Publish develop to main

.github/scripts/check-single-executable.sh

@@ -21,6 +21,13 @@
 #
 # Needs a display. On Linux run it under `xvfb-run -a`; a macOS runner has one.
 #
+# On Windows (Git Bash, with the Visual Studio C++ tools installed) the tarball is the static
+# kit build-windows.sh writes, packaged by package-static-renderer.sh. The build script has no
+# download route for it yet, so the kit is unpacked into the scratch directory and handed to
+# the build as DXC_WINDOWS_NATIVE_LIB, which links exactly what a consumer's build would.
+# dumpbin (or llvm-readobj, or objdump) must then show Windows' own DLLs only; a hosted
+# runner has no graphics card, so the window draws with Windows' software adapter.
+#
 # What it prints is the evidence: the executable's size, before and after stripping, and
 # every library it names.
 set -euo pipefail
@@ -44,9 +51,11 @@ fail() {
 }
 
 os="$(uname -s)"
+exe=""
 case "$os" in
     Darwin|Linux) ;;
-    *) fail "this checks macOS and Linux executables; $os is not one" ;;
+    MINGW*|MSYS*|CYGWIN*) os=Windows exe=.exe ;;
+    *) fail "this checks macOS, Linux and Windows executables; $os is not one" ;;
 esac
 if [[ "$os" == Linux && -z "${DISPLAY:-}" ]]; then
     fail "DISPLAY is not set" "Run it under xvfb-run -a."
@@ -69,13 +78,15 @@ esac
 # Listed into a variable first: grep -q stops reading early, and under pipefail the tar it
 # cut off would fail the check.
 contents="$(tar -tzf "$artifact")"
-grep -qE '^(\./)?lib/libcompose_rust_renderer\.a$' <<< "$contents" ||
-    fail "$(basename "$artifact") does not carry lib/libcompose_rust_renderer.a" \
+archive_pattern='^(\./)?lib/libcompose_rust_renderer\.a$'
+[[ "$os" != Windows ]] || archive_pattern='^(\./)?libcompose_rust_renderer\.a$'
+grep -qE "$archive_pattern" <<< "$contents" ||
+    fail "$(basename "$artifact") does not carry the static renderer archive" \
         "Only the static renderer makes an application one executable."
 
 # A workspace build in this checkout would be found before the cache, and then this would
 # test that instead of the artifact.
-for built in renderer/build/macos renderer/build/linux \
+for built in renderer/build/macos renderer/build/linux renderer/build/windows \
              renderer/build/linux-arm64 renderer/build/native-image/dist/lib; do
     [[ ! -e "$repo_root/$built" ]] || fail "$built exists in this checkout" \
         "The build script would link that instead of the artifact. Run this in a clean checkout."
@@ -93,6 +104,7 @@ cp "$artifact" "$artifact.sha256" "$scratch/cache/downloads/"
 
