Skip to content

Windows enterprise packages: MSI (SCCM) + MSIX/AppX (Intune) targets + deployment runbook #345

Description

@alexander-blackwell

Core-side work item for the enterprise add-on's Windows packages deliverable (add-on #75, PI-4 / ADR-A009). Filed here because feature work on the core packaging pipeline lands in this repo; the add-on repo only tracks it.

Both foundations have landed: the air-gap build profile (ADR-0225: vendored omp + bundled relocatable Python + the CI air-gap smoke gate) and the managed-config update channel (add-on #74). The Linux (deb/rpm, PR #147) and macOS (pkg + cask, PR #141) enterprise targets already exist; Windows is the remaining platform. Current build.win targets are nsis + portable only: nothing SCCM or Intune can consume for managed, in-place-upgradable deployment.

Scope:

  • build.win gains msi (SCCM) and appx (MSIX family, Intune LOB) targets, x64, built by the existing dist:win CI job on windows-latest.
  • MSI: perMachine, pinned stable UpgradeCode (the in-place-upgrade + no-duplicate-install contract), versioned artifact name. WiX warnings not treated as errors (the bundled repo tree is large).
  • AppX/MSIX: enterprise identity (identityName / publisher / publisherDisplayName / applicationId), versioned artifact name. Builds unsigned in CI; org PKI signing documented (Intune requires a device-trusted cert for LOB MSIX).
  • Authenticode rides the existing WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD seam in build-desktop.yml; no new secrets, nothing in-repo.
  • CI: *.msi and *.appx attached to run artifacts, tag releases, and the rolling latest release.
  • A config-contract test pinning the UpgradeCode value, perMachine, the target set, and the AppX identity so silent drift (the MSI data-loss failure mode) fails CI.
  • docs/WINDOWS-ENTERPRISE-DEPLOYMENT.md runbook mirroring the Linux/macOS ones: SCCM application, Intune Win32 (.intunewin wrap of the MSI), Intune MSIX LOB, in-place upgrade semantics, user-data preservation (userData lives in %APPDATA%, never under the install dir), signing.

Done when: dist:win produces LucidAgent--x64.msi and .appx alongside the NSIS/portable artifacts, the air-gap smoke still gates the build, the config test locks the upgrade contract, and the runbook covers SCCM + both Intune paths.

Producing/installing the real packages on a managed Windows fleet is runner-bound validation, same as the Linux/macOS work; the checklist lives in the runbook.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions