Refresh integrity tree before packaging

Author: mamoreau-devolutions

.github/workflows/build-release.yml

@@ -225,21 +225,15 @@ jobs:
             -CertificateName '${{ secrets.CODE_SIGNING_CERTIFICATE_NAME }}' `
             -TimestampServer '${{ vars.CODE_SIGNING_TIMESTAMP_SERVER }}'
 
-      - name: Generate integrity tree
-        shell: pwsh
-        run: .\scripts\generate-integrity-tree.ps1 -Path $PWD/unigetui_bin -MinOutput
-
-      - name: Validate integrity tree
-        shell: pwsh
-        run: .\scripts\verify-integrity-tree.ps1 -Path $PWD/unigetui_bin -FailOnUnexpectedFiles
-
       - name: Build installer
         shell: pwsh
         run: |
           $Platform = '${{ matrix.platform }}'
           $OutputDir = Join-Path $PWD "output"
           New-Item $OutputDir -ItemType Directory -ErrorAction SilentlyContinue | Out-Null
 
+          .\scripts\refresh-integrity-tree.ps1 -Path $PWD/unigetui_bin -FailOnUnexpectedFiles
+
           # Configure Inno Setup to use AzureSignTool
           $IssPath = "UniGetUI.iss"
 
@@ -266,6 +260,8 @@ jobs:
           $Platform = '${{ matrix.platform }}'
           New-Item "output" -ItemType Directory -ErrorAction SilentlyContinue | Out-Null
 
+          .\scripts\refresh-integrity-tree.ps1 -Path $PWD/unigetui_bin -FailOnUnexpectedFiles
+
           # Zip
           Compress-Archive -Path "unigetui_bin/*" -DestinationPath "output/UniGetUI.$Platform.zip" -CompressionLevel Optimal
 

scripts/build.ps1

@@ -94,18 +94,14 @@ Get-ChildItem $PublishDir | Move-Item -Destination $BinDir -Force
 # WingetUI.exe alias for backward compat
 Copy-Item (Join-Path $BinDir "UniGetUI.exe") (Join-Path $BinDir "WingetUI.exe") -Force
 
-# --- Integrity tree ---
-Write-Host "`n=== Generating integrity tree ===" -ForegroundColor Cyan
-& (Join-Path $PSScriptRoot "generate-integrity-tree.ps1") -Path $BinDir -MinOutput
-
-Write-Host "`n=== Validating integrity tree ===" -ForegroundColor Cyan
-& (Join-Path $PSScriptRoot "verify-integrity-tree.ps1") -Path $BinDir -FailOnUnexpectedFiles
-
 # --- Package output ---
 if (Test-Path $OutputPath) { Remove-Item $OutputPath -Recurse -Force }
 New-Item $OutputPath -ItemType Directory | Out-Null
 
 $ZipPath = Join-Path $OutputPath "UniGetUI.$Platform.zip"
+Write-Host "`n=== Refreshing integrity tree before zip packaging ===" -ForegroundColor Cyan
+& (Join-Path $PSScriptRoot "refresh-integrity-tree.ps1") -Path $BinDir -FailOnUnexpectedFiles
+
 Write-Host "`n=== Creating zip: $ZipPath ===" -ForegroundColor Cyan
 Compress-Archive -Path (Join-Path $BinDir "*") -DestinationPath $ZipPath -CompressionLevel Optimal
 
@@ -130,6 +126,9 @@ if (-not $SkipInstaller) {
         $IssPath = Join-Path $RepoRoot "UniGetUI.iss"
         $IssContent = Get-Content $IssPath -Raw
 
+        Write-Host "`n=== Refreshing integrity tree before installer packaging ===" -ForegroundColor Cyan
+        & (Join-Path $PSScriptRoot "refresh-integrity-tree.ps1") -Path $BinDir -FailOnUnexpectedFiles
+
         try {
             $IssContentNoSign = $IssContent -Replace '(?m)^SignTool=.*$', '; SignTool=azsign (disabled for local build)'
             $IssContentNoSign = $IssContentNoSign -Replace '(?m)^SignedUninstaller=yes', 'SignedUninstaller=no'

scripts/refresh-integrity-tree.ps1

@@ -0,0 +1,48 @@
+#!/usr/bin/env pwsh
+<#
+.SYNOPSIS
+    Regenerates IntegrityTree.json and validates it against the current folder contents.
+
+.PARAMETER Path
+    The directory whose IntegrityTree.json should be refreshed and validated.
+
+.PARAMETER FailOnUnexpectedFiles
+    Fail validation if files exist in the directory tree but are not present in
+    IntegrityTree.json.
+#>
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory, Position = 0)]
+    [string] $Path,
+
+    [switch] $FailOnUnexpectedFiles
+)
+
+$ErrorActionPreference = 'Stop'
+
+if (-not (Test-Path $Path -PathType Container)) {
+    throw "The directory '$Path' does not exist."
+}
+
+$Path = (Resolve-Path $Path).Path
+$GenerateScriptPath = Join-Path $PSScriptRoot 'generate-integrity-tree.ps1'
+$VerifyScriptPath = Join-Path $PSScriptRoot 'verify-integrity-tree.ps1'
+
+if (-not (Test-Path $GenerateScriptPath -PathType Leaf)) {
+    throw "Integrity tree generator not found at '$GenerateScriptPath'."
+}
+
+if (-not (Test-Path $VerifyScriptPath -PathType Leaf)) {
+    throw "Integrity tree validator not found at '$VerifyScriptPath'."
+}
+
+Write-Host "Refreshing integrity tree in $Path..."
+& $GenerateScriptPath -Path $Path -MinOutput
+
+$ValidationParameters = @{ Path = $Path }
+if ($FailOnUnexpectedFiles) {
+    $ValidationParameters.FailOnUnexpectedFiles = $true
+}
+
+& $VerifyScriptPath @ValidationParameters

scripts/sign.ps1

@@ -115,16 +115,15 @@ function Update-IntegrityTree {
         return
     }
 
-    $TreeScriptPath = Join-Path $PSScriptRoot "generate-integrity-tree.ps1"
-    if (-not (Test-Path $TreeScriptPath -PathType Leaf)) {
-        Write-Warning "Integrity tree generator not found at $TreeScriptPath"
+    $TreeRefreshScriptPath = Join-Path $PSScriptRoot "refresh-integrity-tree.ps1"
+    if (-not (Test-Path $TreeRefreshScriptPath -PathType Leaf)) {
+        Write-Warning "Integrity tree refresh script not found at $TreeRefreshScriptPath"
         return
     }
 
-    Write-Host "Refreshing integrity tree in $RootPath..."
-    & $TreeScriptPath -Path $RootPath -MinOutput
+    & $TreeRefreshScriptPath -Path $RootPath -FailOnUnexpectedFiles
     if ($LASTEXITCODE -ne 0) {
-        throw "generate-integrity-tree.ps1 failed with exit code $LASTEXITCODE"
+        throw "refresh-integrity-tree.ps1 failed with exit code $LASTEXITCODE"
     }
 }