Fix windows velopack package creation in GHA

Potential fix for pull request finding 'CodeQL / Workflow does not contain permissions'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: RyeMutt

.github/workflows/build.yaml

@@ -26,6 +26,9 @@ on:
     branches: ["main", "release/*", "beta/*", "project/*"]
     tags: ["Alchemy*"]
 
+permissions:
+  contents: read
+
 jobs:
   # The whole point of the setup job is that we want to set variables once
   # that will be consumed by multiple subsequent jobs.
@@ -56,7 +59,7 @@ jobs:
       - name: Setup python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
 
       - name: Determine source branch
         id: which-branch
@@ -138,7 +141,7 @@ jobs:
         runner: ["windows-2025-vs2026", "macos-26", "ubuntu-24.04"]
         configuration: [release]
         arch: [x64, arm64]
-        build_variant: [Viewer, Tests]
+        build_variant: [Viewer]
         exclude:
           - runner: ubuntu-24.04
             arch: arm64
@@ -160,10 +163,13 @@ jobs:
       # Windows Velopack outputs (passed to sign-pkg-windows)
       velopack_pack_id:       ${{ steps.build.outputs.velopack_pack_id }}
       velopack_pack_version:  ${{ steps.build.outputs.velopack_pack_version }}
+      velopack_pack_authors:  ${{ steps.build.outputs.velopack_pack_authors }}
       velopack_pack_title:    ${{ steps.build.outputs.velopack_pack_title }}
       velopack_main_exe:      ${{ steps.build.outputs.velopack_main_exe }}
       velopack_exclude:       ${{ steps.build.outputs.velopack_exclude }}
       velopack_icon:          ${{ steps.build.outputs.velopack_icon }}
+      velopack_splash:        ${{ steps.build.outputs.velopack_splash }}
+      velopack_splash_color:  ${{ steps.build.outputs.velopack_splash_color }}
       velopack_installer_base: ${{ steps.build.outputs.velopack_installer_base }}
       # macOS Velopack outputs (passed to sign-pkg-mac)
       velopack_mac_pack_id:      ${{ steps.build.outputs.velopack_mac_pack_id }}
@@ -254,14 +260,6 @@ jobs:
       - name: Install python dependencies
         run: pip3 install llsd cmake ninja
 
-      - name: Setup .NET for Velopack
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: '10.x'
-
-      - name: Install Velopack CLI
-        run: dotnet tool restore
-
       - name: Bootstrap vcpkg Windows
         if: runner.os == 'Windows'
         run: |
@@ -472,34 +470,116 @@ jobs:
       #       ${{ steps.configure.outputs.build_directory }}/llappearanceutility/Release/appearance-utility-bin
       #       ${{ steps.configure.outputs.build_directory }}/llappearanceutility/Release/appearance-utility-headless-bin
 
