waleedlatif1 · Oct 31, 2026 · Oct 31, 2026 · Oct 31, 2026 · Oct 31, 2026 · Oct 31, 2026
diff --git a/.github/scripts/ci-plan.gql b/.github/scripts/ci-plan.gql
@@ -1,22 +1,56 @@
-query($base: String!, $head: String!) {
-  packages { items { name path } }
-  affectedTasks(base: $base, head: $head, tasks: [
-    "test", "build", "type-check", "ci:integration", "ci:desktop-live",
-    "ci:e2e-scim", "ci:e2e-cli", "ci:e2e-stop-after", "ci:e2e-desktop-inbox",
-    "ci:e2e-browser-extension", "ci:e2e-project-files", "ci:e2e-mobile", "ci:e2e-seo"
-  ]) {
+query ($base: String!, $head: String!) {
+  packages {
+    items {
+      name
+      path
+    }
+  }
+  affectedTasks(
+    base: $base
+    head: $head
+    tasks: [
+      "test"
+      "build"
+      "type-check"
+      "ci:integration"
+      "ci:desktop-live"
+      "ci:e2e-scim"
+      "ci:e2e-cli"
+      "ci:e2e-stop-after"
+      "ci:e2e-desktop-inbox"
+      "ci:e2e-browser-extension"
+      "ci:e2e-project-files"
+      "ci:e2e-mobile"
+      "ci:e2e-seo"
+    ]
+  ) {
     items {
       name
       fullName
-      package { name }
+      package {
+        name
+      }
       reason {
         __typename
-        ... on TaskFileChanged { filePath }
-        ... on TaskGlobalFileChanged { filePath }
-        ... on TaskGlobalDepsChanged { filePath }
-        ... on TaskDependencyTaskChanged { taskName packageName }
-        ... on TaskPackageDependencyChanged { packageName }
-        ... on TaskAllChanged { description }
+        ... on TaskFileChanged {
+          filePath
+        }
+        ... on TaskGlobalFileChanged {
+          filePath
+        }
+        ... on TaskGlobalDepsChanged {
+          filePath
+        }
+        ... on TaskDependencyTaskChanged {
+          taskName
+          packageName
+        }
+        ... on TaskPackageDependencyChanged {
+          packageName
+        }
+        ... on TaskAllChanged {
+          description
+        }
       }
     }
   }

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1260,8 +1260,12 @@ jobs:
       needs.desktop-signing.result == 'success' &&
       needs.version.result == 'success' &&
       needs.desktop-signing.outputs.configured == 'true'
+    # The reusable workflow's Windows job requests id-token: write for Azure
+    # OIDC, and GitHub checks every called job against the caller's grant at
+    # startup, even one this macOS call skips.
     permissions:
       contents: write
+      id-token: write
     uses: ./.github/workflows/desktop-release.yml
     with:
       version: ${{ needs.version.outputs.version }}
@@ -1275,6 +1279,55 @@ jobs:
       APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
       APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
+  # Windows desktop builds are signed with Azure Artifact Signing over GitHub
+  # OIDC. Gated like the macOS build: until the Azure identity and signing
+  # variables exist, the Windows build skips with a warning, and nothing is
+  # ever published unsigned. Windows jobs are separate workflow calls that no
+  # other job needs, so a Windows failure never blocks a macOS release; the
+  # update feed treats a release without latest.yml as having no Windows build.
+  desktop-signing-windows:
+    name: desktop-signing-windows
+    runs-on: *runner-2vcpu
+    timeout-minutes: 2
+    needs: [version, desktop-changes]
+    if: ${{ !cancelled() && (needs.version.outputs.is_release == 'true' || needs.desktop-changes.outputs.changed == 'true') }}
+    outputs:
+      configured: ${{ steps.check.outputs.configured }}
+    steps:
+      - name: Probe Azure signing configuration
+        id: check
+        env:
+          CONFIGURED: ${{ secrets.AZURE_CLIENT_ID != '' && secrets.AZURE_TENANT_ID != '' && secrets.AZURE_SUBSCRIPTION_ID != '' && vars.AZURE_SIGNING_ENDPOINT != '' && vars.AZURE_SIGNING_ACCOUNT != '' && vars.AZURE_SIGNING_PROFILE != '' && vars.AZURE_SIGNING_PUBLISHER != '' }}
+        run: |
+          echo "configured=${CONFIGURED}" >> "$GITHUB_OUTPUT"
+          if [ "$CONFIGURED" != "true" ]; then
+            echo "::warning::Windows desktop release skipped: Azure signing is not configured (secrets AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID; variables AZURE_SIGNING_ENDPOINT, AZURE_SIGNING_ACCOUNT, AZURE_SIGNING_PROFILE, AZURE_SIGNING_PUBLISHER)."
+          fi
+
+  desktop-release-windows:
+    name: desktop-release-windows
+    needs: [release, desktop-signing-windows, version]
+    # See desktop-release for why the implicit success() check is suppressed.
