From 4fb537ce9c9c54e772b99cddd1a686330baf1692 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Sat, 22 Aug 2026 01:26:04 +0000 Subject: [PATCH 1/3] Migrate Windows arm64 release build to native windows-11-arm runner Both windows-11-arm and windows-2025 GitHub-hosted runner images now ship the same VC++/Windows SDK/LLVM toolchain, so the arm64 leg of the Windows release build no longer needs to cross-compile from an x86_64 host. - .github/workflows/create_release.yml: point the arm64 leg of build_windows_binaries and release_windows (already keyed by a per-arch matrix.runner) at windows-11-arm instead of windows-latest-large. Give build_windows_tui_binaries and release_windows_tui the same per-arch matrix.runner treatment (they previously had a flat runs-on: windows-latest-large). Drop the 'Add arm64 target' rustup steps, since the arm64 leg's host target is now aarch64-pc-windows-msvc rather than a cross-compiled add-on. Disable azure/artifact-signing-action's dependency cache (cache-dependencies: false) in both signing steps, since it is not keyed by runner architecture and can otherwise be corrupted when the x64 and arm64 legs of the matrix sign concurrently (Azure/artifact-signing-action#146). - script/install_cargo_binstall: pin the aarch64-pc-windows-msvc cargo-binstall archive and its verified SHA-256 alongside the existing x86_64 entry, so the installer can resolve a native arm64 archive if it is ever selected. --- .github/workflows/create_release.yml | 30 +++++++++++++++------------- script/install_cargo_binstall | 2 ++ 2 files changed, 18 insertions(+), 14 deletions(-) diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml index d65fcdbe46f..a7492afa112 100644 --- a/.github/workflows/create_release.yml +++ b/.github/workflows/create_release.yml @@ -2036,7 +2036,7 @@ jobs: build_windows_tui_binaries: name: Build Release Binary (Windows TUI ${{ matrix.arch }}) - runs-on: windows-latest-large + runs-on: ${{ matrix.runner }} needs: prepare_release if: ${{ inputs.build_windows != false }} timeout-minutes: 150 @@ -2045,7 +2045,9 @@ jobs: matrix: include: - arch: x64 + runner: windows-latest-large - arch: arm64 + runner: windows-11-arm steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 @@ -2058,11 +2060,6 @@ jobs: install_release_deps: true ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }} - - name: Add arm64 target - if: ${{ matrix.arch == 'arm64' }} - run: rustup target add aarch64-pc-windows-msvc - shell: bash - - name: Get channel configuration id: get-config uses: ./.github/actions/get_channel_config/ @@ -2109,7 +2106,7 @@ jobs: # parallel), then adds the canonical schema and signs it. release_windows_tui: name: Build Release (Windows TUI ${{ matrix.arch }}) - runs-on: windows-latest-large + runs-on: ${{ matrix.runner }} needs: [prepare_release, build_windows_binaries, build_windows_tui_binaries] if: ${{ inputs.build_windows != false }} timeout-minutes: 150 @@ -2119,8 +2116,10 @@ jobs: include: - arch: x64 release_arch: x86_64 + runner: windows-latest-large - arch: arm64 release_arch: aarch64 + runner: windows-11-arm env: TRUSTED_SIGNING_ENDPOINT: https://eus.codesigning.azure.net/ TRUSTED_SIGNING_ACCOUNT: warpdotdev @@ -2189,6 +2188,10 @@ jobs: file-digest: SHA256 timestamp-rfc3161: http://timestamp.acs.microsoft.com timestamp-digest: SHA256 + # The action's dependency cache is not keyed by runner architecture, so x64 and arm64 + # legs of this matrix can clobber each other's cached tools when they run concurrently + # (Azure/artifact-signing-action#146). + cache-dependencies: false - name: Build sign-tool command for Inno Setup id: setup_signing shell: pwsh @@ -2263,7 +2266,7 @@ jobs: - arch: x64 runner: windows-latest-large - arch: arm64 - runner: windows-latest-large + runner: windows-11-arm steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 @@ -2276,11 +2279,6 @@ jobs: install_release_deps: true ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }} - - name: Add arm64 target - if: ${{ matrix.arch == 'arm64' }} - run: rustup target add aarch64-pc-windows-msvc - shell: bash - - name: Get channel configuration id: get-config uses: ./.github/actions/get_channel_config/ @@ -2338,7 +2336,7 @@ jobs: - arch: x64 runner: windows-latest-large - arch: arm64 - runner: windows-latest-large + runner: windows-11-arm env: TRUSTED_SIGNING_ENDPOINT: https://eus.codesigning.azure.net/ TRUSTED_SIGNING_ACCOUNT: warpdotdev @@ -2401,6 +2399,10 @@ jobs: file-digest: SHA256 timestamp-rfc3161: http://timestamp.acs.microsoft.com timestamp-digest: SHA256 + # The action's dependency cache is not keyed by runner architecture, so x64 and