modified release pipeline (#4)

await certificate from ssl.com

Reviewed-on: #4
Co-authored-by: Aleksandr Neychev <alexnejchev73@gmail.com>

.gitea/workflows/release.yml

@@ -2,6 +2,13 @@
 # packs the MSIX with the version taken from the tag — three numbers of the tag
 # and a zero the Store keeps for itself.
 #
+# The package goes to the Store and nowhere else, so it leaves the run as an
+# artifact: someone picks it up and uploads it to Partner Center, which puts its
+# own signature on it. Nothing is signed here and nothing is attached to the
+# release — a publicly trusted code signing certificate is not to be had, and an
+# unsigned package would look like something to install and install nowhere.
+# Gitea makes the release for the tag itself, and it carries the tag alone.
+#
 # The same requirements to the runner as in pull-request.yml apply: Windows, the
 # .NET 10 SDK and an interactive desktop session for the tests. makeappx comes
 # with a NuGet package (Packaging\Tools\SdkTools.csproj), so the Windows SDK does
@@ -77,6 +84,10 @@ jobs:
           # reserves the last one, so it carries nothing the tag could tell
           "version=$($tag.Substring(1)).0" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
 
+          # The installer answers to nobody about a fourth number and takes the
+          # tag as it is
+          "plain=$($tag.Substring(1))" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+
       - name: Show the toolchain
         run: dotnet --info
 
@@ -121,15 +132,32 @@ jobs:
 
           ./Packaging/build-msix.ps1 @arguments
 
-      - name: Keep the packages
+      # The other half of the release: the same application as an ordinary
+      # installer, for handing round outside the Store. Nobody signs it, so
+      # SmartScreen warns about it — see Packaging\installer.iss
+      - name: Build the installer
+        run: ./Packaging/build-installer.ps1 -Version ${{ steps.version.outputs.plain }}
+
+      # The artifact is where the package waits to be uploaded to Partner Center
+      - name: Keep the package
         uses: actions/upload-artifact@v4
         with:
           name: msix-${{ steps.version.outputs.version }}
           path: artifacts/packages/
           if-no-files-found: error
 
-      # Gitea creates a release of its own for a pushed tag, so the release is
-      # looked up first and only made when it is not there
+      # The .wixpdb next to each installer is left out on purpose: it is of use
+      # only when something has to be traced back to the WiX source
+      - name: Keep the installer
+        uses: actions/upload-artifact@v4
+        with:
+          name: installer-${{ steps.version.outputs.plain }}
+          path: artifacts/installers/*.msi
+          if-no-files-found: error
+
+      # Only the installers go into the release. The MSIX stays in the artifacts
+      # of the run: unsigned, it installs nowhere, and its one destination is
+      # Partner Center
       - name: Publish the release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
@@ -145,6 +173,8 @@ jobs:
           $api = "$root/repos/$env:GITHUB_REPOSITORY/releases"
           $headers = @{ Authorization = "token $env:GITEA_TOKEN" }
 
+          # Gitea makes a release of its own for a pushed tag, so the release is
+          # looked up first and only made when it is not there
           $release = $null
           try { $release = Invoke-RestMethod "$api/tags/$env:TAG" -Headers $headers } catch { }
 
@@ -153,7 +183,7 @@ jobs:
               $release = Invoke-RestMethod $api -Method Post -Headers $headers -ContentType 'application/json' -Body $body
           }
 
-          foreach ($file in Get-ChildItem artifacts/packages -File) {
+          foreach ($file in Get-ChildItem artifacts/installers -File -Filter *.msi) {
               # A tag can be pushed again after it was deleted; the old file of
               # the same name is dropped, otherwise the upload is refused
               $existing = $release.assets | Where-Object { $_.name -eq $file.Name }