On-device sensitive-detail detection + redaction (pre-send) #46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Windows | |
| on: | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| native: | |
| name: Windows ${{ matrix.arch }} | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 60 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: x64 | |
| runner: windows-latest | |
| dist_script: dist:win:x64 | |
| - arch: arm64 | |
| runner: windows-11-arm | |
| dist_script: dist:win:arm64 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Validate source installer guardrails | |
| shell: pwsh | |
| run: | | |
| $path = (Resolve-Path "install.ps1").Path | |
| & .\scripts\install-windows.test.ps1 -InstallerPath $path | |
| $beforeErrorPreference = $ErrorActionPreference | |
| $beforeProgressPreference = $ProgressPreference | |
| $env:SKILL_RECORDER_COMMIT = "master" | |
| try { | |
| & .\install.ps1 | |
| throw "install.ps1 accepted a mutable source reference" | |
| } catch { | |
| if ($_.Exception.Message -notmatch "full 40-character") { | |
| throw | |
| } | |
| } finally { | |
| Remove-Item Env:SKILL_RECORDER_COMMIT -ErrorAction SilentlyContinue | |
| } | |
| if ( | |
| $ErrorActionPreference -ne $beforeErrorPreference -or | |
| $ProgressPreference -ne $beforeProgressPreference | |
| ) { | |
| throw "install.ps1 leaked preference changes into the caller" | |
| } | |
| - name: Test commit-pinned source installation | |
| shell: powershell | |
| env: | |
| SKILL_RECORDER_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }} | |
| SKILL_RECORDER_INSTALL_ROOT: ${{ runner.temp }}\skill-recorder-source | |
| SKILL_RECORDER_NO_LAUNCH: "1" | |
| run: .\install.ps1 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.19.0 | |
| architecture: ${{ matrix.arch }} | |
| cache: npm | |
| - name: Validate lockfile portability | |
| run: npm run check:lockfile | |
| - name: Install native dependencies | |
| shell: pwsh | |
| run: | | |
| if ((node -p "process.arch") -ne "${{ matrix.arch }}") { | |
| throw "Expected Node ${{ matrix.arch }}" | |
| } | |
| npm ci --ignore-scripts=false --dangerously-allow-all-scripts=false --strict-allow-scripts | |
| node -e "require('sharp'); require('onnxruntime-node'); require('koffi')" | |
| if (Select-String -Path package-lock.json -Pattern 'ffmpeg-static' -Quiet) { | |
| throw "ffmpeg-static remains in the lockfile" | |
| } | |
| - name: Generate license inventory | |
| run: npm run compliance:licenses | |
| - name: Run tests | |
| run: npm test | |
| - name: Build | |
| run: npm run build | |
| - name: Package native installer | |
| run: npm run ${{ matrix.dist_script }} | |
| - name: Verify packaged architecture | |
| run: node scripts/verify-windows-package.mjs ${{ matrix.arch }} |