+    if: >-
+      !cancelled() &&
+      needs.release.result == 'success' &&
+      needs.desktop-signing-windows.result == 'success' &&
+      needs.version.result == 'success' &&
+      needs.desktop-signing-windows.outputs.configured == 'true'
+    permissions:
+      contents: write
+      id-token: write
+    uses: ./.github/workflows/desktop-release.yml
+    with:
+      version: ${{ needs.version.outputs.version }}
+      publish: true
+      platform: windows
+    secrets:
+      DESKTOP_RELEASE_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
   # Per-env desktop prereleases: a dev/staging push that touches shell code
   # publishes an environment-tagged GitHub prerelease to the public,
   # release-only simstudioai/sim-desktop-releases repository. Keeping these
@@ -1285,15 +1338,20 @@ jobs:
     name: prerelease-create
     runs-on: *runner-2vcpu
     timeout-minutes: 5
-    needs: [desktop-changes, desktop-signing]
-    # Requires the signing probe to have actually succeeded (not just "not
+    needs: [desktop-changes, desktop-signing, desktop-signing-windows]
+    # Requires a signing probe to have actually succeeded (not just "not
     # cancelled") so a probe failure can't produce a release with no build.
+    # Either platform's signing is enough: each build job gates on its own.
     if: >-
       ${{
         !cancelled() &&
         needs.desktop-changes.outputs.changed == 'true' &&
-        needs.desktop-signing.result == 'success' &&
-        needs.desktop-signing.outputs.configured == 'true'
+        (
+          (needs.desktop-signing.result == 'success' &&
+            needs.desktop-signing.outputs.configured == 'true') ||
+          (needs.desktop-signing-windows.result == 'success' &&
+            needs.desktop-signing-windows.outputs.configured == 'true')
+        )
       }}
     permissions:
       contents: read
@@ -1355,11 +1413,19 @@ jobs:
   prerelease-build:
     name: prerelease-build
     needs: [prerelease-create, desktop-signing]
+    if: >-
+      !cancelled() &&
+      needs.prerelease-create.result == 'success' &&
+      needs.desktop-signing.result == 'success' &&
+      needs.desktop-signing.outputs.configured == 'true'
     # The reusable workflow declares contents: write for its stable-release
     # path. GitHub cannot elevate a caller's token, even though this prerelease
     # path uses the dedicated cross-repository token for its actual upload.
+    # id-token: write is required the same way by the Windows job (see
+    # desktop-release above).
     permissions:
       contents: write
+      id-token: write
     uses: ./.github/workflows/desktop-release.yml
     with:
       version: ${{ needs.prerelease-create.outputs.version }}
@@ -1374,14 +1440,49 @@ jobs:
       APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
       APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
+  # Attaches the Windows build to the same prerelease. A Windows failure never
+  # holds back a macOS build that succeeded (see prerelease-publish).
+  prerelease-build-windows:
+    name: prerelease-build-windows
+    needs: [prerelease-create, desktop-signing-windows]
+    if: >-
+      !cancelled() &&
+      needs.prerelease-create.result == 'success' &&
+      needs.desktop-signing-windows.result == 'success' &&
+      needs.desktop-signing-windows.outputs.configured == 'true'
+    permissions:
+      contents: write
+      id-token: write
+    uses: ./.github/workflows/desktop-release.yml
+    with:
+      version: ${{ needs.prerelease-create.outputs.version }}
+      publish: true
+      sign: true
+      platform: windows
+    secrets:
+      DESKTOP_RELEASE_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
   # The draft only becomes visible to the update feed once its artifacts are
   # attached — this is what makes a dev/staging push atomic from the shell's
   # point of view.
   prerelease-publish:
     name: prerelease-publish
     runs-on: *runner-2vcpu
     timeout-minutes: 5
-    needs: [prerelease-create, prerelease-build]
+    needs: [prerelease-create, prerelease-build, prerelease-build-windows]
+    # Publishes once every configured platform has finished: the macOS build
+    # when Apple signing is configured, otherwise the Windows build alone.
+    if: >-
+      !cancelled() &&
+      needs.prerelease-create.result == 'success' &&
+      (
+        needs.prerelease-build.result == 'success' ||
+        (needs.prerelease-build.result == 'skipped' &&
+          needs.prerelease-build-windows.result == 'success')
+      )
     permissions:
       contents: read
     env:

diff --git a/.github/workflows/desktop-e2e.yml b/.github/workflows/desktop-e2e.yml
@@ -260,3 +260,72 @@ jobs:
             exit 1
           fi
           SIM_DESKTOP_EXECUTABLE="$EXECUTABLE" bunx playwright test e2e/packaged-smoke.spec.ts
+
+  # The Windows leg: the unit suite on Windows, then an unsigned unpacked x64
+  # build through the same packaged smoke suite (fuses, launch telemetry, and
+  # the bundled offline page).
+  package-smoke-windows:
+    name: package-smoke-windows
+    if: github.event_name != 'schedule'
+    runs-on: windows-latest
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.4
+
+      - name: Setup Node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
+        with:
+          node-version: 22
+
+      - name: Cache Electron downloads
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
+        with:
+          path: |
+            ~/AppData/Local/electron/Cache
+            ~/AppData/Local/electron-builder/Cache
+          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: desktop-downloads-${{ runner.os }}-
+
+      - name: Install dependencies
+        env:
+          HUSKY: '0'
+        run: bun install --frozen-lockfile
+
+      - name: Run desktop unit tests
+        working-directory: apps/desktop
+        run: bun run test
+
+      - name: Bundle and package unsigned
+        working-directory: apps/desktop
+        run: |
+          bun run build
+          bunx electron-builder --win dir --x64 --publish never -c.win.signExecutable=false
+
+      - name: Run packaged Electron smoke suite
+        working-directory: apps/desktop
+        run: |
+          EXECUTABLE=release/win-unpacked/Sim.exe
+          if [ ! -f "$EXECUTABLE" ]; then
+            echo "::error::Packaged app executable was not found."
+            exit 1
+          fi
+          SIM_DESKTOP_EXECUTABLE="$EXECUTABLE" bunx playwright test e2e/packaged-smoke.spec.ts
+
+      - name: Upload test results
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: desktop-package-smoke-windows-results
+          path: apps/desktop/test-results
+          retention-days: 7