Context
--cli-install=binary (#653) verifies releases with keyless cosign on linux only; the emitted install is a bash script and pins cosign for linux arches. Windows runners are not supported by binary mode today (see #654).
Ask (demand-gated)
Support binary mode on Windows runners. Unlike macOS (which needs only extra checksum pins, see the companion issue), Windows is a larger lift because the emitted step rides the default shell and the scripts are POSIX bash:
- Emit
shell: bash on the binary-mode step (Git Bash is present on GitHub-hosted Windows runners) so setup_cli_binary_preamble.sh + install.sh run at all. action mode is unaffected.
- Handle the Windows specifics in the scripts: the cosign asset is
cosign-windows-amd64.exe (pin its checksum; for v2.4.3 a2ac24e197111c9430cb2a98f10a641164381afb83df036504868e4ea5720800), the binary is cascade.exe, and the install dir / PATH differ from /usr/local/bin.
- A windows-safety pass on both scripts (path separators,
install availability, archive extension).
Alternative if the cosign path is too invasive on Windows: use a per-platform method. gpg verification of the published checksums.txt.asc (key already shipped at docs/cascade-release-public-key.asc) is cross-platform and needs no cosign binary; it gives integrity + key-holder authenticity but not workflow-identity provenance. The install method can legitimately differ per platform.
Add Windows legs to cli-install-selftest.yaml asserting the chosen verification actually ran. Update the --cli-install docs.
Priority
Lowest of the platform extensions: needs a consumer who runs cascade-generated workflows on Windows runners AND needs allowlist-free install. Defer until that demand is real.
Context
--cli-install=binary(#653) verifies releases with keyless cosign on linux only; the emitted install is a bash script and pins cosign for linux arches. Windows runners are not supported by binary mode today (see #654).Ask (demand-gated)
Support binary mode on Windows runners. Unlike macOS (which needs only extra checksum pins, see the companion issue), Windows is a larger lift because the emitted step rides the default shell and the scripts are POSIX bash:
shell: bashon the binary-mode step (Git Bash is present on GitHub-hosted Windows runners) sosetup_cli_binary_preamble.sh+install.shrun at all.actionmode is unaffected.cosign-windows-amd64.exe(pin its checksum; for v2.4.3a2ac24e197111c9430cb2a98f10a641164381afb83df036504868e4ea5720800), the binary iscascade.exe, and the install dir / PATH differ from/usr/local/bin.installavailability, archive extension).Alternative if the cosign path is too invasive on Windows: use a per-platform method. gpg verification of the published
checksums.txt.asc(key already shipped atdocs/cascade-release-public-key.asc) is cross-platform and needs no cosign binary; it gives integrity + key-holder authenticity but not workflow-identity provenance. The install method can legitimately differ per platform.Add Windows legs to
cli-install-selftest.yamlasserting the chosen verification actually ran. Update the--cli-installdocs.Priority
Lowest of the platform extensions: needs a consumer who runs cascade-generated workflows on Windows runners AND needs allowlist-free install. Defer until that demand is real.