                  path: apps/desktop
            - name: Cache .hak
              id: cache
              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
              with:
                  key: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('apps/desktop/hakHash', 'apps/desktop/electronVersion', 'apps/desktop/dockerbuild/*') }}
                  path: |
                      apps/desktop/.hak
            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  node-version-file: apps/desktop/.node-version
                  cache: "pnpm"
              env:
                  # Workaround for https://github.com/actions/setup-node/issues/317
                  FORCE_COLOR: 0
            - name: Install Deps
              working-directory: apps/desktop
              run: "pnpm install --frozen-lockfile --filter element-desktop"
            - name: "Get modified files"
              id: changed_files
              if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request' && github.repository == 'element-hq/element-web'
              uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47
              with:
                  files: |
                      apps/desktop/dockerbuild/**
            # This allows contributors to test changes to the dockerbuild image within a pull request
            - name: Build docker image
              uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
              if: steps.changed_files.outputs.any_modified == 'true'
              with:
                  file: apps/desktop/dockerbuild/Dockerfile
                  context: apps/desktop
                  load: true
                  platforms: linux/${{ inputs.arch }}
                  tags: ${{ env.HAK_DOCKER_IMAGE }}
            - name: Build Natives
              if: steps.cache.outputs.cache-hit != 'true'
              run: |
                  docker run \
                    -v ${{ github.workspace }}:/work -w /work \
                    -e SQLCIPHER_BUNDLED \
                    -e CI=1 \
                    $HAK_DOCKER_IMAGE \
                    pnpm -C apps/desktop run build:native
            - name: Fix permissions
              run: |
                  # For .hak
                  sudo chown -R $USER:$USER apps/desktop/.hak
                  # For node_modules pnpm strict security
                  sudo chmod +x node_modules/7zip-bin/linux/*/7za
            - name: Check native libraries in hak dependencies
              working-directory: apps/desktop
              run: |
                  shopt -s globstar
                  for filename in ./.hak/hakModules/**/*.node; do
                      ./scripts/glibc-check.sh $filename
                  done
            - name: Generate debian files and arguments
              working-directory: apps/desktop
              run: |
                  if [ -f changelog.Debian ]; then
                      echo "ED_DEBIAN_CHANGELOG=changelog.Debian" >> $GITHUB_ENV
                  fi
            - name: Build App
              working-directory: apps/desktop
              run: pnpm run build --publish never $BUILD_ARGS -l $TARGETS
              env:
                  VARIANT_PATH: variant.json
                  # Only set for Nightly builds
                  VERSION: ${{ inputs.version }}
                  # Workaround for https://github.com/electron-userland/electron-builder/issues/5721
                  USE_HARD_LINKS: false
                  BUILD_ARGS: ${{ steps.config.outputs.build-args }}
                  TARGETS: ${{ inputs.targets }}
            - name: Check native libraries
              working-directory: apps/desktop
              run: |
                  set -x
                  shopt -s globstar
                  FILES=$(file dist/**/*.node)
                  echo $FILES
                  ! echo "$FILES" | grep -v "$ARCH"
                  LIBS=$(readelf -d dist/**/*.node | grep NEEDED)
                  echo "$LIBS"
                  set +x
                  assert_contains_string() { [[ "$1" == *"$2"* ]]; }
                  ! assert_contains_string "$LIBS" "libcrypto.so.1.1"
                  if [ "$SQLCIPHER_BUNDLED" == "1" ]; then
                      ! assert_contains_string "$LIBS" "libsqlcipher.so.0"
                  else
                      assert_contains_string "$LIBS" "libsqlcipher.so.0"
                  fi
                  ./scripts/glibc-check.sh dist/linux-*unpacked/element-desktop*
              env:
                  ARCH: ${{ steps.config.outputs.arch }}
            # We exclude *-unpacked as it loses permissions and the tarball contains it with correct permissions
            - name: Upload Artifacts
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
                  path: |
                      apps/desktop/dist
                      !apps/desktop/dist/*-unpacked/**
                  retention-days: 1
            - name: Assert deb is present and valid
              if: contains(inputs.targets, 'deb')
              working-directory: apps/desktop
              run: |
                  test -f ./dist/element-desktop*$ARCH.deb
                  DEB_LISTING=$(dpkg-deb --fsys-tarfile ./dist/element-desktop*.deb | tar -tv)
