Give the MSIX its own numeric version

.github/workflows/release.yml

@@ -75,16 +75,39 @@ jobs:
       - name: Work out the version
         shell: bash
         run: |
+          PROJECT="$(sed -n 's/^project(hyperbin VERSION \([0-9.]*\).*/\1/p' CMakeLists.txt)"
           if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
             VERSION="${GITHUB_REF_NAME#v}"
           else
-            VERSION="$(sed -n 's/^project(hyperbin VERSION \([0-9.]*\).*/\1/p' CMakeLists.txt)-pr${{ github.event.number }}"
+            VERSION="${PROJECT}-pr${{ github.event.number }}"
           fi
           BUILD=$(git rev-list --count HEAD)
-          echo "VERSION=$VERSION"   >> $GITHUB_ENV
-          echo "BUILD=$BUILD"       >> $GITHUB_ENV
+
+          # MSIX gets its own version, and it has to be built rather than
+          # borrowed. Its schema takes four dot-separated integers and
+          # NOTHING else, so the display version cannot be used: that is
+          # only ever clean on a tag, and every pull request packed as
+          # "1.0.0-pr4.0" and failed makeappx outright.
+          #
+          # The last field is the commit count for the same reason
+          # CFBundleVersion is — see CMakeLists. Windows compares these to
+          # decide what is an upgrade, so two builds of 1.0.0 that both
+          # said 1.0.0.0 would be indistinguishable to it. A commit count
+          # only ever goes up.
+          #
+          # Strip any pre-release suffix off a tag first: v1.1.0-beta.2 is
+          # a perfectly good tag and not a number.
+          MSIX_VERSION="${VERSION%%-*}.${BUILD}"
+          if [[ "$BUILD" -gt 65535 ]]; then
+            echo "::error::commit count $BUILD exceeds the 65535 an MSIX version field allows"
+            exit 1
+          fi
+
+          echo "VERSION=$VERSION"           >> $GITHUB_ENV
+          echo "BUILD=$BUILD"               >> $GITHUB_ENV
+          echo "MSIX_VERSION=$MSIX_VERSION" >> $GITHUB_ENV
           echo "$VERSION" > build-version.txt
-          echo "Version $VERSION, build $BUILD"
+          echo "Version $VERSION, build $BUILD, msix $MSIX_VERSION"
 
       - name: Install Qt
         uses: jurplel/install-qt-action@v4
@@ -215,8 +238,11 @@ jobs:
           Copy-Item packaging\windows\Assets dist\windows\Assets -Recurse -Force
 
           (Get-Content dist\windows\AppxManifest.xml) `
-            -replace '\{\{VERSION\}\}', "$env:VERSION" `
+            -replace '\{\{MSIX_VERSION\}\}', "$env:MSIX_VERSION" `
             -replace '\{\{ARCH\}\}', 'x64' | Set-Content dist\windows\AppxManifest.xml
+          if (Select-String -Path dist\windows\AppxManifest.xml -Pattern '\{\{') {
+            throw "AppxManifest still has an unsubstituted placeholder"
+          }
 
           $makeappx = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\10.*\x64\makeappx.exe" |
                       Sort-Object -Descending | Select-Object -First 1

packaging/windows/AppxManifest.xml

@@ -9,16 +9,22 @@
   <!--
     MSIX manifest for hyperbin.
 
-    {{VERSION}} and {{ARCH}} are substituted by CI before packaging.
+    {{MSIX_VERSION}} and {{ARCH}} are substituted by CI before packaging.
     Publisher must match the Subject of the signing certificate exactly,
     character for character — makeappx will pack a mismatched one
     happily and Windows will refuse to install it.
+
+    MSIX_VERSION is NOT the version the app calls itself. The schema here
+    admits four dot-separated integers and nothing else, so a display
+    version carrying any suffix — "1.0.0-pr4", "1.0.0-dev" — fails to
+    pack at all. That is not hypothetical: every pull request built here
+    died on it, because the display version is only clean on a tag.
   -->
 
   <Identity
     Name="Hypernuclear.Hyperbin"
     Publisher="CN=hypernuclear, O=hypernuclear, L=Henderson, S=Nevada, C=US"
-    Version="{{VERSION}}.0"
+    Version="{{MSIX_VERSION}}"
     ProcessorArchitecture="{{ARCH}}" />
 
   <Properties>