Windows installer hardening: local ARP uninstall, native download/hash, strict registration success

.github/workflows/ci.yml

@@ -12,6 +12,35 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
+  installer-defaults:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Verify installer default extension ID consistency
+        run: |
+          set -euo pipefail
+
+          sh_id=$(sed -n 's/^DEFAULT_EXTENSION_ID="\([a-z0-9]\+\)"$/\1/p' install/install.sh)
+          ps_id=$(sed -n 's/^\$DefaultExtensionId = "\([a-z0-9]\+\)"$/\1/p' install/install.ps1)
+          rs_id=$(sed -n 's/^    const DEFAULT_EXTENSION_ID: &str = "\([a-z0-9]\+\)";$/\1/p' installer/src/main.rs)
+
+          if [[ -z "$sh_id" || -z "$ps_id" || -z "$rs_id" ]]; then
+            echo "Failed to parse one or more default extension IDs"
+            exit 1
+          fi
+
+          if [[ "$sh_id" != "$ps_id" || "$sh_id" != "$rs_id" ]]; then
+            echo "Installer default extension IDs are inconsistent"
+            echo "install.sh: $sh_id"
+            echo "install.ps1: $ps_id"
+            echo "installer/src/main.rs: $rs_id"
+            exit 1
+          fi
+
+          echo "Default extension ID is consistent: $sh_id"
+
   extension:
     runs-on: ubuntu-latest
     defaults:

.github/workflows/release.yml

@@ -97,11 +97,21 @@ jobs:
         run: copy target\release\freemid.exe ${{ matrix.artifact }}
         if: runner.os == 'Windows'
 
+      - name: Collect setup binary (Windows)
+        run: copy target\release\freemid-setup.exe freemid-setup.exe
+        if: runner.os == 'Windows'
+
       - uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact }}
           path: ${{ matrix.artifact }}
 
+      - uses: actions/upload-artifact@v7
+        if: runner.os == 'Windows'
+        with:
+          name: freemid-setup.exe
+          path: freemid-setup.exe
+
   # Create the GitHub release with all artifacts
   release:
     needs: [audit-rust, build-extension, build-native]
@@ -120,6 +130,7 @@ jobs:
           cp artifacts/freemid-macos-arm64/freemid-macos-arm64 .
           cp artifacts/freemid-macos-x86_64/freemid-macos-x86_64 .
           cp artifacts/freemid-windows-x86_64.exe/freemid-windows-x86_64.exe .
+          cp artifacts/freemid-setup.exe/freemid-setup.exe .
           chmod +x freemid-linux-x86_64 freemid-macos-arm64 freemid-macos-x86_64
 
       - name: Generate checksums
@@ -129,9 +140,27 @@ jobs:
             freemid-macos-arm64 \
             freemid-macos-x86_64 \
             freemid-windows-x86_64.exe \
+            freemid-setup.exe \
             freemid-extension.zip \
             > checksums.sha256
 
+      - name: Validate checksum coverage
+        run: |
+          required=(
+            freemid-linux-x86_64
+            freemid-macos-arm64
+            freemid-macos-x86_64
+            freemid-windows-x86_64.exe
+            freemid-setup.exe
+            freemid-extension.zip
+          )
+          for f in "${required[@]}"; do
+            grep -q "[[:space:]]$f$" checksums.sha256 || {
+              echo "Missing checksum entry for $f"
+              exit 1
+            }
+          done
+
       - uses: softprops/action-gh-release@v2
         with:
           prerelease: ${{ contains(github.ref_name, '-') }}
@@ -141,6 +170,7 @@ jobs:
             freemid-macos-arm64
             freemid-macos-x86_64
             freemid-windows-x86_64.exe
+            freemid-setup.exe
             checksums.sha256
             install/install.sh
             install/install.ps1

.github/workflows/windows-artifacts.yml

@@ -0,0 +1,61 @@
+name: Windows Artifacts
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - dev/ux-improvements-auto-update
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  build-windows-artifacts:
+    runs-on: windows-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Cargo
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: windows-artifacts-${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Ensure DISCORD_CLIENT_ID fallback
+        shell: pwsh
+        env:
+          DISCORD_CLIENT_ID: ${{ secrets.DISCORD_CLIENT_ID }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:DISCORD_CLIENT_ID)) {
+            "DISCORD_CLIENT_ID=placeholder-ci-build" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          } else {
+            "DISCORD_CLIENT_ID=$env:DISCORD_CLIENT_ID" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          }
+
+      - name: Build Windows binaries
+        run: cargo build --release -p freemid -p freemid-installer
+
+      - name: Collect artifacts
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Path artifacts -Force | Out-Null
+          Copy-Item target/release/freemid.exe artifacts/freemid-windows-x86_64.exe
+          Copy-Item target/release/freemid-setup.exe artifacts/freemid-setup.exe
+          Copy-Item install/install.ps1 artifacts/install.ps1
+          Copy-Item install/uninstall.ps1 artifacts/uninstall.ps1
+
+      - name: Upload Windows artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: freemid-windows-artifacts-${{ github.sha }}
+          path: artifacts/*

.yamllint

@@ -0,0 +1,9 @@
+extends: default
+
+rules:
+  document-start: disable
+  line-length:
+    max: 140
+    level: warning
+  truthy:
+    check-keys: false