arm64 + # legs of this matrix can clobber each other's cached tools when they run concurrently + # (Azure/artifact-signing-action#146). + cache-dependencies: false # The azure/artifact-signing-action above downloads signtool.exe and the Trusted Signing dlib. # We locate them so ISCC can call signtool during compilation to sign the inner setup engine diff --git a/script/install_cargo_binstall b/script/install_cargo_binstall index b3a61612ce2..976a61a2cda 100755 --- a/script/install_cargo_binstall +++ b/script/install_cargo_binstall @@ -29,6 +29,8 @@ archive_sha256() { echo "c55962a0115f9716b709216de7f8bdd59d6ba8738779e60b051b4593f677717a" ;; cargo-binstall-x86_64-pc-windows-msvc.zip) echo "89706aa5215c164d8d091597a470fee72308ac87e8553af395ea77db844a888c" ;; + cargo-binstall-aarch64-pc-windows-msvc.zip) + echo "c6873e81457d9e44973a8e9a849795f2c83765fce0af8ad68b597b5b40dec418" ;; esac } From 9607961225d727e0404cd335ae3a25346bba9aae Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Sat, 22 Aug 2026 01:35:41 +0000 Subject: [PATCH 2/3] Fix Windows arch detection in install_cargo_binstall archive_for_platform derived the Windows archive name from `uname -m`, but Git for Windows' MSYS runtime does not report the host's real architecture there: it reports the emulated x86_64 process architecture under WOW64, or "unknown" for a native arm64 host with no case in its uname implementation. On windows-11-arm this asked for cargo-binstall-unknown-pc-windows-msvc.zip, which has no pinned digest, and the script exited before installing anything. Derive the Windows architecture from PROCESSOR_ARCHITEW6432 (set only under WOW64/x64 emulation, to the true native architecture) falling back to PROCESSOR_ARCHITECTURE instead, so both a native arm64 host and an x64-emulated bash on an arm64 host resolve to the aarch64 archive. The x64 leg still resolves to the same x86_64 archive as before. --- script/install_cargo_binstall | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/script/install_cargo_binstall b/script/install_cargo_binstall index 976a61a2cda..e9ae5638be9 100755 --- a/script/install_cargo_binstall +++ b/script/install_cargo_binstall @@ -43,7 +43,17 @@ archive_for_platform() { echo "cargo-binstall-$(uname -m)-unknown-linux-musl.tgz" ;; *) if [ "${OS-}" = "Windows_NT" ]; then - echo "cargo-binstall-$(uname -m)-pc-windows-msvc.zip" + # uname -m is unreliable here: Git for Windows' MSYS runtime reports the + # emulated x86_64 host under WOW64, or "unknown" on a native arm64 host, + # rather than the real machine architecture. PROCESSOR_ARCHITEW6432 (set + # only under emulation, to the true native architecture) falling back to + # PROCESSOR_ARCHITECTURE reports it correctly in both cases. + case "${PROCESSOR_ARCHITEW6432:-${PROCESSOR_ARCHITECTURE-}}" in + ARM64) + echo "cargo-binstall-aarch64-pc-windows-msvc.zip" ;; + AMD64) + echo "cargo-binstall-x86_64-pc-windows-msvc.zip" ;; + esac fi ;; esac From 4da56caa19d9026db3c3916c0111e36e11e241a9 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Sun, 23 Aug 2026 00:49:46 +0000 Subject: [PATCH 3/3] TEMPORARY TEST SCAFFOLDING: isolate Windows arm64 in create_release.yml DO NOT MERGE THIS COMMIT. It exists only so this migration's Windows arm64 path can be exercised on its own, without paying for the full release matrix. Revert it (a single, self-contained commit) before this PR merges. Re-derived against the workflow as restructured by the commits this branch is now rebased onto (release_macos_cli and release_linux_cli_x86 split into build-only + packaging-only jobs, gate_tui_release_artifacts replaced by collect_results). The previous version of this commit hardcoded if: false on every non-Windows job by name; that approach no longer matches the current job list and, more importantly, collect_results derives which platforms are "disabled" from the build_macos/build_linux/build_windows/ build_web workflow inputs, not from each job's own if:, so hardcoding if: false directly on jobs would have made collect_results treat every one of them as a genuine, non-excluded failure and fail the whole run. Instead, this flips the *default* of the build_linux, build_macos, and build_web workflow_dispatch inputs to false (the workflow_call inputs used by real automated releases are untouched). A manual test run started with no input overrides now disables those three platforms through the exact same mechanism a user could already invoke by hand, so collect_results correctly excludes them instead of reporting spurious failures. Within Windows, isolates the arm64 leg of build_windows_tui_binaries, release_windows_tui, and