From 9429dacac5d6aa053c8ffa212379f7e965494ab2 Mon Sep 17 00:00:00 2001
From: Myx <ludvig_olausson@hotmail.com>
Date: Fri, 14 Aug 2026 10:15:15 +0200
Subject: [PATCH] ci: fix broken windows tool

---
 .gitea/workflows/release-draft.yml | 55 +++++++++++++++++++++++++++---
 tools/deploy-web-apps.ps1          | 10 ++++++
 2 files changed, 61 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/release-draft.yml b/.gitea/workflows/release-draft.yml
index f81ad6b..b0ff4f6 100644
--- a/.gitea/workflows/release-draft.yml
+++ b/.gitea/workflows/release-draft.yml
@@ -249,8 +249,8 @@ jobs:
         run: |
           $projectRoot = $PWD.ProviderPath
           $electronBuilderWorkspace = Join-Path $env:TEMP ([guid]::NewGuid().ToString('N'))
-          $electronBuilderCache = Join-Path $electronBuilderWorkspace 'electron-builder-cache'
-          $electronCache = Join-Path $electronBuilderWorkspace 'electron-cache'
+          $electronBuilderCache = Join-Path $env:LOCALAPPDATA 'electron-builder\Cache'
+          $electronCache = Join-Path $env:LOCALAPPDATA 'electron\Cache'
           $locationPushed = $false
 
           function Invoke-RoboCopy {
@@ -266,21 +266,68 @@ jobs:
             }
           }
 
+          function Initialize-WinCodeSignCache {
+            param(
+              [string]$CacheRoot,
+              [string]$SevenZip
+            )
+
+            # electron-builder downloads winCodeSign for rcedit (icon and version stamping)
+            # even when nothing is signed. Its two darwin symlinks cannot be recreated
+            # without SeCreateSymbolicLinkPrivilege, so seed the cache without them.
+            # The version must match the one app-builder resolves, otherwise it downloads
+            # its own copy and fails on the symlinks again.
+            $version = 'winCodeSign-2.6.0'
+            $target = Join-Path $CacheRoot "winCodeSign\$version"
+
+            if (Test-Path $target) {
+              return
+            }
+
+            $staging = "$target.incomplete"
+            $archive = Join-Path $env:TEMP "$version.7z"
+            $url = "https://github.com/electron-userland/electron-builder-binaries/releases/download/$version/$version.7z"
+
+            Remove-Item $staging -Recurse -Force -ErrorAction SilentlyContinue
+
+            try {
+              $ProgressPreference = 'SilentlyContinue'
+              [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+              Invoke-WebRequest -Uri $url -OutFile $archive -UseBasicParsing
+              & $SevenZip x -bd -y "-o$staging" '-x!darwin' $archive | Out-Null
+
+              if ($LASTEXITCODE -ne 0) {
+                throw "failed to extract $version with exit code $LASTEXITCODE"
+              }
+
+              New-Item -ItemType Directory -Path (Split-Path -Parent $target) -Force | Out-Null
+              Move-Item $staging $target
+            } finally {
+              Remove-Item $archive -Force -ErrorAction SilentlyContinue
+              Remove-Item $staging -Recurse -Force -ErrorAction SilentlyContinue
+            }
+          }
+
           # Stage the packaging inputs into a real short-path directory.
           # electron-builder rejects junction-backed files during asar creation
           # because their resolved path sits outside the package root.
           New-Item -ItemType Directory -Path $electronBuilderWorkspace | Out-Null
-          New-Item -ItemType Directory -Path $electronBuilderCache | Out-Null
-          New-Item -ItemType Directory -Path $electronCache | Out-Null
+          New-Item -ItemType Directory -Path $electronBuilderCache -Force | Out-Null
+          New-Item -ItemType Directory -Path $electronCache -Force | Out-Null
           $env:ELECTRON_BUILDER_CACHE = $electronBuilderCache
           $env:ELECTRON_CACHE = $electronCache
 
           try {
+            Initialize-WinCodeSignCache `
+              -CacheRoot $electronBuilderCache `
+              -SevenZip (Join-Path $projectRoot 'node_modules\7zip-bin\win\x64\7za.exe')
+
             Copy-Item -Path (Join-Path $projectRoot 'package.json') -Destination (Join-Path $electronBuilderWorkspace 'package.json') -Force
             Copy-Item -Path (Join-Path $projectRoot 'package-lock.json') -Destination (Join-Path $electronBuilderWorkspace 'package-lock.json') -Force
             Invoke-RoboCopy (Join-Path $projectRoot 'dist') (Join-Path $electronBuilderWorkspace 'dist')
             Invoke-RoboCopy (Join-Path $projectRoot 'docs-site/build') (Join-Path $electronBuilderWorkspace 'docs-site/build')
             Invoke-RoboCopy (Join-Path $projectRoot 'images') (Join-Path $electronBuilderWorkspace 'images')
+            Invoke-RoboCopy (Join-Path $projectRoot 'tools') (Join-Path $electronBuilderWorkspace 'tools')
             Invoke-RoboCopy (Join-Path $projectRoot 'node_modules') (Join-Path $electronBuilderWorkspace 'node_modules')
 
             Push-Location $electronBuilderWorkspace
diff --git a/tools/deploy-web-apps.ps1 b/tools/deploy-web-apps.ps1
index e571a0b..00eda5c 100644
--- a/tools/deploy-web-apps.ps1
+++ b/tools/deploy-web-apps.ps1
@@ -9,6 +9,16 @@ param(
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+# Reading IIS configuration (redirection.config) and creating sites needs a full
+# administrator token. An interactive logon gets a UAC-filtered one, which fails
+# later with a confusing "cannot retrieve the dynamic parameters" error.
+$currentIdentity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$currentPrincipal = [Security.Principal.WindowsPrincipal]::new($currentIdentity)
+
+if (-not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+  throw "IIS deployment requires an elevated administrator token, but '$($currentIdentity.Name)' does not have one. Add the runner account to the local Administrators group and run the Gitea runner as a Windows service."
+}
+
 try {
   Import-Module WebAdministration -ErrorAction Stop
 } catch {