 # Nothing may point the build anywhere else.
 unset COMPOSE_RUST_RENDERER_DIR DIOXUS_COMPOSE_RENDERER_DIR DXC_MACOS_NATIVE_LIB DXC_LINUX_NATIVE_LIB
+unset DXC_WINDOWS_NATIVE_LIB DXC_WINDOWS_CRT RUSTFLAGS CARGO_ENCODED_RUSTFLAGS CARGO_BUILD_RUSTFLAGS
 # The Kotlin/Native renderer cannot close its own window, so the self-check ends the
 # process once the frames are in.
 unset COMPOSE_RUST_AUTOEXIT_MS
@@ -106,9 +118,40 @@ export COMPOSE_RUST_TEXT_SELF_CHECK=1
 # No ICU data file anywhere an application could be pointed at one. The executable must find
 # words and line breaks with what is linked into it. A runner that ships one (a browser
 # carries icudtl.dat) has to have it removed before this runs.
-icu_files="$(find /usr /opt /Library /Applications /home /Users -name 'icudtl.dat' 2>/dev/null || true)"
+if [[ "$os" == Windows ]]; then
+    # Git Bash sees the drives as /c, /d. The system and program directories are where a
+    # browser or a runtime keeps one; the checkout and the scratch directory are not searched,
+    # because the kit's own skia/icudtl.dat is not in the tarball and must not be.
+    icu_roots=()
+    for root in "/c/Program Files" "/c/Program Files (x86)" "/c/ProgramData" "/c/Users" \
+                "/c/Windows" "/c/hostedtoolcache" "/c/msys64" "/d/a/_tool" "/d/a/_temp"; do
+        [[ ! -d "$root" ]] || icu_roots+=("$root")
+    done
+    icu_files="$(find "${icu_roots[@]}" -name 'icudtl.dat' 2>/dev/null || true)"
+else
+    icu_files="$(find /usr /opt /Library /Applications /home /Users -name 'icudtl.dat' 2>/dev/null || true)"
+fi
 [[ -z "$icu_files" ]] || fail "an ICU data file is on this machine, so the text check would not prove anything" \
-    $icu_files
+    "$icu_files"
+
+if [[ "$os" == Windows ]]; then
+    # The tarball root is the kit root, as build-windows.sh writes it and build.rs reads it.
+    kit="$scratch/kit"
+    mkdir -p "$kit"
+    tar -xzf "$artifact" -C "$kit"
+    [[ -f "$kit/libcompose_rust_renderer.a" ]] || fail "the unpacked kit has no libcompose_rust_renderer.a at its root"
+    for piece in gcc/libstdc++.a native/dxc-windows-native.lib native/dxc-windows-static-ucrt.lib \
+                 skiko/skiko-bridges.lib skiko/skia.lib; do
+        [[ -f "$kit/$piece" ]] || fail "the kit has no $piece" \
+            "package-static-renderer.sh packs the whole kit build-windows.sh writes for windows-x64."
+    done
+    find "$kit" -name 'icudtl.dat' | grep . && fail "the kit carries an icudtl.dat" \
+        "The ICU data is to be inside the renderer's object, not beside it."
+    DXC_WINDOWS_NATIVE_LIB="$(cygpath -w "$kit")"
+    export DXC_WINDOWS_NATIVE_LIB
+    # A hosted runner has no card: Windows' software adapter draws instead.
+    export DXC_D3D12_WARP="${DXC_D3D12_WARP:-1}"
+fi
 
 # What every system the application may name lives under. Anything else is a file that
 # would have to travel with it.
@@ -119,9 +162,59 @@ system_library() {
     esac
 }
 
