feat(installer): add PowerShell installer

.github/workflows/ci_install_script.yml

@@ -43,6 +43,7 @@ jobs:
             tombi.toml
             type-test.toml
             docs/public/install.sh
+            docs/public/install.ps1
             .github/scripts/install-cross.sh
             .github/actions/relevant-changes/**
             .github/actions/set-version/**
@@ -387,3 +388,151 @@ jobs:
         run: |
           ${{ matrix.exe_name }} --version
           ${{ matrix.exe_name }} --help
+
+  test-install-powershell:
+    needs: detect-changes
+    if: needs.detect-changes.outputs.relevant == 'true'
+    name: Test install.ps1 (Windows)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Resolve release artifact metadata
+        shell: pwsh
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          $installer = Get-Content -Raw ./docs/public/install.ps1
+          $versionMatch = [regex]::Match(
+            $installer,
+            '(?m)^\$LatestStableVersion = "([0-9]+\.[0-9]+\.[0-9]+)"$'
+          )
+          if (-not $versionMatch.Success) {
+            throw "Failed to resolve LatestStableVersion"
+          }
+
+          $headers = @{
+            Accept = "application/vnd.github+json"
+            Authorization = "Bearer $env:GITHUB_TOKEN"
+            "X-GitHub-Api-Version" = "2022-11-28"
+          }
+          $requestedVersion = $versionMatch.Groups[1].Value
+          try {
+            $release = Invoke-RestMethod `
+              -Headers $headers `
+              -Uri "https://api.github.com/repos/tombi-toml/tombi/releases/tags/v$requestedVersion"
+            $version = $requestedVersion
+          }
+          catch {
+            Write-Warning "Release v$requestedVersion is not published yet; falling back to the latest release."
+            $release = Invoke-RestMethod `
+              -Headers $headers `
+              -Uri "https://api.github.com/repos/tombi-toml/tombi/releases/latest"
+            $version = $release.tag_name -replace "^v", ""
+          }
+
+          $architecture = if ($env:PROCESSOR_ARCHITECTURE -eq "ARM64") {
+            "aarch64"
+          }
+          else {
+            "x86_64"
+          }
+          $assetName = "tombi-cli-$version-$architecture-pc-windows-msvc.zip"
+          $asset = $release.assets | Where-Object { $_.name -eq $assetName } | Select-Object -First 1
+          if ($null -eq $asset) {
+            throw "Failed to resolve release asset $assetName"
+          }
+
+          $checksum = $asset.digest -replace "^sha256:", ""
+          if ($checksum -notmatch "^[0-9a-f]{64}$") {
+            throw "Invalid release asset digest for ${assetName}: $checksum"
+          }
+
+          "INSTALL_VERSION=$version" >> $env:GITHUB_ENV
+          "INSTALL_CHECKSUM=$checksum" >> $env:GITHUB_ENV
+
+      - name: Run PowerShell installer without checksum
+        shell: powershell
+        run: |
+          $installDir = Join-Path $env:LOCALAPPDATA "tombi\bin"
+          $userPathBefore = [Environment]::GetEnvironmentVariable("Path", "User")
+          $processPathBefore = $env:PATH
+          $installedPath = & ./docs/public/install.ps1 -Version $env:INSTALL_VERSION
+          if ($installedPath -ne (Join-Path $installDir "tombi.exe")) {
+            throw "Unexpected installed path: $installedPath"
+          }
+          if ([Environment]::GetEnvironmentVariable("Path", "User") -ne $userPathBefore) {
+            throw "The installer unexpectedly modified the user PATH."
+          }
+          if ($env:PATH -ne $processPathBefore) {
+            throw "The installer unexpectedly modified the process PATH."
+          }
+          & $installedPath --version
+          & $installedPath --help
+
+      - name: Run PowerShell installer with plain checksum
+        shell: powershell
+        run: |
+          $installDir = Join-Path $env:RUNNER_TEMP "install-powershell-checksum"
+          & ./docs/public/install.ps1 `
+            -Version $env:INSTALL_VERSION `
+            -InstallDir $installDir `
+            -Checksum $env:INSTALL_CHECKSUM
+          if (-not (Test-Path -LiteralPath (Join-Path $installDir "tombi.exe") -PathType Leaf)) {
+            throw "Installed binary was not found."
+          }
+
+      - name: Run PowerShell installer with sha256 checksum
+        shell: powershell
+        run: |
+          $installDir = Join-Path $env:RUNNER_TEMP "install-powershell-prefixed-checksum"
+          & ./docs/public/install.ps1 `
+            -Version $env:INSTALL_VERSION `
+            -InstallDir $installDir `
+            -Checksum "sha256:$env:INSTALL_CHECKSUM"
+          if (-not (Test-Path -LiteralPath (Join-Path $installDir "tombi.exe") -PathType Leaf)) {
+            throw "Installed binary was not found."
+          }
+
+      - name: Reject wrong checksum before install
+        shell: powershell
+        run: |
+          $installDir = Join-Path $env:RUNNER_TEMP "install-powershell-bad-checksum"
+          try {
+            & ./docs/public/install.ps1 `
+              -Version $env:INSTALL_VERSION `
+              -InstallDir $installDir `
+              -Checksum ("0" * 64)
+            throw "Installer unexpectedly accepted an incorrect checksum."
+          }
+          catch {
+            if ($_.Exception.Message -notmatch "Checksum verification failed") {
+              throw
+            }
+          }
+          if (Test-Path -LiteralPath (Join-Path $installDir "tombi.exe")) {
+            throw "Binary was installed despite the checksum mismatch."
+          }
+
+      - name: Reject invalid checksum formats
+        shell: powershell
+        run: |
+          $invalidChecksums = @(
+            "sha1:0123456789abcdef0123456789abcdef01234567",
+            "1234",
+            ("z" * 64),
+            ""
+          )
+          foreach ($checksum in $invalidChecksums) {
+            try {
+              & ./docs/public/install.ps1 -Checksum $checksum
+              throw "Installer unexpectedly accepted checksum '$checksum'."
+            }
+            catch {
+              if ($_.Exception.Message -notmatch "Unsupported checksum format|Invalid checksum") {
+                throw
+              }
+            }
+          }

