chatgpt-on-wechat/.github/workflows/release-win7.yml

name: Release Desktop (Win7 legacy)

# One-off / on-demand build for legacy Windows 7 / 8 / 8.1 users.
#
# The main release pipeline (release.yml) ships Electron 33 (Chromium 130+) and
# a PyInstaller backend built with Python 3.11 — NEITHER runs on Windows 7,
# which is why those users hit "不是有效的 Win32 应用程序" when launching the exe.
#
# To support Win7 we must pin BOTH halves to the last versions that still
# target it:
#   - Electron 22.3.27  (Chromium 108, last major to support Win7/8/8.1)
#   - Python  3.8        (last CPython to support Win7)
#
# This is a SEPARATE, manually-triggered workflow so it never touches the
# production auto-update feed. It produces an unsigned NSIS installer and:
#   - always uploads it as a build artifact (fallback), and
#   - when Cloudflare secrets are present, mirrors it to R2 under a dedicated
#     desktop/win7/ prefix so it can be downloaded fast from cdn.cowagent.ai.
# It deliberately does NOT touch D1 (no release rows, no is_latest) — this is a
# throwaway test build, not a published release. Delete this file whenever Win7
# support is no longer worth maintaining — the main pipeline is unaffected.
#
# IMPORTANT for end users: Win7 must have SP1 + update KB2533623 (or the rollup
# KB4457144) installed, otherwise the Python 3.8 backend still fails to start.

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to stamp (e.g. 2.1.3-win7). Used for package.json and artifact name."
        type: string
        default: "0.0.0-win7"

permissions:
  contents: read

jobs:
  build:
    name: Build Windows x64 (Win7 legacy)
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Python 3.8 is the last CPython that supports Windows 7. A backend built
      # with it (via PyInstaller) still runs on Win7 even though the CI host is
      # Server 2022 — PyInstaller's bootloader targets the interpreter's minimum
      # OS, not the build machine's.
      - name: Set up Python 3.8
        uses: actions/setup-python@v5
        with:
          python-version: "3.8"

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Build Python backend (PyInstaller, Python 3.8)
        shell: bash
        run: |
          python -m pip install --upgrade pip
          # Most deps are unpinned, so pip auto-picks the newest Python-3.8 wheel.
          # But a few are pinned to versions with NO 3.8 wheel and must be relaxed
          # for this legacy build. We rewrite them into a throwaway requirements
          # file so the repo's source stays untouched (main pipeline keeps its
          # pins). playwright 1.48.0 is the last release with a cp38 wheel.
          sed 's/^playwright==.*/playwright==1.48.0/' \
            desktop/build/requirements-desktop.txt > /tmp/requirements-win7.txt
          pip install -r /tmp/requirements-win7.txt
          pip install pyinstaller
          # Run from repo root so the spec's relative datas resolve correctly.
          pyinstaller desktop/build/cowagent-backend.spec \
            --noconfirm \
            --distpath desktop/build/dist \
            --workpath desktop/build/build-work

      - name: Install desktop deps
        working-directory: desktop
        run: npm ci

      - name: Write version into package.json
        working-directory: desktop
        shell: bash
        run: npm version "${{ github.event.inputs.version }}" --no-git-tag-version --allow-same-version

      # Downgrade Electron to the last Win7-capable major (22). --no-save keeps
      # this out of package.json so the repo's committed deps stay on Electron 33
      # for the main pipeline. electron-builder reads the installed Electron
      # version from node_modules, so this is all that's needed to package v22.
      - name: Pin Electron to 22 (last Win7-capable)
        working-directory: desktop
        run: npm install --no-save electron@22.3.27

      - name: Compile (vite + tsc)
        working-directory: desktop
        shell: bash
        run: npm run build

      # Unsigned NSIS x64 build using the base config in package.json (no win
      # sign hook, no R2/D1, no auto-update publish). --publish never still emits
      # the installer. Invoke via node (not npx) to avoid the Windows npx.cmd
      # batch-wrapper returning before the process finishes (see release.yml).
      - name: Build installer (electron-builder, Electron 22)
        working-directory: desktop
        shell: bash
        run: node node_modules/electron-builder/cli.js --win --x64 --publish never

      - name: Upload installer artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cowagent-win7-x64
          path: |
            desktop/release/*.exe
            desktop/release/*.blockmap
          if-no-files-found: warn
          retention-days: 7

  # Mirror the installer to R2 so it downloads fast (GitHub artifacts are
  # painfully slow from China). Mirrors the MAIN pipeline's publish-r2 job:
  # a SEPARATE ubuntu-latest job with NO setup-node, so it uses the runner's
  # built-in Node 22+ and wrangler@latest works (the build job runs Node 20 for
  # Electron, where wrangler@latest — which needs Node >=22 — would abort).
  # Reuses the same cow-skills bucket + cdn.cowagent.ai domain, under a
  # dedicated desktop/win7/<version>/ prefix. NO D1 write: this is an
  # unpublished test build. Skips cleanly when Cloudflare secrets are absent.
  publish-r2:
    name: Publish to R2
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Guard on Cloudflare secrets
        id: guard
        env:
          CF_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
        run: |
          if [ -n "$CF_TOKEN" ]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=false" >> "$GITHUB_OUTPUT"
            echo "::notice::CLOUDFLARE_API_TOKEN not set — skipping R2 upload (use the artifact instead)."
          fi

      - name: Download build artifact
        if: steps.guard.outputs.enabled == 'true'
        uses: actions/download-artifact@v4
        with:
          name: cowagent-win7-x64
          path: dist

      - name: Upload installer to R2
        if: steps.guard.outputs.enabled == 'true'
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          R2_BUCKET: ${{ vars.R2_BUCKET != '' && vars.R2_BUCKET || 'cow-skills' }}
          VER: ${{ github.event.inputs.version }}
        run: |
          shopt -s nullglob
          for f in dist/*.exe; do
            base="$(basename "$f")"
            key="desktop/win7/v${VER}/${base}"
            echo "==> Uploading $base -> r2://${R2_BUCKET}/${key}"
            npx --yes wrangler@latest r2 object put "${R2_BUCKET}/${key}" \
              --file "$f" --remote
            echo "==> Download URL: https://cdn.cowagent.ai/${key}"
          done