-  # sign-and-package-windows:
-  #   env:
-  #     AZURE_KEY_VAULT_URI: ${{ secrets.AZURE_KEY_VAULT_URI }}
-  #     AZURE_CERT_NAME: ${{ secrets.AZURE_CERT_NAME }}
-  #     AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-  #     AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-  #     AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-  #   needs: [setup, build]
-  #   runs-on: windows-2022
-  #   if: needs.setup.outputs.build_type == 'proprietary'
-  #   steps:
-  #     - name: Sign and package Windows viewer
-  #       if: env.AZURE_KEY_VAULT_URI && env.AZURE_CERT_NAME && env.AZURE_CLIENT_ID && env.AZURE_CLIENT_SECRET && env.AZURE_TENANT_ID
-  #       uses: secondlife/viewer-build-util/sign-pkg-windows@geenz/velopack
-  #       with:
-  #         vault_uri: "${{ env.AZURE_KEY_VAULT_URI }}"
-  #         cert_name: "${{ env.AZURE_CERT_NAME }}"
-  #         client_id: "${{ env.AZURE_CLIENT_ID }}"
-  #         client_secret: "${{ env.AZURE_CLIENT_SECRET }}"
-  #         tenant_id: "${{ env.AZURE_TENANT_ID }}"
-  #         installer_type: "${{ github.event.inputs.installer_type || 'velopack' }}"
-  #         velopack_pack_id: "${{ needs.build.outputs.velopack_pack_id }}"
-  #         velopack_pack_version: "${{ needs.build.outputs.velopack_pack_version }}"
-  #         velopack_pack_title: "${{ needs.build.outputs.velopack_pack_title }}"
-  #         velopack_main_exe: "${{ needs.build.outputs.velopack_main_exe }}"
-  #         velopack_exclude: "${{ needs.build.outputs.velopack_exclude }}"
-  #         velopack_icon: "${{ needs.build.outputs.velopack_icon }}"
-  #         velopack_installer_base: "${{ needs.build.outputs.velopack_installer_base }}"
+  sign-and-package-windows:
+    needs: [setup, build]
+    runs-on: windows-2025
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          submodules: recursive
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Setup .NET for Velopack
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: '10.x'
+
+      - name: Install Velopack CLI
+        run: dotnet tool restore
+
+      - name: Fetch Windows app
+        uses: actions/download-artifact@v8
+        if: needs.setup.outputs.build_type == 'proprietary'
+        with:
+          name: Windows-x64-app
+          path: .app
+
+      - name: Fetch Windows OS app
+        uses: actions/download-artifact@v8
+        if: needs.setup.outputs.build_type != 'proprietary'
+        with:
+          name: Windows-OS-x64-app
+          path: .app
+
+      - name: Build and sign Velopack package
+        shell: bash
+        env:
+          PACK_ID: ${{ needs.build.outputs.velopack_pack_id }}
+          PACK_VERSION: ${{ needs.build.outputs.velopack_pack_version }}
+          PACK_TITLE: ${{ needs.build.outputs.velopack_pack_title }}
+          PACK_AUTHORS: ${{ needs.build.outputs.velopack_pack_authors }}
+          MAIN_EXE: ${{ needs.build.outputs.velopack_main_exe }}
+          EXCLUDE: ${{ needs.build.outputs.velopack_exclude }}
+          ICON: ${{ needs.build.outputs.velopack_icon }}
+          SPLASH_IMAGE: ${{ needs.build.outputs.velopack_splash }}
+          SPLASH_COLOR: ${{ needs.build.outputs.velopack_splash_color }}
+          INSTALLER_BASE: ${{ needs.build.outputs.velopack_installer_base }}
+        run: |
+          set -x
+
+          vpk_args=(
+            vpk pack
+            --packId "$PACK_ID"
+            --packVersion "$PACK_VERSION"
+            --packAuthors "$PACK_AUTHORS"
+            --packDir .app
+            --mainExe "$MAIN_EXE"
+            --packTitle "$PACK_TITLE"
+            --exclude "$EXCLUDE"
+            --shortcuts ''
+            --splashProgressColor "$SPLASH_COLOR"
+          )
+
+          # Add icon if provided
+          if [[ -n "$ICON" && -f ".app/$ICON" ]]; then
+            vpk_args+=(--icon ".app/$ICON")
+          fi
+
+          # Add splash if provided
+          if [[ -n "$SPLASH_IMAGE" && -f ".app/$SPLASH_IMAGE" ]]; then
+            vpk_args+=(--splashImage ".app/$SPLASH_IMAGE")
+          fi
+
+          "${vpk_args[@]}"
+
+      - name: Rename Velopack outputs
+        shell: bash
+        env:
+          PACK_ID: ${{ needs.build.outputs.velopack_pack_id }}
+          INSTALLER_BASE: ${{ needs.build.outputs.velopack_installer_base }}
+        run: |
+          # Move Setup.exe into .app for the installer upload step
+          setup="Releases/${PACK_ID}-win-Setup.exe"
+          if [[ -f "$setup" ]]; then
+            mv "$setup" ".app/${INSTALLER_BASE}_Setup.exe"
+            echo "Moved $setup to .app/${INSTALLER_BASE}_Setup.exe"
+          fi
+
+          # Rename Portable.zip to include version
+          portable="Releases/${PACK_ID}-win-Portable.zip"
+          if [[ -f "$portable" ]]; then
+            mv "$portable" "Releases/${INSTALLER_BASE}_Portable.zip"
+            echo "Moved $portable to Releases/${INSTALLER_BASE}_Portable.zip"
+          fi
+
+      - name: Find Velopack installer
+        shell: bash
+        run: |
+          installer="$(ls -t .app/*_Setup.exe | head -n 1)"
+          echo "installer=$installer" >> "$GITHUB_ENV"
+
+      - name: Post the installer
+        uses: actions/upload-artifact@v7
+        with:
+          name: "Windows-installer"
+          path: ${{ env.installer }}
+
+      - name: Upload Velopack releases
+        uses: actions/upload-artifact@v7
+        with:
+          name: "Windows-releases"
+          path: Releases/
 
   # sign-and-package-mac:
   #   env:
@@ -610,60 +690,43 @@ jobs:
   #         node-version: "22"
   #         dumpSyms: false
 
-  # release:
-  #   needs: [setup, build, sign-and-package-windows, sign-and-package-mac]
-  #   runs-on: ubuntu-latest
-  #   if: needs.setup.outputs.release_run
-  #   steps:
-  #     # - uses: actions/download-artifact@v8
-  #     #   with:
-  #     #     pattern: "*-installer"
-
-  #     - uses: actions/download-artifact@v8
-  #       with:
-  #         pattern: "*-metadata"
+  release:
+    needs: [setup, build, sign-and-package-windows]
+    runs-on: ubuntu-latest
+    if: needs.setup.outputs.release_run
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: "*-installer"
 
-  #     - uses: actions/download-artifact@v8
-  #       with:
-  #         pattern: "*-releases"
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: "*-releases"
 
-  #     - uses: actions/download-artifact@v8
-  #       with:
-  #         name: "Linux-app"
+      - uses: actions/download-artifact@v8
+        with:
+          name: "Linux-x64-app"
 
-  #     - name: Rename metadata
-  #       run: |
-  #         cp Windows-metadata/newview/viewer_version.txt Windows-viewer_version.txt
-  #         cp macOS-metadata/newview/viewer_version.txt macOS-viewer_version.txt
-  #         cp Linux-metadata/newview/viewer_version.txt Linux-viewer_version.txt
-
-  #     # forked from softprops/action-gh-release
-  #     - name: Create GitHub release
-  #       id: release
-  #       uses: AlchemyViewer/action-gh-release@v2
-  #       with:
-  #         # name the release page for the branch
-  #         name: "${{ needs.setup.outputs.viewer_branch }}"
-  #         # SL-20546: want the channel and version to be visible on the
-  #         # release page
-  #         body: |
-  #           Build ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-  #           ${{ needs.setup.outputs.viewer_channel }}
-  #           ${{ needs.build.outputs.viewer_version }}
-  #           ${{ needs.setup.outputs.relnotes }}
-  #         prerelease: true
-  #         generate_release_notes: true
-  #         target_commitish: ${{ github.sha }}
-  #         append_body: true
-  #         fail_on_unmatched_files: true
-  #         files: |
-  #           macOS-installer/*.dmg
-  #           Windows-installer/*.exe
-  #           *.tar.xz
-  #           *-viewer_version.txt
-  #           Windows-releases/*
-  #           macOS-releases/*
-
-  #     - name: post release URL
-  #       run: |
-  #         echo "::notice::Release ${{ steps.release.outputs.url }}"
+      # forked from softprops/action-gh-release
+      - name: Create GitHub release
+        id: release
+        uses: AlchemyViewer/action-gh-release@v3
+        with:
+          # name the release page for the branch. We want channel and version.
+          name: "${{ needs.setup.outputs.viewer_channel }} ${{ needs.build.outputs.viewer_version }}"
+          body: |
+          prerelease: true
+          generate_release_notes: true
+          target_commitish: ${{ github.sha }}
+          append_body: true
+          fail_on_unmatched_files: true
+          files: |
+            Windows-installer/*.exe
+            *.tar.xz
+            Windows-releases/*
+
+      - name: post release URL
+        run: |
+          echo "::notice::Release ${{ steps.release.outputs.url }}"

dotnet-tools.json

@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "vpk": {
-      "version": "1.1.1",
+      "version": "1.2.0",
       "commands": [
         "vpk"
       ],

indra/newview/viewer_manifest.py

@@ -270,16 +270,6 @@ def installer_base_name(self):
             }
         return "%(channel_vendor_base)s%(channel_variant_underscores)s_%(version_underscores)s_%(arch)s" % substitution_strings
 
-    def installer_base_name_mac(self):
-        global CHANNEL_VENDOR_BASE
-        # a standard map of strings for replacing in the templates
-        substitution_strings = {
-            'channel_vendor_base' : '_'.join(CHANNEL_VENDOR_BASE.split()),
-            'channel_variant_underscores':self.channel_variant_app_suffix(),
-            'version_underscores' : '_'.join(self.args['version'])
-            }
-        return "%(channel_vendor_base)s%(channel_variant_underscores)s_%(version_underscores)s_universal" % substitution_strings
-
     def app_name(self):
         global CHANNEL_VENDOR_BASE
         channel_type=self.channel_type()
@@ -554,6 +544,12 @@ def package_finish(self):
         if self.args.get('velopack', 'OFF').upper() != 'ON' and self.args.get('velopack', 'OFF').upper() != 'TRUE' and self.args.get('velopack', 'OFF').upper() != '1':
             return
 
+        # Velopack packaging author metadata. This is the "Authors" field in the Velopack installer.
+        pack_authors = 'Alchemy Viewer Project'
+
+        # Velopack splash progress bar color
+        splash_color = '#00a5dc'
+
         # packId determines install folder: %LocalAppData%\{packId}
         # Uses same naming as NSIS INSTNAME for channel separation
         pack_id = self.app_name_oneword()  # "SecondLife", "SecondLifeBeta", etc.
@@ -600,9 +596,11 @@ def package_finish(self):
             self.set_github_output('velopack_pack_id', pack_id)
             self.set_github_output('velopack_pack_version', pack_version)
             self.set_github_output('velopack_pack_title', pack_title)
+            self.set_github_output('velopack_pack_authors', pack_authors)
             self.set_github_output('velopack_main_exe', main_exe)
             self.set_github_output('velopack_icon', icon_filename)
             self.set_github_output('velopack_splash', splash_filename)
+            self.set_github_output('velopack_splash_color', splash_color)
             self.set_github_output('velopack_installer_base', installer_base)
             self.set_github_output('velopack_exclude', exclude_pattern)
             # Set package_file so llmanifest's touched.bat logic doesn't crash
@@ -615,6 +613,7 @@ def package_finish(self):
             'dotnet', 'vpk', 'pack',
             '--packId', pack_id,
             '--packVersion', pack_version,
+            '--packAuthors', pack_authors,
             '--packDir', pack_dir,
             '--mainExe', main_exe,
             '--packTitle', pack_title,
@@ -624,7 +623,7 @@ def package_finish(self):
             '--shortcuts', '',
             '--outputDir', os.path.join(self.args['build'], 'Releases'),
             '--splashImage', splash_path,
-            '--splashProgressColor', '#00a5dc',
+            '--splashProgressColor', splash_color,
         ]
 
         # Add icon — CMake copies the channel-appropriate secondlife.ico to res/ll_icon.ico
@@ -859,7 +858,7 @@ def path_optional(src, dst):
         self.package_file = "copied_deps"
 
     def package_finish(self):
-        imagename = self.installer_base_name_mac()
+        imagename = self.installer_base_name()
         self.set_github_output('imagename', imagename)
         finalname = imagename + ".dmg"
         self.package_file = finalname

indra/vcpkg/ports/velopack/portfile.cmake

@@ -2,7 +2,7 @@ vcpkg_from_github(
     OUT_SOURCE_PATH SOURCE_PATH
     REPO velopack/velopack
     REF ${VERSION}
-    SHA512 c12703a623555adc56c0e8f7ea70e789caa616d2d6f2c5a53eda7bf55794feee125b6a97817e17114ccf19ca1b43d377f70b5f417b7c9d2befa9f381c57f9d53
+    SHA512 5f782dcc2a172a90dd3e13130e00e6a2144cb679061cc6e7512029f5fb197a3278a9d5db00f3819ac5cbaa078211c18cee5cc2b0c24bbb8d77bda1825382c002
     HEAD_REF main
 )
 

indra/vcpkg/ports/velopack/vcpkg.json

@@ -1,6 +1,6 @@
 {
   "name": "velopack",
-  "version-string": "1.1.1",
+  "version-string": "1.2.0",
   "description": "Installer and automatic update framework for cross-platform desktop applications",
   "homepage": "https://velopack.io/",
   "license": "MIT"