release_windows by commenting out the x64 entry in each job's matrix.include, rather than by adding a matrix condition to the job's if:. jobs..if only has access to the github, needs, vars, and inputs contexts (see the context availability table in GitHub's docs); matrix is not among them, so a job-level if: referencing matrix.arch silently evaluates to an empty-string comparison and is always false. This was the flaw in the very first attempt at this scaffolding. build_windows_binaries is deliberately left running both legs: its x64 leg alone produces the canonical Windows settings schema artifact that the arm64 legs of release_windows and release_windows_tui download. --- .github/workflows/create_release.yml | 47 ++++++++++++++++++++++------ 1 file changed, 37 insertions(+), 10 deletions(-) diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml index a7492afa112..91da1f2d986 100644 --- a/.github/workflows/create_release.yml +++ b/.github/workflows/create_release.yml @@ -40,10 +40,16 @@ on: channel: type: string required: true + # TEMPORARY TEST SCAFFOLDING (arm64-native-test): build_linux/build_macos/build_web + # default to false below (only for this manual-trigger input block; the workflow_call + # inputs above are untouched) so a workflow_dispatch test run exercises only the + # Windows path. collect_results reads these same inputs to decide which platforms + # are "disabled" and excludes them from its pass/fail rollup, so this does not make + # the run report a spurious failure. Restore all three to `default: true` before merge. build_linux: description: Build Linux artifacts. type: boolean - default: true + default: false build_windows: description: Build Windows artifacts. type: boolean @@ -51,17 +57,26 @@ on: build_macos: description: Build macOS artifacts. type: boolean - default: true + default: false build_web: description: Build web artifacts. type: boolean - default: true + default: false env: CARGO_TERM_COLOR: always CONFIG_FILE: ".github/workflows/release_configurations.json" jobs: + # ============================================================================ + # TEMPORARY TEST SCAFFOLDING (arm64-native-test) — DO NOT MERGE THIS COMMIT. + # See the workflow_dispatch build_linux/build_macos/build_web inputs above + # (defaulted to false) and the matrix.include comments on + # build_windows_tui_binaries, release_windows_tui, and release_windows below + # for the full mechanism. It isolates a manual test run to the Windows arm64 + # path only. Revert this single, self-contained commit before this PR merges. + # ============================================================================ + # Perform all once-per-release steps. Dependent jobs will build release # assets and upload them as appropriate. prepare_release: @@ -2044,8 +2059,11 @@ jobs: fail-fast: false matrix: include: - - arch: x64 - runner: windows-latest-large + # TEMPORARY TEST SCAFFOLDING (arm64-native-test): the x64 entry is removed from this + # matrix (not gated by `if:`, which cannot see the `matrix` context at the job level) + # to isolate the Windows arm64 job. Restore this entry before merge. + # - arch: x64 + # runner: windows-latest-large - arch: arm64 runner: windows-11-arm steps: @@ -2114,9 +2132,12 @@ jobs: fail-fast: false matrix: include: - - arch: x64 - release_arch: x86_64 - runner: windows-latest-large + # TEMPORARY TEST SCAFFOLDING (arm64-native-test): the x64 entry is removed from this + # matrix (not gated by `if:`, which cannot see the `matrix` context at the job level) + # to isolate the Windows arm64 job. Restore this entry before merge. + # - arch: x64 + # release_arch: x86_64 + # runner: windows-latest-large - arch: arm64 release_arch: aarch64 runner: windows-11-arm @@ -2258,6 +2279,9 @@ jobs: name: Build Release Binary (Windows ${{ matrix.arch }}) runs-on: ${{ matrix.runner }} needs: prepare_release + # Not restricted to arm64 by the TEMPORARY TEST SCAFFOLDING below: the x64 leg still runs + # here because it alone produces the canonical Windows settings schema artifact that the + # arm64 legs of release_windows/release_windows_tui download. if: ${{ inputs.build_windows != false }} timeout-minutes: 150 strategy: @@ -2333,8 +2357,11 @@ jobs: strategy: matrix: include: - - arch: x64 - runner: windows-latest-large + # TEMPORARY TEST SCAFFOLDING (arm64-native-test): the x64 entry is removed from this + # matrix (not gated by `if:`, which cannot see the `matrix` context at the job level) + # to isolate the Windows arm64 job. Restore this entry before merge. + # - arch: x64 + # runner: windows-latest-large - arch: arm64 runner: windows-11-arm env: