macOSの署名付き更新とWindows Store向け配布を準備する

.github/workflows/desktop-checks.yml

@@ -0,0 +1,42 @@
+name: Desktop checks
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  desktop:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.13
+      - uses: dtolnay/rust-toolchain@stable
+      - run: bun install --frozen-lockfile
+      - run: bun run test:updates
+      - run: bun run build
+      - if: runner.os == 'Windows'
+        name: Validate MSIX packaging script syntax
+        shell: pwsh
+        run: |
+          $tokens = $null
+          $parseErrors = $null
+          [System.Management.Automation.Language.Parser]::ParseFile("$PWD/scripts/package-windows-store.ps1", [ref]$tokens, [ref]$parseErrors) | Out-Null
+          if ($parseErrors.Count -gt 0) { throw ($parseErrors | Out-String) }
+      - run: cargo check --locked --manifest-path src-tauri/Cargo.toml
+      - if: runner.os == 'Windows'
+        run: bun run tauri build --no-bundle
+      - if: runner.os == 'Windows'
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-executable-validation-only
+          path: src-tauri/target/release/posture-app.exe

.github/workflows/windows-store-package.yml

@@ -0,0 +1,58 @@
+name: Windows Store package
+on:
+  workflow_dispatch:
+    inputs:
+      runtime_url:
+        description: Official Microsoft x64 Fixed Version WebView2 CAB URL (license accepted)
+        required: false
+        type: string
+      runtime_sha256:
+        description: SHA256 of the approved CAB
+        required: false
+        type: string
+permissions:
+  contents: read
+jobs:
+  package:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.13
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-pc-windows-msvc
+      - run: bun install --frozen-lockfile
+      - name: Download and verify the approved runtime
+        shell: pwsh
+        env:
+          # Owner accepted the license and downloaded this x64 CAB on 2026-09-14.
+          RUNTIME_URL: ${{ inputs.runtime_url || 'https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/c3d95bc1-a0a7-4ca6-aaa1-fa0ac3dd1a37/Microsoft.WebView2.FixedVersionRuntime.153.0.4234.32.x64.cab' }}
+          RUNTIME_SHA256: ${{ inputs.runtime_sha256 || '2cb653a74426f0aa802c2396775c6bc674fd662d5396bd677f47bfa6e12eba9c' }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $uri = [uri]$env:RUNTIME_URL
+          if ($uri.Scheme -ne 'https' -or !($uri.DnsSafeHost.EndsWith('.microsoft.com') -or $uri.DnsSafeHost.EndsWith('.azureedge.net'))) { throw 'Use an official Microsoft HTTPS download.' }
+          if ($env:RUNTIME_SHA256 -notmatch '^[a-fA-F0-9]{64}$') { throw 'A complete SHA256 digest is required.' }
+          New-Item -ItemType Directory "$env:RUNNER_TEMP/webview2" | Out-Null
+          $cab = "$env:RUNNER_TEMP/webview2.cab"
+          Invoke-WebRequest -Uri $uri -OutFile $cab
+          if ((Get-FileHash $cab -Algorithm SHA256).Hash -ne $env:RUNTIME_SHA256) { throw 'Runtime checksum mismatch.' }
+          expand.exe $cab '-F:*' "$env:RUNNER_TEMP/webview2"
+          if ($LASTEXITCODE -ne 0) { throw 'CAB extraction failed.' }
+          $runtime = @(Get-ChildItem "$env:RUNNER_TEMP/webview2" -Filter msedgewebview2.exe -Recurse)
+          if ($runtime.Count -ne 1) { throw 'Expected one WebView2 runtime in the CAB.' }
+          "RUNTIME_DIRECTORY=$($runtime[0].DirectoryName)" >> $env:GITHUB_ENV
+      - run: bun run test:updates
+      - name: Build MSIX for the registered PiiiN Store identity
+        shell: pwsh
+        run: ./scripts/package-windows-store.ps1 -WebView2Directory $env:RUNTIME_DIRECTORY
+      - uses: actions/upload-artifact@v4
+        with:
+          name: piiin-store-submission
+          path: |
+            release-artifacts/windows-*/*.msix
+            release-artifacts/windows-*/SHA256SUMS.txt
+          if-no-files-found: error
+          retention-days: 14

.gitignore

@@ -25,3 +25,9 @@ dist-ssr
 
 
 z_plan
+
+# Release output and signing material must never be committed.
+release-artifacts/
+*.p12
+*.pfx
+*.key