                  echo "deb listing: "
                  echo "$DEB_LISTING"
                  ! echo "$DEB_LISTING" | grep '^h'
              env:
                  ARCH: ${{ inputs.arch }}
            - name: Assert tar.gz is present
              if: contains(inputs.targets, 'tar.gz')
              working-directory: apps/desktop
              run: |
                  test -f ./dist/element-desktop*.tar.gz
                  TAR_GZ_LISTING=$(tar -tvf ./dist/element-desktop*.tar.gz)
                  echo "tar.gz listing: "
                  echo "$TAR_GZ_LISTING"
                  ! echo "$TAR_GZ_LISTING" | grep '^h'
    test:
        name: Test Linux ${{ inputs.arch }} SQLCipher ${{ inputs.sqlcipher }}
        needs: build
        if: inputs.test && contains(inputs.targets, 'deb')
        uses: ./.github/workflows/build_desktop_test.yaml
        with:
            project: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
            artifact: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
            runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
            executable: /opt/Element*/element-desktop*
            prepare_cmd: |
                sudo apt-get -qq update
                sudo apt install ./dist/*.deb
            blob_report: ${{ inputs.blob_report }}
            args: ${{ inputs.test-args }}
@@ -1,234 +0,0 @@
 # This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
 # Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
 # the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
 on:
    workflow_call:
        secrets:
            APPLE_ID:
                required: false
            APPLE_ID_PASSWORD:
                required: false
            APPLE_CSC_KEY_PASSWORD:
                required: false
            APPLE_CSC_LINK:
                required: false
        inputs:
            ref:
                type: string
                required: false
                description: "The git ref to checkout, defaults to the default branch"
            version:
                type: string
                required: false
                description: "Version string to override the one in package.json, used for non-release builds"
            sign:
                type: string
                required: false
                description: "Whether to sign & notarise the build, requires 'Desktop Apple' environment"
            base-url:
                type: string
                required: false
                description: "The URL to which the output will be deployed."
            blob_report:
                type: boolean
                required: false
                description: "Whether to run the blob report"
            prepare-artifact-name:
                type: string
                required: false
                description: |
                    The name of the prepare artifact to use, defaults to 'desktop-prepare'.
                    The artifact must contain the following:
                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
                    + electronVersion - the version of electron to use for cache keying
                    + hakHash - the hash of the .hak directory to use for cache keying
                    + variant.json - the variant configuration to use for the build
                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
                    for example icons in the `build/` directory to override the app icons.
                default: "desktop-prepare"
            test:
                type: boolean
                required: false
                default: true
                description: "Whether to run the test stage after building"
            test-args:
                type: string
                required: false
                description: "Additional arguments to pass to playwright"
            artifact-prefix:
                type: string
                required: false
                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
                default: ""
            targets:
                type: string
                required: false
                description: "List of targets to build"
                default: "dmg zip"
 permissions: {} # No permissions required
 jobs:
    build:
        name: Build macOS Universal
        runs-on: macos-15 # M1
        environment: ${{ inputs.sign && 'Desktop Apple' || '' }}
        steps:
            - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
              with:
                  xcode-version: latest-stable
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-web
                  ref: ${{ inputs.ref }}
                  persist-credentials: false
            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: ${{ inputs.prepare-artifact-name }}
                  path: apps/desktop
            - name: Cache .hak
              id: cache
              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
              with:
                  key: ${{ runner.os }}-${{ hashFiles('apps/desktop/hakHash', 'apps/desktop/electronVersion') }}
                  path: |
