Build Windows release artifact in Gitea

tools/test_release_workflow.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+
+REPO = Path(__file__).resolve().parent.parent
+WORKFLOW = REPO / ".gitea/workflows/linux-release-build.yml"
+
+
+def job(text: str, name: str, next_name: str | None) -> str:
+    start = text.index(f"  {name}:\n")
+    end = len(text) if next_name is None else text.index(f"  {next_name}:\n", start + 1)
+    return text[start:end]
+
+
+class ReleaseWorkflowTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.text = WORKFLOW.read_text(encoding="utf-8")
+        cls.linux = job(cls.text, "linux-release", "windows-release")
+        cls.windows = job(cls.text, "windows-release", "publish-release")
+        cls.publish = job(cls.text, "publish-release", None)
+
+    def test_build_jobs_are_linux_hosted_read_only_and_target_separate(self) -> None:
+        self.assertRegex(self.text, r"(?m)^permissions:\n  contents: read$")
+        self.assertIn("runs-on: ubuntu-latest", self.linux)
+        self.assertIn("run: ./tools/build-linux-x64.sh", self.linux)
+        self.assertIn("runs-on: ubuntu-latest", self.windows)
+        self.assertIn("run: ./tools/build-windows-x64.sh", self.windows)
+        self.assertNotIn("releases: write", self.linux + self.windows)
+        self.assertNotIn("secrets.", self.linux + self.windows)
+
+    def test_windows_job_provisions_and_caches_only_its_cross_inputs(self) -> None:
+        self.assertRegex(
+            self.windows,
+            r"gcc-mingw-w64-x86-64 binutils-mingw-w64-x86-64",
+        )
+        self.assertIn("binutils-mingw-w64-x86-64", self.windows)
+        self.assertIn("ffmpeg-*-win64-lgpl-shared-*.zip", self.windows)
+        self.assertIn("windows_release_x86_64.exe", self.windows)
+        self.assertIn("dependency-win64.json", self.windows)
+        self.assertNotIn("linux_release.x86_64", self.windows)
+        self.assertNotIn("dependency-linux-x64.json", self.windows)
+        self.assertNotRegex(self.windows.lower(), r"\bwine(?:32|64)?\b")
+        self.assertNotIn("--package-smoke", self.windows)
+
+    def test_windows_artifact_is_archive_plus_structural_evidence(self) -> None:
+        for name in (
+            "OpenMaidEngine-Himegari-windows-x64.zip",
+            "OpenMaidEngine-Himegari-windows-x64.zip.sha256",
+            "BUILD-INFO.json",
+            "SHA256SUMS",
+            "WINDOWS-VERIFICATION.json",
+        ):
+            self.assertIn(name, self.windows)
+        self.assertIn("if-no-files-found: error", self.windows)
+        self.assertIn("retention-days: 30", self.windows)
+
+    def test_slice_three_keeps_linux_only_tag_promotion_boundary(self) -> None:
+        self.assertIn("if: startsWith(gitea.ref, 'refs/tags/v')", self.publish)
+        self.assertRegex(self.publish, r"(?m)^    needs: linux-release$")
+        self.assertIn("releases: write", self.publish)
+        self.assertNotIn("windows-release", self.publish)
+
+
+if __name__ == "__main__":
+    unittest.main()

tools/validate.py

@@ -35,6 +35,7 @@ CORE_TESTS = (
     "test_package_windows_x64.py",
     "test_dotnet_publish_proxy.py",
     "test_publish_gitea_release.py",
+    "test_release_workflow.py",
     "test_verify_windows_native.py",
     "test_diff_optrace.py",
     "test_engine_ctx.py",