Skip to content

ci: Harden Windows driver installer and signing gates #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ReenigneArcher merged 1 commit into from
Jul 5, 2026
+22 −4
Merged

ci: Harden Windows driver installer and signing gates #41

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 22 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,20 +244,28 @@ jobs:
- name: Install Windows driver installer
if: runner.os == 'Windows'
shell: pwsh
timeout-minutes: 10
run: |
$installer = Get-ChildItem -LiteralPath .\windows-driver-installer -Filter *.msi | Select-Object -First 1
if (!$installer) {
throw "Windows driver installer artifact did not contain an MSI."
}
$logPath = Join-Path $env:RUNNER_TEMP "libvirtualhid-driver-install.log"
$driverLogPath = Join-Path $env:ProgramData "libvirtualhid\install-driver.log"
$process = Start-Process `
-FilePath msiexec.exe `
-ArgumentList @("/i", $installer.FullName, "/qn", "/norestart", "/L*v", $logPath) `
-Wait `
-PassThru `
-NoNewWindow
if (!$process.WaitForExit([int] [TimeSpan]::FromMinutes(5).TotalMilliseconds)) {
Get-Content -LiteralPath $logPath -Tail 200 -ErrorAction SilentlyContinue
Get-Content -LiteralPath $driverLogPath -Tail 200 -ErrorAction SilentlyContinue
Stop-Process -Id $process.Id -Force -ErrorAction SilentlyContinue
throw "Windows driver installer timed out after 5 minutes."
}
if ($process.ExitCode -notin @(0, 3010)) {
Get-Content -LiteralPath $logPath -ErrorAction SilentlyContinue
Get-Content -LiteralPath $driverLogPath -ErrorAction SilentlyContinue
throw "Windows driver installer exited with code $($process.ExitCode)."
}

Expand Down Expand Up @@ -394,9 +402,13 @@ jobs:
$process = Start-Process `
-FilePath msiexec.exe `
-ArgumentList @("/x", $installer.FullName, "/qn", "/norestart", "/L*v", $logPath) `
-Wait `
-PassThru `
-NoNewWindow
if (!$process.WaitForExit([int] [TimeSpan]::FromMinutes(5).TotalMilliseconds)) {
Get-Content -LiteralPath $logPath -Tail 200 -ErrorAction SilentlyContinue
Stop-Process -Id $process.Id -Force -ErrorAction SilentlyContinue
throw "Windows driver installer uninstall timed out after 5 minutes."
}
if ($process.ExitCode -notin @(0, 3010)) {
Get-Content -LiteralPath $logPath -ErrorAction SilentlyContinue
throw "Windows driver installer uninstall exited with code $($process.ExitCode)."
Expand Down Expand Up @@ -475,12 +487,15 @@ jobs:
- name: Validate Azure signing configuration
if: >-
github.event_name == 'push' &&
needs.setup_release.outputs.publish_release == 'true' &&
vars.AZURE_SIGNING_ACCOUNT == ''
shell: pwsh
run: throw "Push builds must use Azure Trusted Signing for the Windows driver package."
run: throw "Release builds must use Azure Trusted Signing for the Windows driver package."

- name: Sign Windows driver package with local test certificate
if: github.event_name == 'pull_request'
if: >-
github.event_name == 'pull_request' ||
needs.setup_release.outputs.publish_release != 'true'
shell: pwsh
run: |
$packagePath = Join-Path `
Expand All @@ -497,6 +512,7 @@ jobs:
id: driver_catalog
if: >-
github.event_name == 'push' &&
needs.setup_release.outputs.publish_release == 'true' &&
vars.AZURE_SIGNING_ACCOUNT != ''
shell: pwsh
run: |
Expand All @@ -508,6 +524,7 @@ jobs:
- name: Sign Windows driver package with Azure Trusted Signing
if: >-
github.event_name == 'push' &&
needs.setup_release.outputs.publish_release == 'true' &&
vars.AZURE_SIGNING_ACCOUNT != ''
uses: azure/trusted-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
with:
Expand Down Expand Up @@ -538,6 +555,7 @@ jobs:
- name: Sign Windows driver installer with Azure Trusted Signing
if: >-
github.event_name == 'push' &&
needs.setup_release.outputs.publish_release == 'true' &&
vars.AZURE_SIGNING_ACCOUNT != ''
uses: azure/trusted-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
with:
Expand Down
Loading