+# Visual Studio's tools, on PATH inside a developer prompt and found through vswhere otherwise.
+# Prints nothing when there is none.
+vs_tool() {
+    local name="$1" found vswhere
+    found="$(command -v "$name" || true)"
+    if [[ -z "$found" ]]; then
+        vswhere="/c/Program Files (x86)/Microsoft Visual Studio/Installer/vswhere.exe"
+        [[ -f "$vswhere" ]] || return 0
+        found="$("$vswhere" -latest -products '*' -find "VC/Tools/MSVC/**/bin/Hostx64/x64/$name" | tr -d '\r' | head -1)"
+        [[ -z "$found" ]] || found="$(cygpath -u "$found")"
+    fi
+    echo "$found"
+}
+
+# The DLLs a Windows executable asks the loader for, listed by dumpbin. The rules are those of
+# scripts/check-windows-consumer.sh: Windows' own DLLs only.
+check_windows_libraries() {
+    local binary="$1" dumpbin dlls dll lower system not_ours=()
+    dumpbin="$(vs_tool dumpbin.exe)"
+    [[ -n "$dumpbin" ]] || fail "no dumpbin to list the executable's DLLs with" \
+        "Install the Visual Studio C++ build tools."
+    echo "-- dumpbin -dependents $(basename "$binary")"
+    "$dumpbin" -nologo -dependents "$(cygpath -w "$binary")" | tr -d '\r' |
+        sed -n '/Image has the following dependencies/,/Summary/p'
+    dlls="$("$dumpbin" -nologo -dependents "$(cygpath -w "$binary")" | tr -d '\r' |
+        sed -n 's/^ *\([A-Za-z0-9_.-]*\.[dD][lL][lL]\)$/\1/p' | sort -fu)"
+    [[ -n "$dlls" ]] || fail "dumpbin named no DLL at all, which is not a Windows executable that opens a window"
+    system="$(cygpath -u "${SystemRoot:-C:\\Windows}")/System32"
+    for dll in $dlls; do
+        lower="$(echo "$dll" | tr '[:upper:]' '[:lower:]')"
+        case "$lower" in
+            vcruntime*|msvcp*|concrt*|libgcc*|libstdc++*|libwinpthread*|*mingw*|\
+            libcompose_rust_renderer*|*jvm*|*java*|awt*|skiko*|icu*)
+                fail "$(basename "$binary") needs $dll, which is not part of Windows" \
+                    "The runtime and the renderer are to be linked into the executable." ;;
+            api-ms-win-*|ext-ms-win-*) ;;
+            *) [[ -f "$system/$dll" || -f "$system/$lower" ]] || not_ours+=("$dll") ;;
+        esac
+    done
+    [[ "${#not_ours[@]}" -eq 0 ]] || fail "$(basename "$binary") needs DLLs Windows does not ship: ${not_ours[*]}"
+    # A statically linked JNI library announces itself with JNI_OnLoad_<name>.
+    ! grep -aq 'JNI_OnLoad' "$binary" ||
+        fail "the executable carries a JNI library, so a Java runtime is linked into it"
+    echo "-- $(wc -w <<< "$dlls" | tr -d ' ') DLLs, every one part of Windows: $(echo $dlls)"
+}
+
 # Prints what the executable names and fails on anything that is not the system's.
 check_libraries() {
     local binary="$1" failures=0 library resolved
+    if [[ "$os" == Windows ]]; then
+        check_windows_libraries "$binary"
+        return
+    fi
     if [[ "$os" == Darwin ]]; then
         echo "-- otool -L $(basename "$binary")"
         otool -L "$binary" | tail -n +2
@@ -185,7 +278,7 @@ check_libraries() {
 }
 
 size_of() {
-    if [[ "$os" == Darwin ]]; then stat -f %z "$1"; else stat -c %s "$1"; fi
+    if [[ "$os" == Darwin ]]; then stat -f %z "$1"; else wc -c < "$1" | tr -d ' '; fi
 }
 
 megabytes() {
@@ -207,28 +300,34 @@ build() {
     grep -q "unpacked the renderer for v$crate_version" "$log" ||
         grep -q "$scratch/cache/renderer" "$log" ||
         echo "note  the build log does not say it unpacked the artifact (a cached build replays nothing)" >&2
-    echo "$repo_root/target/single-executable/$name/release/consumer"
+    echo "$repo_root/target/single-executable/$name/release/consumer$exe"
 }
 
 run_alone() {
     local binary="$1" name="$2"
     local directory="$scratch/run/$name"
     rm -rf "$directory"
     mkdir -p "$directory"
-    cp "$binary" "$directory/consumer"
+    cp "$binary" "$directory/consumer$exe"
     echo "-- ls -la $directory"
     ls -la "$directory"
-    [[ "$(ls -A "$directory")" == "consumer" ]] || fail "something other than the executable is in $directory"
+    [[ "$(ls -A "$directory")" == "consumer$exe" ]] || fail "something other than the executable is in $directory"
     echo "== running it alone in $directory"
     local log="$scratch/run-$name.log" status=0
-    ( cd "$directory" && ./consumer --self-check ) > "$log" 2>&1 || status=$?
+    ( cd "$directory" && "./consumer$exe" --self-check ) > "$log" 2>&1 || status=$?
     cat "$log"
     grep -q "compose-rust text self-check: ok" "$log" ||
         fail "the renderer did not lay Korean text out correctly with no ICU data file" \
             "Its own report is above."
     [[ "$status" -eq 0 ]] || fail "the executable did not draw on its own (exit $status)"
     # And the renderer said so itself: its window opened, its scene was made on the main
     # dispatcher this platform has, and a frame reached the window.
+    if [[ "$os" == Windows ]]; then
+        # The Windows renderer's start lines are not the ones the other two print (it has no
+        # main dispatcher of the platform's), so what proves it drew is the exit status of the
+        # self-check, which the executable returns only once frames went through.
+        return 0
+    fi
     local dispatcher="$smoke_main_dispatcher_kn_linux"
     [[ "$os" != Darwin ]] || dispatcher="$smoke_main_dispatcher_kn_macos"
     check_window_start "$(cat "$log")" "$status" "$dispatcher" ||
@@ -237,6 +336,12 @@ run_alone() {
 
