Build the Windows Warp Agent CLI installer in dev releases by kevinyang372 · Pull Request #14476 · warpdotdev/warp

kevinyang372 · 2026-07-29T16:51:40Z

Description

Add a dev-only Windows x64 release job for the Warp Agent CLI Inno installer.

The job builds the real CLI, signs the CLI and Windows runtime payloads with Azure Trusted Signing, signs the setup engine and uninstaller, and uploads the installer and raw PDB as workflow artifacts. Inno signing setup is shared with the existing Windows GUI release job.

Artifact publication remains intentionally disabled. This replaces reference PR #14445 without modifying it.

Depends on #14475.

Implementation plan: https://staging.warp.dev/drive/notebook/BI2TyxneCNDssiTUVIF0iK

Linked Issue

The linked issue is labeled ready-to-spec or ready-to-implement.
Where appropriate, screenshots or a short video of the implementation are included below.

Testing

./script/format
Repository-prescribed split Clippy checks
cargo check -p warp --lib
Release workflow validates the installer fixture, real signed build, shared Inno signing setup, and installer/raw-PDB artifact output
Credentialed non-publishing release validation will be linked after this branch is remotely exercised
I have manually tested my changes locally with ./script/run

Agent Mode

Warp Agent Mode - This PR was created via Warp's AI Agent Mode

CHANGELOG-NONE

Co-Authored-By: Warp agent@warp.dev

kevinyang372 · 2026-07-29T16:51:53Z

This stack of pull requests is managed by Graphite. Learn more about stacking.

oz-for-oss · 2026-07-29T16:54:55Z

@kevinyang372

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

oz-for-oss

Overview

This PR adds a dev-only Windows x64 Warp Agent CLI installer release job, including signing, install/uninstall validation, packaged ConPTY smoke coverage, and failure notification wiring. It also adjusts Windows release environment setup for channel config access and makes Windows PTY spawning retry without CREATE_BREAKAWAY_FROM_JOB when job-contained hosts reject breakaway.

Concerns

No blocking correctness, security, or spec-alignment concerns found in the annotated diff.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

kevinyang372 · 2026-07-29T20:03:15Z

+    # Load the SSH key needed to clone the private warp-channel-config repo.
+    # Mirrors and fork PRs do not receive the key, so this remains a no-op there.
    - name: Setup SSH keys for warp-channel-config
-      if: ${{ github.repository == 'warpdotdev/warp-internal' && inputs.ssh_key != '' }}


Why are we getting rid of github.repository == 'warpdotdev/warp-internal'? This doesn't seem right?

[Warp Agent] Agreed. Fixed in commit 758e85f78: the warpdotdev/warp-internal repository guard is restored for both SSH-key setup and the Windows channel-config installation step.

kevinyang372 · 2026-07-29T20:03:40Z

-            &startup_info.StartupInfo as *const STARTUPINFOW,
-            &mut process_information,
-        )
+    let create_shell_process = |creation_flags| {


Why are we making changes here?

[Warp Agent] This is required by the packaged ConPTY smoke test and by job-contained hosts. GitHub Actions initially returned E_ACCESSDENIED for CREATE_BREAKAWAY_FROM_JOB; the code retries without breakaway only for that specific error, inheriting the parent job. Other errors still fail normally, and each CreateProcessW attempt gets a fresh mutable command buffer. The native Windows test exercises this path, so I kept the change in this PR.

This is required by the packaged ConPTY smoke test

This freaks me out. I think we should delete the smoke test rather than change such a precious code path.

[Warp Agent] Agreed and fixed in commit 90af8b1a2. I removed the ConPTY smoke test and restored app/src/terminal/local_tty/windows/mod.rs exactly to master, so this PR no longer changes the PTY process-creation path.

acarl005 · 2026-07-30T21:56:40Z

+            CodeSigningAccountName = $env:TRUSTED_SIGNING_ACCOUNT
+            CertificateProfileName = $env:TRUSTED_SIGNING_CERT_PROFILE
+          } | ConvertTo-Json | Set-Content $MetadataPath
+          "sign_tool_cmd=signtool.exe sign /v /fd SHA256 /tr http://timestamp.acs.microsoft.com /td SHA256 /dlib $Dlib /dmdf $MetadataPath `$f" >> $env:GITHUB_OUTPUT


This seems identical to the one in release_windows job. Would be nice to reuse

[Warp Agent] Addressed in commit 90af8b1a2. I extracted the Inno signing setup into script/windows/build_inno_sign_tool_command.ps1; both release_windows_tui and the existing release_windows job now call the same helper.

acarl005 · 2026-07-30T22:06:45Z

@@ -0,0 +1,126 @@
+use std::collections::HashMap;


I don't think this is a useful test. It's like an integration/smoke test dressed as a unit test. If we want to actually test round-trip from Warp to ConPTY and back to Warp, that should be an integration test. The Windows GUI doesn't do that though and so I think this is not necessary.