.github/workflows/release_cli_vscode.yml

@@ -327,7 +327,7 @@ jobs:
           if [[ "${REF_NAME}" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
             echo "stable_version=${REF_NAME#v}" >> "${GITHUB_OUTPUT}"
           else
-            echo "Skipping install.sh update for non-stable tag: ${REF_NAME}"
+            echo "Skipping installer updates for non-stable tag: ${REF_NAME}"
             echo "stable_version=" >> "${GITHUB_OUTPUT}"
           fi
 
@@ -350,7 +350,7 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
 
-      - name: Decide whether install.sh should be updated
+      - name: Decide whether installers should be updated
         id: should-update
         if: steps.stable-version.outputs.stable_version != ''
         shell: bash
@@ -359,14 +359,27 @@ jobs:
         run: |
           set -euo pipefail
           semver_re='^[0-9]+\.[0-9]+\.[0-9]+$'
-          current_version="$(
+          shell_current_version="$(
             sed -n 's/^LATEST_STABLE_VERSION="\([0-9]\+\.[0-9]\+\.[0-9]\+\)"$/\1/p' docs/public/install.sh
           )"
+          powershell_current_version="$(
+            # shellcheck disable=SC2016 # Match the literal PowerShell variable name.
+            sed -n 's/^\$LatestStableVersion = "\([0-9]\+\.[0-9]\+\.[0-9]\+\)"$/\1/p' docs/public/install.ps1
+          )"
 
-          if [ -z "${current_version}" ]; then
+          if [ -z "${shell_current_version}" ]; then
             echo "LATEST_STABLE_VERSION entry not found in docs/public/install.sh" >&2
             exit 1
           fi
+          if [ -z "${powershell_current_version}" ]; then
+            echo "LatestStableVersion entry not found in docs/public/install.ps1" >&2
+            exit 1
+          fi
+          if [ "${shell_current_version}" != "${powershell_current_version}" ]; then
+            echo "Installer stable versions are inconsistent: install.sh=${shell_current_version}, install.ps1=${powershell_current_version}" >&2
+            exit 1
+          fi
+          current_version="${shell_current_version}"
 
           if ! [[ "${current_version}" =~ ${semver_re} ]]; then
             echo "LATEST_STABLE_VERSION must be a stable semver, got: ${current_version}" >&2
@@ -400,7 +413,7 @@ jobs:
           echo "should_update=${should_update}" >> "${GITHUB_OUTPUT}"
 
           if [ "${should_update}" != "true" ]; then
-            echo "Skipping install.sh update because ${STABLE_VERSION} is not newer than ${current_version}."
+            echo "Skipping installer updates because ${STABLE_VERSION} is not newer than ${current_version}."
           fi
 
       - name: Update embedded stable version
@@ -411,33 +424,39 @@ jobs:
         run: |
           set -euo pipefail
           sed -i 's/^LATEST_STABLE_VERSION=.*/LATEST_STABLE_VERSION="'"${STABLE_VERSION}"'"/' docs/public/install.sh
+          # shellcheck disable=SC2016 # Replace the literal PowerShell variable name.
+          sed -i 's/^\$LatestStableVersion = .*/$LatestStableVersion = "'"${STABLE_VERSION}"'"/' docs/public/install.ps1
 
           if ! grep -Fxq "LATEST_STABLE_VERSION=\"${STABLE_VERSION}\"" docs/public/install.sh; then
             echo "Failed to update embedded stable version to ${STABLE_VERSION}" >&2
             exit 1
           fi
+          if ! grep -Fxq "\$LatestStableVersion = \"${STABLE_VERSION}\"" docs/public/install.ps1; then
+            echo "Failed to update PowerShell embedded stable version to ${STABLE_VERSION}" >&2
+            exit 1
+          fi
 
-      - name: Commit updated install script
+      - name: Commit updated installers
         id: commit-install-script
         if: steps.should-update.outputs.should_update == 'true'
         shell: bash
         env:
           STABLE_VERSION: ${{ steps.stable-version.outputs.stable_version }}
         run: |
           set -euo pipefail
-          if git diff --quiet -- docs/public/install.sh; then
+          if git diff --quiet -- docs/public/install.sh docs/public/install.ps1; then
             echo "created_commit=false" >> "${GITHUB_OUTPUT}"
-            echo "install.sh is already up to date."
+            echo "Installer scripts are already up to date."
             exit 0
           fi
 
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add docs/public/install.sh
-          git commit -m "docs: update install.sh stable version to ${STABLE_VERSION}"
+          git add docs/public/install.sh docs/public/install.ps1
+          git commit -m "docs: update installer stable version to ${STABLE_VERSION}"
           echo "created_commit=true" >> "${GITHUB_OUTPUT}"
 
-      - name: Push updated install script to main
+      - name: Push updated installers to main
         if: steps.commit-install-script.outputs.created_commit == 'true'
         shell: bash
         run: |
@@ -451,7 +470,7 @@ jobs:
             fi
 
             if [ "${attempt}" -eq 3 ]; then
-              echo "Failed to push updated install.sh to main after ${attempt} attempts." >&2
+              echo "Failed to push updated installer scripts to main after ${attempt} attempts." >&2
               exit 1
             fi
           done