windows: Publish nightly (#24800)

The installer, uninstaller, and the Zed binary files are all signed
using Microsoft’s newly launched Trusted Signing service. For
demonstration purposes, I have used my own account for the signing
process.

For more information about Trusted Signing, you can refer to the
following links:
- [Microsoft Security Blog: Trusted Signing is in Public
Preview](https://techcommunity.microsoft.com/blog/microsoft-security-blog/trusted-signing-is-in-public-preview/4103457)
- [Overview of Azure Trusted
Signing](https://learn.microsoft.com/en-us/azure/trusted-signing/overview)

**TODO:**

- [x] `InnoSetup` script to setup an installer
- [x] Signing process
- [x] `Open with Zed` in right click context menu (by using sparse
package)
- [x] Integrate with `cli`
  - [x] Implement `cli` (#25412)
  - [x] Pack `cli.exe` into installer
- [x] Implement auto updating (#25734)
  - [x] Pack autoupdater helper into installer
- [x] Implement dock menus
  - [x] Add `Recent Documents` entries (#26369)
  - [x] Make `zed.exe` aware of sigle instance (#25412)
  - [x] Properly handle dock menu events (#26010)
- [x] Handle `zed://***` uri

**Materials needed:**

- [ ] Icons
  - [ ] App icon for all channels (#9571)
- [ ] Associated file icons, at minimum a default icon
([example](https://github.com/microsoft/vscode/tree/main/resources/win32))
  - [ ] Logos for installer wizard
  - [ ] Icons for appx
- [x] Code signing
- [x] Secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET,
ACCOUNT_NAME, CERT_PROFILE_NAME
- [x] Other constants: ENDPOINT, Identity Signature (i.e. `CN=Junkui
Zhang, O=Junkui Zhang, L=Wuhan, S=Hubei, C=CN`)





![屏幕截图 2025-02-13
205132](https://github.com/user-attachments/assets/925ec5b2-c8f4-4f0e-8666-26e30278eb3d)



https://github.com/user-attachments/assets/4f1092b4-90fc-4a47-a868-8f2f1a5d8ad8



Release Notes:

- N/A

---------

Co-authored-by: Kate <kate@zed.dev>
Co-authored-by: localcc <work@localcc.cc>
Co-authored-by: Peter Tripp <peter@zed.dev>
Co-authored-by: Max Brunsfeld <maxbrunsfeld@gmail.com>

.github/actions/install_trusted_signing/action.yml

@@ -0,0 +1,64 @@
+name: "Trusted Signing on Windows"
+description: "Install trusted signing on Windows."
+
+# Modified from https://github.com/Azure/trusted-signing-action
+runs:
+  using: "composite"
+  steps:
+    - name: Set variables
+      id: set-variables
+      shell: "pwsh"
+      run: |
+        $defaultPath = $env:PSModulePath -split ';' | Select-Object -First 1
+        "PSMODULEPATH=$defaultPath" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+
+        "TRUSTED_SIGNING_MODULE_VERSION=0.5.3" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+        "BUILD_TOOLS_NUGET_VERSION=10.0.22621.3233" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+        "TRUSTED_SIGNING_NUGET_VERSION=1.0.53" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+        "DOTNET_SIGNCLI_NUGET_VERSION=0.9.1-beta.24469.1" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+
+    - name: Cache TrustedSigning PowerShell module
+      id: cache-module
+      uses: actions/cache@v4
+      env:
+        cache-name: cache-module
+      with:
+        path: ${{ steps.set-variables.outputs.PSMODULEPATH }}\TrustedSigning\${{ steps.set-variables.outputs.TRUSTED_SIGNING_MODULE_VERSION }}
+        key: TrustedSigning-${{ steps.set-variables.outputs.TRUSTED_SIGNING_MODULE_VERSION }}
+      if: ${{ inputs.cache-dependencies == 'true' }}
+
+    - name: Cache Microsoft.Windows.SDK.BuildTools NuGet package
+      id: cache-buildtools
+      uses: actions/cache@v4
+      env:
+        cache-name: cache-buildtools
+      with:
+        path: ~\AppData\Local\TrustedSigning\Microsoft.Windows.SDK.BuildTools\Microsoft.Windows.SDK.BuildTools.${{ steps.set-variables.outputs.BUILD_TOOLS_NUGET_VERSION }}
+        key: Microsoft.Windows.SDK.BuildTools-${{ steps.set-variables.outputs.BUILD_TOOLS_NUGET_VERSION }}
+      if: ${{ inputs.cache-dependencies == 'true' }}
+
+    - name: Cache Microsoft.Trusted.Signing.Client NuGet package
+      id: cache-tsclient
+      uses: actions/cache@v4
+      env:
+        cache-name: cache-tsclient
+      with:
+        path: ~\AppData\Local\TrustedSigning\Microsoft.Trusted.Signing.Client\Microsoft.Trusted.Signing.Client.${{ steps.set-variables.outputs.TRUSTED_SIGNING_NUGET_VERSION }}
+        key: Microsoft.Trusted.Signing.Client-${{ steps.set-variables.outputs.TRUSTED_SIGNING_NUGET_VERSION }}
+      if: ${{ inputs.cache-dependencies == 'true' }}
+
+    - name: Cache SignCli NuGet package
+      id: cache-signcli
+      uses: actions/cache@v4
+      env:
+        cache-name: cache-signcli
+      with:
+        path: ~\AppData\Local\TrustedSigning\sign\sign.${{ steps.set-variables.outputs.DOTNET_SIGNCLI_NUGET_VERSION }}
+        key: SignCli-${{ steps.set-variables.outputs.DOTNET_SIGNCLI_NUGET_VERSION }}
+      if: ${{ inputs.cache-dependencies == 'true' }}
+
+    - name: Install Trusted Signing module
+      shell: "pwsh"
+      run: |
+        Install-Module -Name TrustedSigning -RequiredVersion ${{ steps.set-variables.outputs.TRUSTED_SIGNING_MODULE_VERSION }} -Force -Repository PSGallery
+      if: ${{ inputs.cache-dependencies != 'true' || steps.cache-module.outputs.cache-hit != 'true' }}

.github/workflows/ci.yml

@@ -411,11 +411,10 @@ jobs:
         with:
           clean: false
 
-      - name: Setup Cargo and Rustup
+      - name: Configure CI
         run: |
-          mkdir -p ${{ env.CARGO_HOME }} -ErrorAction Ignore
-          cp ./.cargo/ci-config.toml ${{ env.CARGO_HOME }}/config.toml
-          .\script\install-rustup.ps1
+          New-Item -ItemType Directory -Path "./../.cargo" -Force
+          Copy-Item -Path "./.cargo/ci-config.toml" -Destination "./../.cargo/config.toml"
 
       - name: cargo clippy
         run: |
@@ -430,18 +429,9 @@ jobs:
       - name: Limit target directory size
         run: ./script/clear-target-dir-if-larger-than.ps1 250
 
-      # - name: Check dev drive space
-      #   working-directory: ${{ env.ZED_WORKSPACE }}
-      #   # `setup-dev-driver.ps1` creates a 100GB drive, with CI taking up ~45GB of the drive.
-      #   run: ./script/exit-ci-if-dev-drive-is-full.ps1 95
-
-      # Since the Windows runners are stateful, so we need to remove the config file to prevent potential bug.
       - name: Clean CI config file
         if: always()
-        run: |
-          if (Test-Path "${{ env.CARGO_HOME }}/config.toml") {
-            Remove-Item -Path "${{ env.CARGO_HOME }}/config.toml"  -Force
-          }
+        run: Remove-Item -Recurse -Path "./../.cargo" -Force -ErrorAction SilentlyContinue
 
   tests_pass:
     name: Tests Pass
@@ -763,12 +753,67 @@ jobs:
       # excludes the final package to only cache dependencies
       cachix-filter: "-zed-editor-[0-9.]*-nightly"
 
+  bundle-windows-x64:
+    timeout-minutes: 120
+    name: Create a Windows installer
+    runs-on: [self-hosted, Windows, X64]
+    if: ${{ startsWith(github.ref, 'refs/tags/v') || contains(github.event.pull_request.labels.*.name, 'run-bundling') }}
+    needs: [windows_tests]
+    env:
+      AZURE_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }}
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }}
+      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }}
+      ACCOUNT_NAME: ${{ vars.AZURE_SIGNING_ACCOUNT_NAME }}
+      CERT_PROFILE_NAME: ${{ vars.AZURE_SIGNING_CERT_PROFILE_NAME }}
+      ENDPOINT: ${{ vars.AZURE_SIGNING_ENDPOINT }}
+      DIGITALOCEAN_SPACES_ACCESS_KEY: ${{ secrets.DIGITALOCEAN_SPACES_ACCESS_KEY }}
+      DIGITALOCEAN_SPACES_SECRET_KEY: ${{ secrets.DIGITALOCEAN_SPACES_SECRET_KEY }}
+      FILE_DIGEST: SHA256
+      TIMESTAMP_DIGEST: SHA256
+      TIMESTAMP_SERVER: "http://timestamp.acs.microsoft.com"
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          clean: false
+
+      - name: Determine version and release channel
+        working-directory: ${{ env.ZED_WORKSPACE }}
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        run: |
+          # This exports RELEASE_CHANNEL into env (GITHUB_ENV)
+          script/determine-release-channel.ps1
+
+      - name: Install trusted signing
+        uses: ./.github/actions/install_trusted_signing
+
+      - name: Build Zed installer
+        working-directory: ${{ env.ZED_WORKSPACE }}
+        run: script/bundle-windows.ps1
+
+      - name: Upload installer (x86_64) to Workflow - zed (run-bundling)
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        if: contains(github.event.pull_request.labels.*.name, 'run-bundling')
+        with:
+          name: ZedEditorUserSetup-x64-${{ github.event.pull_request.head.sha || github.sha }}.exe
+          path: ${{ env.SETUP_PATH }}
+
+      - name: Upload Artifacts to release
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        if: ${{ !(contains(github.event.pull_request.labels.*.name, 'run-bundling')) && env.RELEASE_CHANNEL == 'preview' }} # upload only preview
+        with:
+          draft: true
+          prerelease: ${{ env.RELEASE_CHANNEL == 'preview' }}
+          files: ${{ env.SETUP_PATH }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   auto-release-preview:
     name: Auto release preview
     if: |
       startsWith(github.ref, 'refs/tags/v')
       && endsWith(github.ref, '-pre') && !endsWith(github.ref, '.0-pre')
-    needs: [bundle-mac, bundle-linux-x86_x64, bundle-linux-aarch64, freebsd]
+    needs: [bundle-mac, bundle-linux-x86_x64, bundle-linux-aarch64, bundle-windows-x64, freebsd]
     runs-on:
       - self-hosted
       - bundle

.github/workflows/release_nightly.yml

@@ -51,6 +51,32 @@ jobs:
       - name: Run tests
         uses: ./.github/actions/run_tests
 
+  windows-tests:
+    timeout-minutes: 60
+    name: Run tests on Windows
+    if: github.repository_owner == 'zed-industries'
+    runs-on: [self-hosted, Windows, X64]
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          clean: false
+
+      - name: Configure CI
+        run: |
+          New-Item -ItemType Directory -Path "./../.cargo" -Force
+          Copy-Item -Path "./.cargo/ci-config.toml" -Destination "./../.cargo/config.toml"
+
+      - name: Run tests
+        uses: ./.github/actions/run_tests_windows
+
+      - name: Limit target directory size
+        run: ./script/clear-target-dir-if-larger-than.ps1 1024
+
+      - name: Clean CI config file
+        if: always()
+        run: Remove-Item -Recurse -Path "./../.cargo" -Force -ErrorAction SilentlyContinue
+
   bundle-mac:
     timeout-minutes: 60
     name: Create a macOS bundle
@@ -213,10 +239,54 @@ jobs:
 
   bundle-nix:
     name: Build and cache Nix package
+    if: false
     needs: tests
     secrets: inherit
     uses: ./.github/workflows/nix.yml
 
+  bundle-windows-x64:
+    timeout-minutes: 60
+    name: Create a Windows installer
+    if: github.repository_owner == 'zed-industries'
+    runs-on: [self-hosted, Windows, X64]
+    needs: windows-tests
+    env:
+      AZURE_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }}
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }}
+      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }}
+      ACCOUNT_NAME: ${{ vars.AZURE_SIGNING_ACCOUNT_NAME }}
+      CERT_PROFILE_NAME: ${{ vars.AZURE_SIGNING_CERT_PROFILE_NAME }}
+      ENDPOINT: ${{ vars.AZURE_SIGNING_ENDPOINT }}
+      DIGITALOCEAN_SPACES_ACCESS_KEY: ${{ secrets.DIGITALOCEAN_SPACES_ACCESS_KEY }}
+      DIGITALOCEAN_SPACES_SECRET_KEY: ${{ secrets.DIGITALOCEAN_SPACES_SECRET_KEY }}
+      FILE_DIGEST: SHA256
+      TIMESTAMP_DIGEST: SHA256
+      TIMESTAMP_SERVER: "http://timestamp.acs.microsoft.com"
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          clean: false
+
+      - name: Set release channel to nightly
+        working-directory: ${{ env.ZED_WORKSPACE }}
+        run: |
+          $ErrorActionPreference = "Stop"
+          $version = git rev-parse --short HEAD
+          Write-Host "Publishing version: $version on release channel nightly"
+          "nightly" | Set-Content -Path "crates/zed/RELEASE_CHANNEL"
+
+      - name: Install trusted signing
+        uses: ./.github/actions/install_trusted_signing
+
+      - name: Build Zed installer
+        working-directory: ${{ env.ZED_WORKSPACE }}
+        run: script/bundle-windows.ps1
+
+      - name: Upload Zed Nightly
+        working-directory: ${{ env.ZED_WORKSPACE }}
+        run: script/upload-nightly.ps1 windows
+
   update-nightly-tag:
     name: Update nightly tag
     if: github.repository_owner == 'zed-industries'
@@ -225,6 +295,7 @@ jobs:
       - bundle-mac
       - bundle-linux-x86
       - bundle-linux-arm
+      - bundle-windows-x64
     steps:
       - name: Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4