[Warp Agent] Removed in commit 90af8b1a2. The packaged ConPTY test file is deleted rather than retained as a unit test.

acarl005 · 2026-07-30T22:07:20Z

-            &startup_info.StartupInfo as *const STARTUPINFOW,
-            &mut process_information,
-        )
+    let create_shell_process = |creation_flags| {


This is required by the packaged ConPTY smoke test

This freaks me out. I think we should delete the smoke test rather than change such a precious code path.

acarl005 · 2026-07-30T22:10:06Z

+          GIT_RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
+          SIGN_TOOL_CMD: ${{ steps.setup_signing.outputs.sign_tool_cmd }}
+
+      - name: Install and inspect signed Warp Agent CLI


This step is interesting. We don't do this type of validation for any other release, including the Windows GUI app. I'm not opposed to the general idea of doing more validation on the bundle after building it, but I am a little concerned about the amount of complexity it's introducing.

Yeah agreed

[Warp Agent] Simplified in commit 90af8b1a2. The install/inspect, ConPTY smoke, and uninstall-validation steps are removed. The job now follows the existing Windows release shape: build, sign, configure shared Inno signing, bundle, and upload the installer/raw PDB.

Co-Authored-By: Warp <agent@warp.dev>

## Description Make Windows Warp Agent CLI background updates download and execute the same signed Inno installer used for initial installation. Windows no longer parses or installs ZIP payloads in Rust. The updater verifies the installer with `WinVerifyTrust`, invokes it silently against the detected managed root, verifies the completed version and active pointer, and then performs conservative lease-aware cleanup. Unix tarball updates, polling, status, telemetry, custom-root detection, and live-version leases are unchanged. Artifact publication remains intentionally disabled. This replaces reference PR #14446 without modifying it. Depends on #14476 and warpdotdev/warp-server#13497. Implementation plan: https://staging.warp.dev/drive/notebook/BI2TyxneCNDssiTUVIF0iK ## Linked Issue - [ ] The linked issue is labeled `ready-to-spec` or `ready-to-implement`. - [ ] Where appropriate, screenshots or a short video of the implementation are included below. ## Testing - `./script/format` - Repository-prescribed split Clippy checks - `cargo test -p warp_tui --lib autoupdate --features release_bundle,standalone,crash_reporting` — 17 passed - Windows tests retain Authenticode rejection, installed-payload validation, custom-root arguments, current/previous behavior, rollback retention, and live-version garbage collection - Native Windows and cross-repository release validation will be linked after the remote branches are exercised - [ ] I have manually tested my changes locally with `./script/run` ## Agent Mode - [x] Warp Agent Mode - This PR was created via Warp's AI Agent Mode CHANGELOG-NONE Co-Authored-By: Warp <agent@warp.dev> Co-authored-by: Warp <agent@warp.dev>

cla-bot Bot added the cla-signed label Jul 29, 2026

This was referenced Jul 29, 2026

Build Warp Agent CLI with the Windows installer #14475

Merged

Use the Windows installer for Warp Agent CLI autoupdates #14477

Merged

kevinyang372 marked this pull request as ready for review July 29, 2026 16:54

oz-for-oss Bot reviewed Jul 29, 2026

View reviewed changes

kevinyang372 force-pushed the 07-29-build_windows_warp_agent_cli_inno_in_dev_releases branch from c4f8984 to 9c92a82 Compare July 29, 2026 17:37

kevinyang372 commented Jul 29, 2026

View reviewed changes

kevinyang372 force-pushed the 07-29-build_windows_warp_agent_cli_inno_in_dev_releases branch from 9c92a82 to 758e85f Compare July 29, 2026 20:43

kevinyang372 force-pushed the 07-29-build_windows_warp_agent_cli_inno_in_dev_releases branch from 758e85f to 65b336f Compare July 29, 2026 21:07

kevinyang372 requested a review from acarl005 July 29, 2026 21:17

kevinyang372 force-pushed the 07-29-build_windows_warp_agent_cli_inno_in_dev_releases branch 2 times, most recently from 77b1f07 to 357274d Compare July 30, 2026 02:27

Base automatically changed from 07-29-build_windows_warp_agent_cli_inno_installer to master July 30, 2026 03:08

kevinyang372 force-pushed the 07-29-build_windows_warp_agent_cli_inno_in_dev_releases branch from 357274d to 73ec05c Compare July 30, 2026 03:11

acarl005 requested changes Jul 30, 2026

View reviewed changes

Build the Windows Warp Agent CLI installer in dev releases

90af8b1

Co-Authored-By: Warp <agent@warp.dev>

kevinyang372 force-pushed the 07-29-build_windows_warp_agent_cli_inno_in_dev_releases branch from 73ec05c to 90af8b1 Compare July 30, 2026 22:46

kevinyang372 requested a review from acarl005 July 30, 2026 23:03

acarl005 approved these changes Jul 30, 2026

View reviewed changes

kevinyang372 merged commit 1535d39 into master Jul 31, 2026
37 checks passed

kevinyang372 deleted the 07-29-build_windows_warp_agent_cli_inno_in_dev_releases branch July 31, 2026 01:31

Uh oh!

Conversation

kevinyang372 commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Linked Issue

Testing

Agent Mode

Uh oh!

kevinyang372 commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oz-for-oss Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oz-for-oss Bot left a comment

Choose a reason for hiding this comment

Overview

Concerns

Verdict

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

acarl005 Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kevinyang372 commented Jul 29, 2026 •

edited

Loading

kevinyang372 commented Jul 29, 2026 •

edited

Loading

oz-for-oss Bot commented Jul 29, 2026 •

edited

Loading

acarl005 Jul 30, 2026 •

edited

Loading