chore: native binary distribution via winget (#430)

* chore: create the windows binary, installer and publish to winget

.github/actions/build-binaries/windows/action.yaml

@@ -4,29 +4,87 @@ inputs:
   package_name:
     description: "The name of the package"
     required: true
+  version:
+    description: "The version to use for this artifact"
   artifacts_dir:
     description: "The directory to write artifacts you want to publish"
     required: true
-  version:
-    description: "The version to use for this artifact"
+  production_release:
+    description: "Flag to determine if this is a production release"
+    required: true
+  azure_tenant_id:
+    description: "The Microsoft Entra tenant (directory) ID."
+    required: true
+  azure_client_id:
+    description: "The client (application) ID of an App Registration in the tenant."
+    required: true
+  azure_client_secret:
+    description: "A client secret that was generated for the App Registration."
+    required: true
 
 runs:
   using: "composite"
   steps:
+    - name: Configure build environment
+      shell: bash
+      run: |
+        echo 'C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x64' >> $GITHUB_PATH
+        echo 'BINARY_BUILD_DIR=dist\algokit' >> $GITHUB_ENV
+        echo 'WINGET_INSTALLER=${{ inputs.artifacts_dir }}\${{ inputs.package_name }}-winget.msix' >> $GITHUB_ENV
+
     - name: Build binary
       shell: bash
       run: |
         poetry run poe package_windows
 
-    - name: Package binary artifact
+    - name: Add metadata to binary
+      shell: bash
+      run: |
+        echo winget > '${{ env.BINARY_BUILD_DIR }}\_internal\algokit\resources\distribution-method'
+
+    - name: Sign executable
+      if: ${{ inputs.production_release == 'true' }}
+      uses: azure/[email protected]
+      with:
+        azure-tenant-id: ${{ inputs.azure_tenant_id }}
+        azure-client-id: ${{ inputs.azure_client_id }}
+        azure-client-secret: ${{ inputs.azure_client_secret }}
+        endpoint: https://weu.codesigning.azure.net/
+        trusted-signing-account-name: algokit-signing
+        certificate-profile-name: algokit
+        files-folder: ${{ env.BINARY_BUILD_DIR }}
+        files-folder-filter: exe
+        file-digest: SHA256
+        timestamp-rfc3161: http://timestamp.acs.microsoft.com
+        timestamp-digest: SHA256
+
+    - name: Build winget installer
       shell: pwsh
       run: |
-        Set-Location -Path dist\algokit\
-        tar -zcf ${{ inputs.artifacts_dir }}\${{ inputs.package_name }}.tar.gz *
-        Set-Location -Path ..\..
+        & .\scripts\winget\build-installer.ps1 `
+          -binaryDir '${{ env.BINARY_BUILD_DIR }}' `
+          -releaseVersion '${{ inputs.version }}' `
+          -outputFile '${{ env.WINGET_INSTALLER }}'
+
+    - name: Sign winget installer
+      if: ${{ inputs.production_release == 'true' }}
+      uses: azure/[email protected]
+      with:
+        azure-tenant-id: ${{ inputs.azure_tenant_id }}
+        azure-client-id: ${{ inputs.azure_client_id }}
+        azure-client-secret: ${{ inputs.azure_client_secret }}
+        endpoint: https://weu.codesigning.azure.net/
+        trusted-signing-account-name: algokit-signing
+        certificate-profile-name: algokit
+        files-folder: ${{ env.WINGET_INSTALLER }}
+        files-folder-filter: msix
+        file-digest: SHA256
+        timestamp-rfc3161: http://timestamp.acs.microsoft.com
+        timestamp-digest: SHA256
 
-    - name: Upload binary artifact
+    - name: Upload winget artifact
       uses: actions/upload-artifact@v4
       with:
-        name: ${{ inputs.package_name }}
-        path: ${{ inputs.artifacts_dir }}\${{ inputs.package_name }}.tar.gz
+        name: ${{ inputs.package_name }}-winget
+        path: ${{ env.WINGET_INSTALLER }}
+        if-no-files-found: error

.github/workflows/build-binaries.yaml

@@ -66,6 +66,10 @@ jobs:
           package_name: ${{ env.PACKAGE_NAME }}
           version: ${{ env.RELEASE_VERSION }}
           artifacts_dir: ${{ env.ARTIFACTS_DIR }}
+          production_release: ${{ inputs.production_release }}
+          azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }}
 