                      apps/desktop/.hak
            - name: Install Rust
              if: steps.cache.outputs.cache-hit != 'true'
              run: |
                  rustup toolchain install stable --profile minimal --no-self-update
                  rustup default stable
                  rustup target add aarch64-apple-darwin
                  rustup target add x86_64-apple-darwin
            # M1 macos-14 comes without Python preinstalled
            - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
              with:
                  python-version: "3.13"
            # Install Quartz for DMG badges
            # https://github.com/electron-userland/electron-builder/issues/9511#issuecomment-3774092888
            - run: sudo pip3 install pyobjc-framework-Quartz
            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  node-version-file: apps/desktop/.node-version
                  cache: "pnpm"
            - name: Install Deps
              working-directory: apps/desktop
              run: "pnpm install --frozen-lockfile --filter element-desktop"
            - name: Build Natives
              if: steps.cache.outputs.cache-hit != 'true'
              working-directory: apps/desktop
              run: pnpm run build:native:universal
            # We split these because electron-builder gets upset if we set CSC_LINK even to an empty string
            - name: "[Signed] Build App"
              if: inputs.sign != ''
              working-directory: apps/desktop
              run: |
                  pnpm run build:universal --publish never -m ${TARGETS}
              env:
                  APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
                  APPLE_ID: ${{ secrets.APPLE_ID }}
                  APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
                  CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
                  CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}
                  VARIANT_PATH: variant.json
                  # Only set for Nightly builds
                  VERSION: ${{ inputs.version }}
                  TARGETS: ${{ inputs.targets }}
            - name: Check app was signed & notarised successfully
              if: inputs.sign != ''
              working-directory: apps/desktop
              run: |
                  hdiutil attach dist/*.dmg -mountpoint /Volumes/Element
                  codesign -dv --verbose=4 /Volumes/Element/*.app
                  spctl -a -vvv -t install /Volumes/Element/*.app
                  hdiutil detach /Volumes/Element
            - name: "[Unsigned] Build App"
              if: inputs.sign == ''
              working-directory: apps/desktop
              run: |
                  pnpm run build:universal --publish never -m ${TARGETS}
              env:
                  CSC_IDENTITY_AUTO_DISCOVERY: false
                  VARIANT_PATH: variant.json
                  TARGETS: ${{ inputs.targets }}
            - name: Generate releases.json
              if: inputs.base-url
              working-directory: apps/desktop
              run: |
                  PKG_JSON_VERSION=$(cat package.json | jq -r .version)
                  LATEST=$(find dist -type f -iname "*-mac.zip" | xargs -0 -n1 -- basename)
                  # Encode spaces in the URL as Squirrel.Mac complains about bad JSON otherwise
                  URL="${BASE_URL}/update/macos/${LATEST// /%20}"
                  jq -n --arg version "${VERSION:-$PKG_JSON_VERSION}" --arg url "$URL" '
                    {
                      currentRelease: $version,
                      releases: [{
                        version: $version,
                        updateTo: {
                          version: $version,
                          url: $url,
                        },
                      }],
                    }
                  ' > dist/releases.json
                  jq -n --arg url "$URL" '
                    { url: $url }
                  ' > dist/releases-legacy.json
              env:
                  VERSION: ${{ inputs.version }}
                  BASE_URL: ${{ inputs.base-url }}
            # We exclude mac-universal as the unpacked app takes forever to upload and zip and dmg already contains it
            - name: Upload Artifacts
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: ${{ inputs.artifact-prefix }}macos
                  path: |
                      apps/desktop/dist
                      !apps/desktop/dist/mac-universal/**
                  retention-days: 1
            - name: Assert zip is present
              if: contains(inputs.targets, 'zip')
              working-directory: apps/desktop
              run: |
                  test -f ./dist/Element*-mac.zip
            - name: Assert dmg is present
              if: contains(inputs.targets, 'dmg')
              working-directory: apps/desktop
              run: |
                  test -f ./dist/Element*.dmg
    test:
        name: Test macOS Universal
        needs: build
        if: inputs.test && contains(inputs.targets, 'dmg')
        uses: ./.github/workflows/build_desktop_test.yaml
        with:
            project: macos
            artifact: ${{ inputs.artifact-prefix }}macos
            runs-on: macos-14
            executable: /Users/runner/Applications/Element*.app/Contents/MacOS/Element*
            # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
            # read-only and thus would not allow us to override the fuses as is required for Playwright.
            prepare_cmd: |
                hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element &&
                rsync -a /Volumes/Element/Element*.app ~/Applications/ &&
                hdiutil detach /Volumes/Element
            blob_report: ${{ inputs.blob_report }}
            args: ${{ inputs.test-args }}
@@ -1,197 +0,0 @@
 # This action helps perform common actions before the build_* actions are started in parallel.
 on:
    workflow_call:
        inputs:
            config:
                type: string
                required: true
                description: "The config directory to use"
            version:
                type: string
                required: false
                description: "The version tag to fetch, or 'develop', will pick automatically if not passed"
            nightly:
                type: boolean
                required: false
                default: false
                description: "Whether the build is a Nightly and to calculate the version strings new builds should use"
            deploy:
                type: boolean
                required: false
                default: false
                description: "Whether the build should be deployed to production"
            webapp-artifact:
                type: string
                required: false
                description: "Name of the webapp artifact that should be used, will fetch a relevant build if omitted"
        secrets:
            # Required if `nightly` is set
            CF_R2_ACCESS_KEY_ID:
                required: false
            # Required if `nightly` is set
            CF_R2_TOKEN:
                required: false
        outputs:
            nightly-version:
                description: "The version string the next Nightly should use, only output for nightly"
                value: ${{ jobs.prepare.outputs.nightly-version }}
            packages-dir:
                description: "The directory non-deb packages for this run should live in within packages.element.io"
                value: ${{ inputs.nightly && 'nightly' || 'desktop' }}
            # This is just a simple pass-through of the input to simplify reuse of complex inline conditions
            deploy:
                description: "Whether the build should be deployed to production"
                value: ${{ inputs.deploy }}
 permissions: {}
 jobs:
    prepare:
        name: Prepare
        environment: ${{ inputs.nightly && 'packages.element.io' || '' }}
        runs-on: ubuntu-latest # builder-1 hat kein ubuntu-24.04-Label
        permissions:
            contents: read
        outputs:
            nightly-version: ${{ steps.versions.outputs.nightly }}
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false
                  repository: ${{ github.repository }}
            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  node-version-file: apps/desktop/.node-version
                  cache: "pnpm"
            - name: Install Deps
              working-directory: apps/desktop
              run: "pnpm install --frozen-lockfile --filter element-desktop"
            - name: Fetch Element Web (from artifact)
              if: inputs.webapp-artifact != ''
              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: ${{ inputs.webapp-artifact }}
                  path: apps/desktop/webapp
            - name: Build webapp.asar (from artifact)
              if: inputs.webapp-artifact != ''
              working-directory: apps/desktop
              run: |
                  cp -f "$CONFIG_DIR/config.json" webapp/config.json
                  pnpm run asar-webapp
              env:
                  CONFIG_DIR: ${{ inputs.config }}
            - name: Fetch Element Web (${{ inputs.version }})
              if: inputs.webapp-artifact == ''
              working-directory: apps/desktop
              run: pnpm run fetch --noverify -d ${CONFIG} ${VERSION}
              env:
                  CONFIG: ${{ inputs.config }}
                  VERSION: ${{ inputs.version }}
            - name: Copy variant config
              working-directory: apps/desktop
              run: cp "$CONFIG_DIR/build.json" variant.json
              env:
                  CONFIG_DIR: ${{ inputs.config }}
            # We split this out to save the build_* scripts having to do it to make use of `hashFiles` in the cache action
            - name: Generate cache hash files
              working-directory: apps/desktop
              run: |
                  set -ex
                  # Add --no-sandbox as otherwise it fails because the helper isn't setuid root. It's only getting the version.
                  pnpm --silent electron --no-sandbox --version > electronVersion
                  cat package.json | jq -c .hakDependencies | sha1sum > hakHash
                  find hak -type f -print0 | xargs -0 sha1sum >> hakHash
                  find scripts/hak -type f -print0 | xargs -0 sha1sum >> hakHash
            - name: "[Nightly] Calculate version"
              id: versions
              if: inputs.nightly
              working-directory: apps/desktop
              run: |
                  set -e
                  # Find all latest Nightly versions
                  aws s3 cp s3://$R2_BUCKET/nightly/update/macos/releases.json - --endpoint-url $R2_URL --region auto | jq -r .currentRelease >> VERSIONS
                  aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-amd64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
                  aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-arm64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/x64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/arm64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
                  # Pick the greatest one
                  VERSION=$(cat VERSIONS | sort -uf | tail -n1)
                  echo "Found latest nightly version $VERSION"
                  # Increment it
                  echo "nightly=$(scripts/generate-nightly-version.ts --latest $VERSION)" >> $GITHUB_OUTPUT
              env:
                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
                  R2_BUCKET: ${{ vars.R2_BUCKET }}
                  R2_URL: ${{ vars.CF_R2_S3_API }}
            - name: Check version
              id: package
              working-directory: apps/desktop
              run: |
                  echo "version=$(cat package.json | jq -r .version)" >> $GITHUB_OUTPUT
            - name: "[Release] Fetch release"
              id: release
              if: ${{ !inputs.nightly && inputs.version != 'develop' }}
              uses: cardinalby/git-get-release-action@5172c3a026600b1d459b117738c605fabc9e4e44 # 1.2.5
              env:
                  GITHUB_TOKEN: ${{ github.token }}
              with:
                  tag: v${{ steps.package.outputs.version }}
            - name: "[Release] Write changelog"
              if: ${{ !inputs.nightly && inputs.version != 'develop' }}
              working-directory: apps/desktop
              run: |
                  TIME=$(date -d "$PUBLISHED_AT" -R)
                  echo "element-desktop ($VERSION) default; urgency=medium" >> changelog.Debian
                  echo "$BODY" | sed 's/^##/\n  */g;s/^\*/  */g' | perl -pe 's/\[.+?]\((.+?)\)/\1/g' >> changelog.Debian
                  echo "" >> changelog.Debian
                  echo " -- $ACTOR <support@element.io>  $TIME" >> changelog.Debian
              env:
                  ACTOR: ${{ github.actor }}
                  VERSION: v${{ steps.package.outputs.version }}
                  BODY: ${{ steps.release.outputs.body }}
                  PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
            - name: "[Nightly] Write summary"
              if: inputs.nightly
              working-directory: apps/desktop
              run: |
                  set -e
                  BUNDLE_HASH=$(npx asar l webapp.asar | grep /bundles/ | head -n 1 | sed 's|.*/||')
                  WEBAPP_VERSION=$(./scripts/get-version.ts)
                  WEB_VERSION=${WEBAPP_VERSION:0:12}
                  JS_VERSION=${WEBAPP_VERSION:16:12}
                  echo "### Nightly build ${NIGHTLY_VERSION}" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY
                  echo "| Component   | Version |" >> $GITHUB_STEP_SUMMARY
                  echo "| ----------- | ------- |" >> $GITHUB_STEP_SUMMARY
                  echo "| Bundle Hash | $BUNDLE_HASH |" >> $GITHUB_STEP_SUMMARY
                  echo "| Element Web | [$WEB_VERSION](https://github.com/element-hq/element-web/commit/$WEB_VERSION) |" >> $GITHUB_STEP_SUMMARY
                  echo "| JS SDK      | [$JS_VERSION](https://github.com/matrix-org/matrix-js-sdk/commit/$JS_VERSION) |" >> $GITHUB_STEP_SUMMARY
              env:
                  NIGHTLY_VERSION: ${{ steps.versions.outputs.nightly }}
            - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: desktop-prepare
                  retention-days: 1
                  path: |
                      apps/desktop/webapp.asar
                      apps/desktop/electronVersion
                      apps/desktop/hakHash
                      apps/desktop/changelog.Debian
                      apps/desktop/variant.json
@@ -1,118 +0,0 @@
 # This action helps run Playwright tests within one of the build_* stages.
 on:
    workflow_call:
        inputs:
            runs-on:
                type: string
                required: true
                description: "The runner image to use"
            artifact:
                type: string
                required: true
                description: "The name of the artifact to download"
            project:
                type: string
                required: true
                description: "The Playwright project to use for testing"
            executable:
                type: string
                required: true
                description: "Path to the executable to test"
            prepare_cmd:
                type: string
                required: false
                description: "Command to run to prepare the executable or environment for testing"
            blob_report:
                type: boolean
                default: false
                description: "Whether to upload a blob report instead of the HTML report"
            args:
                type: string
                required: false
                description: "Additional arguments to pass to playwright, for e.g. skipping specific tests"
 permissions: {}
 jobs:
    test:
        name: Test ${{ inputs.project }}
        runs-on: ${{ inputs.runs-on }}
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-web
                  persist-credentials: false
            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  node-version-file: apps/desktop/.node-version
                  cache: "pnpm"
            - name: Install Deps
              run: "pnpm install --frozen-lockfile --filter element-desktop"
            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: ${{ inputs.artifact }}
                  path: apps/desktop/dist
            - name: Prepare for tests
              working-directory: apps/desktop
              # This is set by the caller of the reusable workflow, they have the ability to run the command they specify
              # directly without our help so this is fine.
              run: ${{ inputs.prepare_cmd }} # zizmor: ignore[template-injection]
              if: inputs.prepare_cmd
            - name: Expand executable path
              id: executable
              working-directory: apps/desktop
              shell: bash
              env:
                  EXECUTABLE: ${{ inputs.executable }}
              run: |
                  FILES=($EXECUTABLE)