 report() {
     local binary="$1" stripped="$scratch/consumer.stripped"
+    if [[ "$os" == Windows ]]; then
+        # A release MSVC executable keeps its symbols in a .pdb beside it, so it is as small
+        # as it gets.
+        echo "-- size: $(megabytes "$(size_of "$binary")")"
+        return
+    fi
     cp "$binary" "$stripped"
     if [[ "$os" == Darwin ]]; then strip -x "$stripped"; else strip "$stripped"; fi
     echo "-- size: $(megabytes "$(size_of "$binary")"), stripped $(megabytes "$(size_of "$stripped")")"
@@ -245,7 +350,7 @@ report() {
 
 binary="$(build default "")"
 [[ -x "$binary" ]] || fail "the build produced no $binary"
-ls "$scratch/cache/renderer"/v"$crate_version"/* >/dev/null 2>&1 ||
+[[ "$os" == Windows ]] || ls "$scratch/cache/renderer"/v"$crate_version"/* >/dev/null 2>&1 ||
     fail "the build did not unpack the artifact into $scratch/cache/renderer" \
         "It found a renderer somewhere else, so this did not test the artifact."
 check_libraries "$binary"

.github/scripts/delete-pr-caches.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Usage: delete-pr-caches.sh <pull request number>
+#
+# Deletes the Actions caches that runs of one pull request saved (ref refs/pull/<n>/merge).
+# A pull request's caches can only be read by that pull request, so once it is merged or
+# closed they are dead weight against the repository's 10 GB limit, and they push out the
+# caches that other runs could use.
+#
+# It deletes nothing but that one ref, and it never fails the run: a cache that is already
+# gone or a listing that errors is reported as a warning.
+set -uo pipefail
+
+number="${1:-}"
+if [[ ! "$number" =~ ^[0-9]+$ ]]; then
+    echo "::warning title=No cache cleanup::'$number' is not a pull request number"
+    exit 0
+fi
+ref="refs/pull/$number/merge"
+
+if ! ids="$(gh cache list --ref "$ref" --limit 1000 --json id --jq '.[].id' 2>&1)"; then
+    echo "::warning title=Could not list caches::$ids"
+    exit 0
+fi
+[[ -n "$ids" ]] || { echo "no caches under $ref"; exit 0; }
+
+count="$(wc -l <<< "$ids" | tr -d ' ')"
+[[ "$count" -lt 1000 ]] || echo "::warning title=More caches may remain::listed $count caches, the most the listing returns; run again to delete the rest"
+
+for id in $ids; do
+    [[ "$id" =~ ^[0-9]+$ ]] || continue
+    if gh cache delete "$id" >/dev/null 2>&1; then echo "deleted cache $id of $ref"
+    else echo "::warning title=Cache not deleted::cache $id of $ref"; fi
+done
+exit 0

