ci: build Windows Store release artifacts

.github/workflows/windows-store.yml

@@ -0,0 +1,157 @@
+name: Windows Store package
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/windows-store.yml"
+      - "packaging/windows/**"
+      - "assets/windows/**"
+      - "desktopApp/**"
+      - "shared/**"
+      - "crates/vnidrop/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "build.gradle.kts"
+      - "settings.gradle.kts"
+      - "gradle.properties"
+      - "gradle/**"
+      - "gradlew"
+      - "gradlew.bat"
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Release version in MAJOR.MINOR.PATCH form
+        required: true
+        default: "1.0.0"
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: windows-store-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  build-msix:
+    name: Build unsigned Store MSIX (x64)
+    runs-on: windows-2025
+    timeout-minutes: 90
+    env:
+      CARGO_TERM_COLOR: always
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+
+      - name: Set up Rust 1.91
+        shell: pwsh
+        run: |
+          rustup toolchain install 1.91.0-x86_64-pc-windows-msvc --profile minimal
+          rustup default 1.91.0-x86_64-pc-windows-msvc
+          rustc --version --verbose
+          cargo --version
+
+      - name: Cache Cargo
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: windows-x64-cargo-1.91.0-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            windows-x64-cargo-1.91.0-
+
+      - name: Resolve Store version
+        id: version
+        shell: pwsh
+        env:
+          REQUESTED_VERSION: ${{ inputs.version || '1.0.0' }}
+        run: |
+          $version = $env:REQUESTED_VERSION
+          if ($env:GITHUB_REF_TYPE -eq "tag") {
+            if ($env:GITHUB_REF_NAME -notmatch "^v[0-9]+\.[0-9]+\.[0-9]+$") {
+              throw "Store release tags must use vMAJOR.MINOR.PATCH"
+            }
+            $version = $env:GITHUB_REF_NAME.Substring(1)
+          }
+
+          if ($version -notmatch "^[0-9]+\.[0-9]+\.[0-9]+$") {
+            throw "Version must use MAJOR.MINOR.PATCH"
+          }
+          $parts = $version.Split(".")
+          for ($index = 0; $index -lt $parts.Count; $index++) {
+            $part = $parts[$index]
+            $number = 0
+            if (-not [int]::TryParse($part, [ref] $number) -or $number.ToString() -ne $part) {
+              throw "Version components must be canonical integers"
+            }
+            if ($number -lt $(if ($index -eq 0) { 1 } else { 0 }) -or $number -gt 65535) {
+              throw "Version components must be between 0 and 65535, with a non-zero major"
+            }
+          }
+
+          "app=$version" >> $env:GITHUB_OUTPUT
+          "package=$version.0" >> $env:GITHUB_OUTPUT
+
+      - name: Test and build release app image
+        shell: pwsh
+        run: |
+          $arguments = @(
+            ":shared:jvmTest"
+            ":desktopApp:createReleaseDistributable"
+            "-Pvnidrop.version=${{ steps.version.outputs.app }}"
+            "-Pvnidrop.desktop.rustVariant=release"
+            "-Pvnidrop.diagnostics.included=false"
+            "--no-daemon"
+            "--no-configuration-cache"
+            "--stacktrace"
+          )
+          & .\gradlew.bat @arguments
+          if ($LASTEXITCODE -ne 0) {
+            throw "Gradle release build failed with exit code $LASTEXITCODE"
+          }
+
+      - name: Create and validate Store package
+        shell: pwsh
+        run: |
+          $arguments = @(
+            "-Version", "${{ steps.version.outputs.app }}"
+            "-AppImage", ".\desktopApp\build\compose\binaries\main-release\app\VniDrop"
+            "-OutputDirectory", ".\build\release\windows"
+          )
+          & .\packaging\windows\build-msix.ps1 @arguments
+
+      - name: Upload Store artifacts
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vnidrop-${{ steps.version.outputs.app }}-windows-store-x64
+          path: build/release/windows/
+          if-no-files-found: error
+          retention-days: 90
+          compression-level: 0
+
+      - name: Summarize package
+        shell: pwsh
+        run: |
+          "### Windows Store package" >> $env:GITHUB_STEP_SUMMARY
+          "- App version: ${{ steps.version.outputs.app }}" >> $env:GITHUB_STEP_SUMMARY
+          "- MSIX version: ${{ steps.version.outputs.package }}" >> $env:GITHUB_STEP_SUMMARY
+          "- Architecture: x64" >> $env:GITHUB_STEP_SUMMARY
+          "- Signing: unsigned Store submission; Microsoft signs after certification" >> $env:GITHUB_STEP_SUMMARY