                  echo "path=${FILES[0]}" >> $GITHUB_OUTPUT
            # We previously disabled the `EnableNodeCliInspectArguments` fuse, but Playwright requires
            # it to be enabled to test Electron apps, so turn it back on.
            - name: Set EnableNodeCliInspectArguments fuse enabled
              run: $RUN_AS npx @electron/fuses write --app "$EXECUTABLE" EnableNodeCliInspectArguments=on
              working-directory: apps/desktop
              shell: bash
              env:
                  # We need sudo on Linux as it is installed in /opt/
                  RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
                  EXECUTABLE: ${{ steps.executable.outputs.path }}
            - name: Run tests
              timeout-minutes: 20
              shell: bash
              working-directory: apps/desktop
              run: |
                  $PREFIX pnpm playwright test \
                      ${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }} \
                      ${{ inputs.blob_report == false && '--reporter=html' || '' }} \
                      $ARGS
              env:
                  PREFIX: ${{ runner.os == 'Linux' && 'xvfb-run' || '' }}
                  PW_TAG: ${{ inputs.project }}
                  ELEMENT_DESKTOP_EXECUTABLE: ${{ steps.executable.outputs.path }}
                  ARGS: ${{ inputs.args }}
                  DEBUG: pw:browser
            - name: Upload blob report
              if: always() && inputs.blob_report
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: blob-report-${{ inputs.artifact }}
                  path: apps/desktop/blob-report
                  retention-days: 1
                  if-no-files-found: error
            - name: Upload HTML report
              if: always() && inputs.blob_report == false
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: ${{ inputs.artifact }}-test
                  path: apps/desktop/playwright-report
                  retention-days: 14
                  if-no-files-found: error
@@ -1,314 +0,0 @@
 # This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
 # Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
 # the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
 # Windows GHA runner by default uses the pwsh shell which breaks codeSigningCert in the workflow
 # We always sign using eSignerCKA to ensure it keeps working, but aside from release & nightlies we use demo credentials
 # which do not yield trusted signatures.
 defaults:
    run:
        shell: powershell
 on:
    workflow_call:
        secrets:
            ESIGNER_USER_NAME:
                required: false
            ESIGNER_USER_PASSWORD:
                required: false
            ESIGNER_USER_TOTP:
                required: false
        inputs:
            ref:
                type: string
                required: false
                description: "The git ref to checkout, defaults to the default branch"
            arch:
                type: string
                required: true
                description: "The architecture to build for, one of 'x64' | 'ia32' | 'arm64'"
            version:
                type: string
                required: false
                description: "Version string to override the one in package.json, used for non-release builds"
            sign:
                type: string
                required: false
                description: "Whether to sign & notarise the build, requires 'Desktop eSigner' environment"
            blob_report:
                type: boolean
                required: false
                description: "Whether to run the blob report"
            prepare-artifact-name:
                type: string
                required: false
                description: |
                    The name of the prepare artifact to use, defaults to 'desktop-prepare'.
                    The artifact must contain the following:
                    + webapp.asar - the asar archive of the webapp to embed in the desktop app
                    + electronVersion - the version of electron to use for cache keying
                    + hakHash - the hash of the .hak directory to use for cache keying
                    + variant.json - the variant configuration to use for the build
                    The artifact can also contain any additional files which will be applied as overrides to the checkout root before building,
                    for example icons in the `build/` directory to override the app icons.
                default: "desktop-prepare"
            test:
                type: boolean
                required: false
                default: true
                description: "Whether to run the test stage after building"
            test-runs-on:
                type: string
                required: false
                description: "The runner image to use for testing, normally set for you, may be needed for running in private repos."
            test-args:
                type: string
                required: false
                description: "Additional arguments to pass to playwright"
            artifact-prefix:
                type: string
                required: false
                description: "An optional prefix to add to the artifact name, useful for distinguishing builds in private repos."
