Fix Windows CI: harden OpenSSL install retry and make CPack resilient to missing OpenSSL files

[Copilot]

Chocolatey transient 504s on openssl.light left OPENSSL_ROOT=C:\OpenSSL unconditionally set in GITHUB_ENV, causing CPack to hard-fail when it couldn't find the binaries that never got installed.

.github/workflows/ci.yml

• Wrap choco install openssl.light in a retry loop (3 attempts, 20 s back-off) to survive transient feed timeouts
• Only write OPENSSL_ROOT to GITHUB_ENV when C:\OpenSSL\bin\openssl.exe is actually present after installation

$max = 3
for ($i = 1; $i -le $max; $i++) {
  try {
    choco install openssl.light -y --params "/InstallDir:$installDir"
    break
  } catch {
    if ($i -eq $max) { throw }
    Write-Host "OpenSSL install failed (attempt $i/$max). Retrying in 20s..."
    Start-Sleep -Seconds 20
  }
}
if (Test-Path "$installDir\bin\openssl.exe") {
  "OPENSSL_ROOT=$installDir" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
}

src/CMakeLists.txt

• Guard the Windows install(FILES ...) block with if(EXISTS ...) checks on all three OpenSSL files (openssl.exe, libcrypto-3-x64.dll, libssl-3-x64.dll)
• Emit message(WARNING ...) and skip bundling when files are absent, so CPack completes rather than errors out
• No change to macOS/Linux install logic

Original prompt

Repo: Range-Software/range-fea

Goal: Fix failing Windows GitHub Actions job by implementing both:

1. Harden the Windows OpenSSL install step in the workflow to retry Chocolatey and only export OPENSSL_ROOT when the expected files exist.
2. Harden the CMake install rules on Windows to only install/bundle OpenSSL files when they exist; otherwise emit a warning and continue packaging.

Context:

• Failing job: https://github.com/Range-Software/range-fea/actions/runs/25056913394/job/73399693778#step:19:692
• Failure shows Chocolatey install of openssl.light fails with 504 Gateway Timeout; later CPack install fails with: file INSTALL cannot find "C:/OpenSSL/bin/openssl.exe" (and dlls).

Required changes:
A) Update .github/workflows/ci.yml

• Modify the existing step "Install OpenSSL (Windows)" (currently uses choco install openssl.light -y --params "/InstallDir:C:\OpenSSL" || echo ... and always writes OPENSSL_ROOT=C:\OpenSSL to GITHUB_ENV).
• Replace with a PowerShell script that:
  • retries choco install openssl.light up to 3 times with a delay (e.g., 20s) on failure.
  • after install attempts, checks for C:\OpenSSL\bin\openssl.exe.
  • only writes OPENSSL_ROOT=C:\OpenSSL to $env:GITHUB_ENV if the file exists; otherwise logs that OpenSSL is not present and does not set OPENSSL_ROOT.
  • Prefer $ErrorActionPreference='Stop' and proper try/catch.

B) Update src/CMakeLists.txt

• In the WIN32 install section, replace the simple if(OPENSSL_ROOT) install(FILES ...) logic with existence checks:
  • define variables for ${OPENSSL_ROOT}/bin/openssl.exe, ${OPENSSL_ROOT}/bin/libcrypto-3-x64.dll, ${OPENSSL_ROOT}/bin/libssl-3-x64.dll
  • only call install(FILES ...) if all three exist.
  • else emit a message(WARNING ...) indicating OPENSSL_ROOT is set but files are missing and OpenSSL bundling is being skipped.
• Ensure the change does not affect macOS/Linux logic.

Acceptance criteria:

• Windows CI no longer fails packaging solely due to Chocolatey transient failures.
• When OpenSSL is installed and the files exist, OpenSSL is still bundled into the installer.
• When OpenSSL is not installed, CPack still completes (with a warning) and packages without OpenSSL.

Please create a PR with these changes.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Please find a solution for this failing job. Use the logs, job definition, and any referenced files where the failure occurred. Keep your response focused on the solution and include code suggestions when appropriate.

Assistant: The Windows job is failing during packaging/install because the workflow’s OpenSSL install step is unreliable (Chocolatey feed timeout), and your CMake install rules assume OpenSSL files exist at C:\OpenSSL\bin\.... When Chocolatey fails, OPENSSL_ROOT still gets set to C:\OpenSSL, so CPack later tries to install:

• C:/OpenSSL/bin/openssl.exe
• C:/OpenSSL/bin/libcrypto-3-x64.dll
• C:/OpenSSL/bin/libssl-3-x64.dll

…and errors out in cmake_install.cmake with messages like: file INSTALL cannot find "C:/OpenSSL/bin/openssl.exe".

Fix: make OpenSSL “presence” explicit and only install it when the files actually exist

1) Harden the workflow OpenSSL step (Windows)

Replace the current Windows OpenSSL step in .github/workflows/ci.yml (lines ~80–86 in the log-referenced file) with a version that:

• retries Chocolatey (handles transient 504s),
• and only exports OPENSSL_ROOT if the expected binaries exist.

- name: Install OpenSSL (Windows)
  if: startsWith(matrix.os, 'windows-')
  shell: pwsh
  run: |
    $ErrorActionPreference = 'Stop'
    $installDir = 'C:\OpenSSL'

    # Try a few times to avoid transient Chocolatey/NuGet 504s
    $max = 3
    for ($i = 1; $i -le $max; $i++) {
      try {
        choco install openssl.light -y --params "/InstallDir:$installDir"
        break
      } catch {
        if ($i -eq $max) { throw }
        Write-Host "OpenSSL install failed (attempt $i/$max). Retrying in 20s..."
        Start-Sleep -Seconds 20
      }
    }

    # Only set OPENSSL_ROOT if files are really present
    if (Test-Path "$installDir\bin\openssl.exe") {
      "OPENSSL_ROOT=$installDir" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
    } else {
      Write-Host "OpenSSL not found at $installDir; not setting OPENSSL_ROOT."
    }

Why this helps: it prevents “lying” to CMake/CPack about OPENSSL_ROOT when the install didn’t actually succeed.

2) Harden the CMake install rules on Windows

In src/CMakeLists.txt, you currently do:

if(OPENSSL_ROOT)
    install(FILES ${OPENSSL_ROOT}/bin/openssl.exe DESTINATION bin COMPONENT Application)
    install(FILES ${OPENSSL_ROOT}/bin/libcrypto-3-x64.dll DESTINATION bin COMPONENT Application)
    install(FILES ${OPENSSL_ROOT}/bin/libssl-3-x64.dll DESTINATION bin COMPONENT Application)
endif()

Change this to check file existence before attempting to install, an...

This pull request was created from Copilot chat.