From c56e6718b4b08cfd7cde08a68f3bc1a546f5ccb2 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Mon, 12 Oct 2026 19:04:02 -0700
Subject: [PATCH] ci(windows): build the agent hook before packaging in
 installer e2e workflows (#28137)

---
 .../prepare-windows-agent-hook/action.yml     | 27 +++++++++++++++++++
 .github/workflows/win-crash-survival-e2e.yml  |  3 +++
 .../workflows/win-orcad-serve-switch-e2e.yml  |  3 +++
 .github/workflows/win-update-survival-e2e.yml |  3 +++
 4 files changed, 36 insertions(+)
 create mode 100644 .github/actions/prepare-windows-agent-hook/action.yml

diff --git a/.github/actions/prepare-windows-agent-hook/action.yml b/.github/actions/prepare-windows-agent-hook/action.yml
new file mode 100644
index 00000000000..b8c8a2ac7c5
--- /dev/null
+++ b/.github/actions/prepare-windows-agent-hook/action.yml
@@ -0,0 +1,27 @@
+name: Prepare the Windows agent hook
+description: Compiles native/windows-agent-hook into native/windows-agent-hook/.build/orca-agent-hook.exe, which electron-builder --win refuses to package without.
+
+runs:
+  using: composite
+  steps:
+    - name: Cache the Windows agent hook build
+      if: runner.os == 'Windows'
+      uses: actions/cache@v5
+      with:
+        path: |
+          native/windows-agent-hook/.build
+          native/windows-agent-hook/target
+          ~/.cargo/registry
+        key: windows-agent-hook-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/windows-agent-hook/**', 'config/scripts/build-windows-agent-hook.mjs', 'config/scripts/windows-rust-executable-build.mjs', 'resources/build/icon.ico', 'package.json') }}
+
+    # Why explicit: a runner image without cargo would otherwise fail inside electron-builder's verify.
+    - name: Build the Windows agent hook
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+        }
+        node config/scripts/build-windows-agent-hook.mjs
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
diff --git a/.github/workflows/win-crash-survival-e2e.yml b/.github/workflows/win-crash-survival-e2e.yml
index 53c231111db..81c3e726faf 100644
--- a/.github/workflows/win-crash-survival-e2e.yml
+++ b/.github/workflows/win-crash-survival-e2e.yml
@@ -119,6 +119,9 @@ jobs:
       - uses: ./.github/actions/install-mobile-dependencies
         if: steps.cache-installer.outputs.cache-hit != 'true'
 
+      - uses: ./.github/actions/prepare-windows-agent-hook
+        if: steps.cache-installer.outputs.cache-hit != 'true'
+
       - name: Build Windows installer (unsigned)
         if: steps.cache-installer.outputs.cache-hit != 'true'
         run: |
diff --git a/.github/workflows/win-orcad-serve-switch-e2e.yml b/.github/workflows/win-orcad-serve-switch-e2e.yml
index cedbf056d44..0d0271d7ce9 100644
--- a/.github/workflows/win-orcad-serve-switch-e2e.yml
+++ b/.github/workflows/win-orcad-serve-switch-e2e.yml
@@ -57,6 +57,9 @@ jobs:
       - uses: ./.github/actions/install-mobile-dependencies
         if: steps.cache-installer.outputs.cache-hit != 'true'
 
+      - uses: ./.github/actions/prepare-windows-agent-hook
+        if: steps.cache-installer.outputs.cache-hit != 'true'
+
       # Before the template exists: packaging verifies a present template for every target.
       - name: Build Windows installer (unsigned)
         if: steps.cache-installer.outputs.cache-hit != 'true'
diff --git a/.github/workflows/win-update-survival-e2e.yml b/.github/workflows/win-update-survival-e2e.yml
index b709f82b788..9b0884f91b0 100644
--- a/.github/workflows/win-update-survival-e2e.yml
+++ b/.github/workflows/win-update-survival-e2e.yml
@@ -101,6 +101,9 @@ jobs:
       - uses: ./.github/actions/install-mobile-dependencies
         if: steps.cache-installer.outputs.cache-hit != 'true'
 
+      - uses: ./.github/actions/prepare-windows-agent-hook
+        if: steps.cache-installer.outputs.cache-hit != 'true'
+
       - name: Build Windows installer (unsigned)
         if: steps.cache-installer.outputs.cache-hit != 'true'
         run: |