                default: ""
            targets:
                type: string
                required: false
                description: "List of targets to build"
                default: "squirrel msi"
 permissions: {} # No permissions required
 jobs:
    build:
        name: Build Windows ${{ inputs.arch }}
        runs-on: windows-2025
        environment: ${{ inputs.sign && 'Desktop eSigner' || '' }}
        env:
            SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.26100.0/x86/signtool.exe"
        steps:
            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
              id: config
              with:
                  key: "${{ inputs.arch }}"
                  export_to: output
                  map: |
                      {
                        "x64": {
                          "target": "x86_64-pc-windows-msvc"
                        },
                        "arm64": {
                          "target": "aarch64-pc-windows-msvc",
                          "build-args": "--arm64",
                          "arch": "amd64_arm64"
                        },
                        "ia32": {
                          "target": "i686-pc-windows-msvc",
                          "build-args": "--ia32",
                          "arch": "x86",
                          "extra_config": "{\"user_notice\": {\"title\": \"Your desktop environment is unsupported.\",\"description\": \"Support for 32-bit Windows installations has ended. Transition to the web or mobile app for continued access.\"}}"
                        }
                      }
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  repository: element-hq/element-web
                  ref: ${{ inputs.ref }}
                  persist-credentials: false
            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  name: ${{ inputs.prepare-artifact-name }}
                  path: apps/desktop/
            - name: Cache .hak
              id: cache
              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
              with:
                  key: ${{ runner.os }}-${{ inputs.arch }}-${{ hashFiles('apps/desktop/hakHash', 'apps/desktop/electronVersion') }}
                  path: |
                      apps/desktop/.hak
            # ActiveTCL package on choco is from 2015,
            # this one is newer but includes more than we need
            - name: Choco install tclsh
              if: steps.cache.outputs.cache-hit != 'true'
              shell: pwsh
              run: |
                  choco install -y magicsplat-tcl-tk --no-progress
                  echo "${HOME}/AppData/Local/Apps/Tcl86/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
            - name: Choco install NetWide Assembler
              if: steps.cache.outputs.cache-hit != 'true'
              shell: pwsh
              run: |
                  choco install -y nasm --no-progress
                  echo "C:/Program Files/NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
            - name: Install Rust
              if: steps.cache.outputs.cache-hit != 'true'
              run: |
                  rustup toolchain install stable --profile minimal --no-self-update
                  rustup default stable
                  rustup target add $env:TARGET
              env:
                  TARGET: ${{ steps.config.outputs.target }}
            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  node-version-file: apps/desktop/.node-version
                  cache: "pnpm"
            - name: Install Deps
              working-directory: apps/desktop
              run: "pnpm install --frozen-lockfile --filter element-desktop"
            - name: Insert config snippet
              if: steps.config.outputs.extra_config != ''
              working-directory: apps/desktop
              shell: bash
              run: |
                  mkdir config-edit
                  pnpm asar extract webapp.asar config-edit
                  cd config-edit
                  mv config.json old-config.json
                  echo '${{ steps.config.outputs.extra_config }}' | jq -s '.[0] * .[1]' old-config.json - > config.json
                  rm old-config.json
                  cd ..
                  rm webapp.asar
                  pnpm asar pack config-edit/ webapp.asar
            - name: Set up sqlcipher macros
              if: steps.cache.outputs.cache-hit != 'true' && contains(inputs.arch, 'arm')
              shell: pwsh
              run: |
                  echo "NCC=${{ github.workspace }}\scripts\cl.bat" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
            - name: Set up build tools
              if: steps.cache.outputs.cache-hit != 'true'
              uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
              with:
                  arch: ${{ steps.config.outputs.arch || inputs.arch }}
            - name: Build Natives
              if: steps.cache.outputs.cache-hit != 'true'
              working-directory: apps/desktop
              run: |
                  refreshenv
                  pnpm run build:native --target $env:TARGET
              env:
                  TARGET: ${{ steps.config.outputs.target }}
            - name: Install and configure eSigner CKA
              run: |
                  Set-StrictMode -Version 'Latest'
                  # Download, extract, and rename
                  Invoke-WebRequest -OutFile eSigner_CKA.zip "$env:ESIGNER_URL"
                  Expand-Archive -Path eSigner_CKA.zip -DestinationPath .
