PDF-Tools/.github/workflows/windows-runtime.yml at master · Open-Document-Alliance/PDF-Tools · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# Windows runtime evidence (class A: headless CI runner, not Claude Desktop).
#
# Two jobs. The MCPB is built from the exact checked-out commit on a Linux
# runner, because the isolated build helper spawns npm in ways Windows Node
# refuses (.cmd spawn hardening) and the builder is not a Windows-supported
# surface. The Windows job then downloads that artifact, verifies its exact
# SHA-256 end to end, and boots it over MCP stdio on real win32-x64: tool
# discovery, prompts, canonical resources, a PDF-lib mutation, and ordinary
# native rasterization. The embedded-host renderer question (rendering
# expected unavailable by design) stays with the "Windows render proof"
# probe workflow.
#
# Standard runners are free for this public repository. The trigger is
# workflow_dispatch only so runs stay deliberate; the evidence value is the
# run at an exact SHA, not continuous execution.
#
# Claim boundary: this proves the packed server's runtime behavior under
# Windows Node on GitHub's runner image. It is not Windows Claude Desktop
# host evidence. The Linux-built artifact hash is recorded and compared
# informationally against the qualified macOS-built release artifact; byte
# identity across build hosts is reported as data, never assumed.
name: Windows runtime evidence

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-mcpb:
    name: build MCPB on ubuntu-latest
    runs-on: ubuntu-latest
    timeout-minutes: 30
    outputs:
      artifact_sha256: ${{ steps.hash.outputs.sha256 }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm

      - name: Record exact identity
        run: |
          echo "commit=$(git rev-parse HEAD)"
          echo "tree=$(git rev-parse HEAD^{tree})"
          node --version

      - name: Install exact locked dependencies
        run: npm ci

      - name: Build MCPB from this exact commit
        run: npm run build:mcpb

      - name: Record built artifact identity
        id: hash
        run: |
          ls -la pdf-toolkit-mcp.mcpb
          sha256sum pdf-toolkit-mcp.mcpb | tee linux-built-artifact.sha256
          echo "sha256=$(cut -d' ' -f1 linux-built-artifact.sha256)" >> "$GITHUB_OUTPUT"

      - name: Upload artifact for the Windows job
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mcpb-artifact
          path: |
            pdf-toolkit-mcp.mcpb
            linux-built-artifact.sha256
          if-no-files-found: error
          retention-days: 7

  packed-runtime:
    name: packed runtime on windows-latest
    runs-on: windows-latest
    needs: build-mcpb
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: mcpb-artifact

      - name: Verify artifact identity end to end
        shell: bash
        run: |
          sha256sum -c linux-built-artifact.sha256
          echo "expected=${{ needs.build-mcpb.outputs.artifact_sha256 }}"
          [ "$(cut -d' ' -f1 linux-built-artifact.sha256)" = "${{ needs.build-mcpb.outputs.artifact_sha256 }}" ]

      - name: Install exact locked dependencies (smoke harness)
        shell: bash
        run: npm ci

      - name: Packed stdio smoke on win32-x64
        shell: bash
        run: npm run smoke:mcpb -- pdf-toolkit-mcp.mcpb

      # test/deep-malformed-native-windows-portable.test.js is gated to win32 in
      # scripts/node-test-files.mjs and omitted on darwin and linux, so it does
      # not run in local verification or in the macOS release gate. Without this
      # step it ran nowhere at all: twelve tests that existed and never executed.
      - name: Native test partition on win32-x64
        shell: bash
        run: npm run test:node-native

      - name: Layout diagnostic probe (always, full responses)
        if: always()
        shell: bash
        run: node .github/workflows/windows-layout-probe.mjs pdf-toolkit-mcp.mcpb