.github/scripts/find-released-renderer.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Usage: find-released-renderer.sh <crate version>
+#
+# Prints "released=true" or "released=false" for GITHUB_OUTPUT. true means the release
+# v<version> carries the renderer tarball and its checksum for every desktop target.
+#
+# "The release has no such asset" and "gh failed" are different answers. A missing release
+# or missing asset is false, which sends the build to building the renderer itself. Any
+# other gh failure (authentication, rate limit, network) is reported as a warning and also
+# false, but it is said, because otherwise a broken token turns into a silent rebuild that
+# takes hours.
+set -uo pipefail
+
+version="${1:?usage: $0 <crate version>}"
+repo="${GITHUB_REPOSITORY:-}"
+
+err="$(mktemp)"
+trap 'rm -f "$err"' EXIT
+if names="$(gh release view "v$version" ${repo:+-R "$repo"} --json assets -q '.assets[].name' 2>"$err")"; then
+    :
+else
+    if grep -qiE 'release not found|not found' "$err"; then
+        echo "no release v$version yet" >&2
+    else
+        echo "::warning title=Could not read the release::gh failed: $(tr '\n' ' ' < "$err")"
+    fi
+    echo "released=false"
+    exit 0
+fi
+
+released=true
+for target in macos-aarch64 linux-x64 linux-arm64 windows-x64; do
+    asset="compose-rust-renderer-v$version-$target.tar.gz"
+    for n in "$asset" "$asset.sha256"; do
+        grep -qxF "$n" <<<"$names" || { echo "missing $n" >&2; released=false; }
+    done
+done
+echo "released=$released"

.github/scripts/heavy-checks.py

@@ -53,10 +53,12 @@
 KNOWN_HEAVY = [
     "test-compose-from-fork.yml",
     "test-kn-desktop-renderer.yml",
+    "packager-linux.yml",
     "test-native-renderer.yml",
     "test-samples.yml",
     "test-windows-resize-metrics.yml",
     "test-windows-resize-probe.yml",
+    "package-windows-host.yml",
 ]
 
 REPO_ROOT = Path(__file__).resolve().parents[2]

.github/scripts/native-needs-macos.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Usage: git diff --no-renames --name-only <base> <head> | native-needs-macos.sh
+#
+# Reads the changed file names on stdin and prints "macos=true" or "macos=false" for
+# GITHUB_OUTPUT. test-native-renderer.yml builds the macOS static renderer, checks the macOS
+# single executable and builds the iOS renderer on macOS runners; false means every changed
+# file is one of the other platforms' own, so those jobs are left out. It fails open: an empty
+# list, an unreadable list or any file not named below prints true.
+#
+# The other platforms' own files (they feed no macOS job of this workflow):
+#   renderer/windows/, renderer/staticlib-windows/, renderer/linux/, renderer/staticlib-linux/
+#   renderer/desktop/scripts/*.ps1, build-windows.sh, build-linux.sh,
+#   renderer/desktop/scripts/windows-build-contract.test.sh, windows-metadata/
+#   scripts/check-windows-consumer.sh, .github/scripts/check-linux-input-access.sh,
+#   .github/scripts/atspi-walk.py, .github/workflows/windows-static.yml
+#
+# Everything else counts as macOS-relevant: the shared renderer sources, the build scripts,
+# package-static-renderer.sh and check-single-executable.sh (the macOS legs run them),
+# compose-rust/build*, parity scripts and the workflows themselves.
+set -uo pipefail
+
+files="$(cat 2>/dev/null)" || { echo "macos=true"; exit 0; }
+[[ -n "$files" ]] || { echo "macos=true"; exit 0; }
+
+while IFS= read -r file; do
+    [[ -n "$file" ]] || continue
+    case "$file" in
+        renderer/windows/*|renderer/staticlib-windows/*|renderer/linux/*|renderer/staticlib-linux/*) ;;
+        renderer/desktop/scripts/windows-metadata/*|renderer/desktop/scripts/*.ps1) ;;
+        renderer/desktop/scripts/build-windows.sh|renderer/desktop/scripts/build-linux.sh) ;;
+        renderer/desktop/scripts/windows-build-contract.test.sh) ;;
+        scripts/check-windows-consumer.sh|.github/scripts/check-linux-input-access.sh) ;;
+        .github/scripts/atspi-walk.py|.github/workflows/windows-static.yml) ;;
+        *) echo "macos=true"; exit 0 ;;
+    esac
+done <<< "$files"
+echo "macos=false"