                  Get-ChildItem -Path * -Include "*_build_*.exe" | Rename-Item -NewName eSigner_CKA.exe
                  # Install
                  New-Item -ItemType Directory -Force -Path "$env:INSTALL_DIR"
                  ./eSigner_CKA.exe /CURRENTUSER /VERYSILENT /SUPPRESSMSGBOXES /DIR="${{ env.INSTALL_DIR }}" | Out-Null
                  # Disable logger
                  $LogConfig = Get-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
                  $LogConfig[0] = '<log4net threshold="OFF">'
                  $LogConfig | Set-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
                  # Configure - default credentials from https://www.ssl.com/guide/esigner-demo-credentials-and-certificates/
                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe config `
                      -mode "$env:ESIGNER_MODE" `
                      -user "${{ secrets.ESIGNER_USER_NAME || 'esigner_demo' }}" `
                      -pass "${{ secrets.ESIGNER_USER_PASSWORD || 'esignerDemo#1' }}" `
                      -totp "${{ secrets.ESIGNER_USER_TOTP || 'RDXYgV9qju+6/7GnMf1vCbKexXVJmUVr+86Wq/8aIGg=' }}" `
                      -key "${{ env.MASTER_KEY_FILE }}" -r
                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe unload
                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe load
                  # Find certificate
                  $CodeSigningCert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
                  echo Certificate: $CodeSigningCert
                  # Extract thumbprint and subject name
                  $Thumbprint = $CodeSigningCert.Thumbprint
                  $SubjectName = ($CodeSigningCert.Subject -replace ", ?", "`n" | ConvertFrom-StringData).CN
                  echo "ED_SIGNTOOL_THUMBPRINT=$Thumbprint" >> $env:GITHUB_ENV
                  echo "ED_SIGNTOOL_SUBJECT_NAME=$SubjectName" >> $env:GITHUB_ENV
              env:
                  ESIGNER_MODE: ${{ vars.ESIGNER_MODE || 'sandbox' }}
                  ESIGNER_URL: https://github.com/SSLcom/eSignerCKA/releases/download/v1.0.6/SSL.COM-eSigner-CKA_1.0.6.zip
                  INSTALL_DIR: C:\Users\runneradmin\eSignerCKA
                  MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key
            - name: Build App
              working-directory: apps/desktop
              run: pnpm run build --publish never $BUILD_ARGS -w $TARGETS
              shell: bash
              env:
                  VARIANT_PATH: variant.json
                  # Only set for Nightly builds
                  # The windows packager relies on parsing this as semver, so we have to make it look like one.
                  # This will give our update packages really stupid names, but we probably can't change that either
                  # because squirrel windows parses them for the version too. We don't really care: nobody sees them.
                  # We just give the installer a static name, so you'll just see this in the 'about' dialog.
                  # Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
                  VERSION: ${{ inputs.version && format('0.0.1-nightly.{0}', inputs.version) || '' }}
                  BUILD_ARGS: ${{ steps.config.outputs.build-args }}
                  TARGETS: ${{ inputs.targets }}
            - name: Trust eSigner sandbox cert
              if: inputs.sign == ''
              run: |
                  Set-StrictMode -Version 'Latest'
                  Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root -FilePath .github/SSLcom-sandbox.crt
            - name: Check app was signed successfully
              working-directory: apps/desktop
              run: |
                  Set-StrictMode -Version 'Latest'
                  Get-ChildItem `
                      -Recurse dist `
                      -Include *.exe, *.msi `
                  | ForEach-Object -Process {. $env:SIGNTOOL_PATH verify /pa $_.FullName; if(!$?) { throw }}
            - name: Upload Artifacts
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
                  path: |
                      apps/desktop/dist
                  retention-days: 1
            - name: Assert executable is present
              working-directory: apps/desktop
              run: |
                  Test-Path './dist/win-*unpacked/Element*.exe'
            - name: Assert all Squirrel files are present
              if: contains(inputs.targets, 'squirrel')
              working-directory: apps/desktop
              run: |
                  Test-Path './dist/squirrel-windows*/Element Setup*.exe'
                  Test-Path './dist/squirrel-windows*/element-desktop-*-full.nupkg'
                  Test-Path './dist/squirrel-windows*/RELEASES'
            - name: Assert MSI is present
              if: contains(inputs.targets, 'msi')
              working-directory: apps/desktop
              run: |
                  Test-Path './dist/Element*.msi'
    test:
        name: Test Windows ${{ inputs.arch }}
        needs: build
        if: inputs.test
        uses: ./.github/workflows/build_desktop_test.yaml
        with:
            project: win-${{ inputs.arch }}
            artifact: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
            runs-on: ${{ inputs.test-runs-on || (inputs.arch == 'arm64' && 'windows-11-arm' || 'windows-2022') }}
            executable: ./dist/win*-unpacked/Element*.exe
            blob_report: ${{ inputs.blob_report }}
            args: ${{ inputs.test-args }}