       - name: Build linux binary
         if: ${{ runner.os == 'Linux' }}

.github/workflows/publish-release-packages.yaml

@@ -22,6 +22,11 @@ on:
         default: true
         type: boolean
         description: "Publish to snap repository"
+      do_winget:
+        required: false
+        default: true
+        type: boolean
+        description: "Publish to Winget repository"
   workflow_dispatch:
     inputs:
       release:
@@ -38,6 +43,11 @@ on:
         default: true
         type: boolean
         description: "Publish to Chocolatey repository"
+      do_winget:
+        required: false
+        default: true
+        type: boolean
+        description: "Publish to Winget repository"
       do_snap:
         required: false
         default: true
@@ -114,6 +124,20 @@ jobs:
         with:
           args: push --source https://push.chocolatey.org/
 
+  publish-winget:
+    runs-on: windows-latest
+    if: ${{ inputs.do_winget }}
+    steps:
+      - name: Publish to winget
+        shell: pwsh
+        env:
+          WINGET_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
+        run: |
+          echo 'Publishing to winget'
+          # The below can be uncommented after we've manually created the first release on winget
+          # & .\scripts\winget\update-package.ps1 `
+          #   -releaseVersionTag '${{ inputs.release }}'
+
   publish-snap:
     runs-on: ubuntu-latest
     if: ${{ inputs.do_snap }}

pyproject.toml

@@ -27,7 +27,7 @@ aiohttp = "3.9.5"
 jsondiff = "^2.0.0"
 
 [tool.poetry.group.dev.dependencies]
-pyinstaller = {version = "^6.3.0"}
+pyinstaller = {version = "^6.9.0"}
 pytest = "^7.2.0"
 ruff = ">=0.1.6,<0.5.0"
 pip-audit = "^2.4.7"

scripts/winget/build-installer.ps1

@@ -0,0 +1,56 @@
+Param(
+  [Parameter(Mandatory = $true)]
+  [String]
+  $binaryDir,
+
+  [Parameter(Mandatory = $false)]
+  [AllowEmptyString()]
+  [String]
+  $releaseVersion,
+
+  [Parameter(Mandatory = $true)]
+  [String]
+  $outputFile
+)
+
+Function ThrowOnNonZeroExit {
+  Param( [String]$Message )
+  If ($LastExitCode -ne 0) {
+    Throw $Message
+  }
+}
+
+$ErrorActionPreference = 'Stop'
+
+Remove-Item -Path build -Recurse -ErrorAction Ignore
+$buildDir = New-Item -ItemType Directory -Path .\build\winget\installer
+$installerContentDir = '.\scripts\winget\installer'
+
+# Add installer assets
+$assetsDir = New-Item -ItemType Directory -Path (Join-Path $buildDir assets)
+Copy-Item -Path "$installerContentDir\assets\*" -Destination $assetsDir -Recurse | Out-Null
+
+# Add manifest file
+$version = if ($releaseVersion) { 
+  # Strip the pre-release meta, as it's not valid
+  $releaseVersion -replace '-\w+|\+.+$', ''
+}
+else {
+  '0.0.1'
+} 
+(Get-Content (Resolve-Path "$installerContentDir\AppxManifest.xml")).Replace('0.0.1.0', $("$version.0")) | Set-Content (Join-Path $buildDir AppxManifest.xml)
+
+# Generate pri resource map for installer assets
+$priConfig = (Resolve-Path "$installerContentDir\priconfig.xml")
+Push-Location $buildDir
+makepri new /ProjectRoot $buildDir /ConfigXml $priConfig | Out-Null
+ThrowOnNonZeroExit "Failed to create pri file"
+Pop-Location
+
+# Add algokit binaries
+Copy-Item -Path (Join-Path $binaryDir *) -Destination $buildDir -Recurse | Out-Null
+
+# Generate msix
+makeappx pack /o /h SHA256 /d $buildDir /p $outputFile | Out-Null
+ThrowOnNonZeroExit "Failed to build msix"
+

scripts/winget/installer/AppxManifest.xml

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10" xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10" xmlns:uap10="http://schemas.microsoft.com/appx/manifest/uap/windows10/10" xmlns:uap3="http://schemas.microsoft.com/appx/manifest/uap/windows10/3" xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities" xmlns:desktop="http://schemas.microsoft.com/appx/manifest/desktop/windows10" IgnorableNamespaces="uap uap3 uap10 desktop rescap">
+  <Identity Name="algokit" Publisher="CN=Algorand Foundation, O=Algorand Foundation, L=Singapore, C=SG" Version="0.0.1.0" ProcessorArchitecture="x64" />
+  <Properties>
+    <DisplayName>AlgoKit</DisplayName>
+    <PublisherDisplayName>Algorand Foundation</PublisherDisplayName>
+    <Description>The Algorand AlgoKit CLI is the one-stop shop tool for developers building on the Algorand network.</Description>
+    <Logo>assets\Square70x70Logo.png</Logo>
+  </Properties>
+  <Resources>
+    <Resource Language="en-us" />
+  </Resources>
+  <Dependencies>
+    <TargetDeviceFamily Name="Windows.Universal" MinVersion="10.0.17763.0" MaxVersionTested="10.0.22000.0" />
+  </Dependencies>
+  <Applications>
+    <Application Id="algokit" Executable="algokit.exe" EntryPoint="Windows.FullTrustApplication">
+      <uap:VisualElements BackgroundColor="transparent" DisplayName="Algorand AlgoKit CLI" Square150x150Logo="assets\Square150x150Logo.png" Square44x44Logo="assets\Square44x44Logo.png" Description="The Algorand AlgoKit CLI is the one-stop shop tool for developers building on the Algorand network.">
+        <uap:DefaultTile ShortName="AlgoKit" Square71x71Logo="assets\Square70x70Logo.png" />
+      </uap:VisualElements>
+      <Extensions>
+        <uap3:Extension Category="windows.appExecutionAlias">
+          <uap3:AppExecutionAlias>
+            <desktop:ExecutionAlias Alias="algokit.exe" />
+          </uap3:AppExecutionAlias>
+        </uap3:Extension>
+      </Extensions>
+    </Application>
+  </Applications>
+  <Capabilities>
+    <rescap:Capability Name="runFullTrust" />
+  </Capabilities>
+</Package>

scripts/winget/installer/priconfig.xml

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<resources targetOsVersion="10.0.0" majorVersion="1">
+	<packaging>
+		<autoResourcePackage qualifier="Language"/>
+		<autoResourcePackage qualifier="Scale"/>
+		<autoResourcePackage qualifier="DXFeatureLevel"/>
+	</packaging>
+	<index root="\" startIndexAt="\">
+		<default>
+			<qualifier name="Language" value="en-US"/>
+			<qualifier name="Contrast" value="standard"/>
+			<qualifier name="Scale" value="100"/>
+			<qualifier name="HomeRegion" value="001"/>
+			<qualifier name="TargetSize" value="256"/>
+			<qualifier name="LayoutDirection" value="LTR"/>
+			<qualifier name="Theme" value="dark"/>
+			<qualifier name="AlternateForm" value=""/>
+			<qualifier name="DXFeatureLevel" value="DX9"/>
+			<qualifier name="Configuration" value=""/>
+			<qualifier name="DeviceFamily" value="Universal"/>
+			<qualifier name="Custom" value=""/>
+		</default>
+		<indexer-config type="folder" foldernameAsQualifier="true" filenameAsQualifier="true" qualifierDelimiter="."/>
+		<indexer-config type="resw" convertDotsToSlashes="true" initialPath=""/>
+		<indexer-config type="resjson" initialPath=""/>
+		<indexer-config type="PRI"/>
+	</index>
+	<!--<index startIndexAt="Start Index Here" root="Root Here">-->
+	<!--        <indexer-config type="resfiles" qualifierDelimiter="."/>-->
+	<!--        <indexer-config type="priinfo" emitStrings="true" emitPaths="true" emitEmbeddedData="true"/>-->
+	<!--</index>-->
+</resources>

scripts/winget/update-package.ps1

@@ -0,0 +1,23 @@
+Param(
+  [Parameter(Mandatory=$true)]
+  [String]
+  $releaseVersionTag
+)
+
+Function ThrowOnNonZeroExit {
+  Param( [String]$Message )
+  If ($LastExitCode -ne 0) {
+    Throw $Message
+  }
+}
+
+$wingetPackage = 'AlgorandFoundation.AlgoKit'
+$release = Invoke-RestMethod -uri "https://api.github.com/repos/algorandfoundation/algokit-cli/releases/tags/$releaseVersionTag"
+$installerUrl = $release | Select -ExpandProperty assets -First 1 | Where-Object -Property name -match '-windows_x64-winget\.msix$' | Select -ExpandProperty browser_download_url
+$releaseVersion = $releaseVersionTag.Trim("v")
+
+$wingetDir = New-Item -Force -ItemType Directory -Path .\build\winget
+$wingetExecutable = "$wingetDir\wingetcreate.exe"
+Invoke-WebRequest https://aka.ms/wingetcreate/latest -OutFile $wingetExecutable
+& $wingetExecutable update $wingetPackage -s -v $releaseVersion -u "$installerUrl" -t "$env:WINGET_GITHUB_TOKEN"
+ThrowOnNonZeroExit "Failed to update winget package"