ci(windows-store): check tiles against the generator, not against build/appx

The verification read build/appx/ to decide which assets to look for, which makes
it blind in the one case it exists for: delete a PNG there and the name drops out
of the expected set too, so the loop passes while electron-builder swaps its blank
placeholder in under that exact name. An empty directory reported success with
zero assets checked.

The generator now owns the list — `--list` prints it, derived from ASSETS and
TARGET_SIZES with no filesystem involved — and CI compares that list to both the
committed directory (missing, or hand-added files) and the package. Refactoring
the names out of the write loop also folded the targetsize variants into the same
compose() path; at size == canvas with no shift it is the same pixels, and the
regenerated assets are byte-identical.

Reported by CodeRabbit on #294.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JZV4hzYgcpTfL15wkxyYQz

Author: claude

.github/workflows/build.yml

@@ -83,13 +83,32 @@ jobs:
       # the package carried electron-builder's vendored placeholder tiles: it reads
       # them from build/appx/ and, when a name is missing there, silently substitutes
       # a blank SampleAppx.*.png instead of failing. Nothing in the build output says
-      # so — the only way to know is to look inside the package. This step does that,
-      # comparing every committed asset against the one actually packaged, so a
-      # renamed, dropped or substituted tile fails the build instead of failing
-      # certification days later.
+      # so — the only way to know is to look inside the package.
+      #
+      # The expected filenames come from the generator (`--list`), NOT from build/appx/.
+      # Deriving them from the directory would defeat the check at the exact moment it
+      # matters: delete an asset there and it drops out of the expected set too, so the
+      # loop passes while electron-builder quietly packages a placeholder under that
+      # name. The generator is the authority; build/appx/ is the artifact being checked.
       - name: Verify Store tiles are in the package
         shell: pwsh
         run: |
+          $expected = @(node scripts/generate-appx-assets.mjs --list)
+          if ($LASTEXITCODE -ne 0 -or $expected.Count -eq 0) { throw "generator produced no asset list" }
+
+          $problems = @()
+
+          # First: the committed directory must match the generator exactly. A deleted or
+          # hand-added PNG is caught here, before it can reach the package.
+          $committed = @(Get-ChildItem build/appx -Filter *.png | ForEach-Object { $_.Name })
+          foreach ($name in $expected) {
+            if ($committed -notcontains $name) { $problems += "missing from build/appx: $name" }
+          }
+          foreach ($name in $committed) {
+            if ($expected -notcontains $name) { $problems += "unexpected file in build/appx (run npm run assets:appx): $name" }
+          }
+
+          # Then: every expected asset must be in the package, byte-identical.
           $appx = Get-ChildItem release -Recurse -Filter *.appx | Select-Object -First 1
           if (-not $appx) { throw "no .appx found under release/" }
           Add-Type -AssemblyName System.IO.Compression.FileSystem
@@ -99,25 +118,26 @@ jobs:
             $entries = @{}
             foreach ($e in $archive.Entries) { $entries[$e.FullName.Replace("\", "/")] = $e }
             $sha = [System.Security.Cryptography.SHA256]::Create()
-            $problems = @()
-            $expected = Get-ChildItem build/appx -Filter *.png
-            foreach ($asset in $expected) {
-              $entry = $entries["assets/$($asset.Name)"]
-              if (-not $entry) { $problems += "missing from package: $($asset.Name)"; continue }
+            foreach ($name in $expected) {
+              $entry = $entries["assets/$name"]
+              if (-not $entry) { $problems += "missing from package: $name"; continue }
               $stream = $entry.Open()
               try { $packaged = [BitConverter]::ToString($sha.ComputeHash($stream)) }
               finally { $stream.Dispose() }
-              $source = [BitConverter]::ToString($sha.ComputeHash([IO.File]::ReadAllBytes($asset.FullName)))
-              if ($packaged -ne $source) { $problems += "packaged copy differs from build/appx: $($asset.Name)" }
-            }
-            if ($problems) {
-              $problems | ForEach-Object { Write-Output "::error::$_" }
-              throw "$($problems.Count) tile asset problem(s) in $($appx.Name)"
+              $sourceFile = "build/appx/$name"
+              if (-not (Test-Path $sourceFile)) { continue }
+              $source = [BitConverter]::ToString($sha.ComputeHash([IO.File]::ReadAllBytes((Resolve-Path $sourceFile))))
+              if ($packaged -ne $source) { $problems += "packaged copy differs from build/appx: $name" }
             }
-            Write-Output "$($expected.Count) tile assets present in $($appx.Name), byte-identical to build/appx/"
           }
           finally { $archive.Dispose() }
 
+          if ($problems) {
+            $problems | ForEach-Object { Write-Output "::error::$_" }
+            throw "$($problems.Count) tile asset problem(s) in $($appx.Name)"
+          }
+          Write-Output "$($expected.Count) tile assets present in $($appx.Name), byte-identical to build/appx/"
+
       - name: Upload Windows Store package
         uses: actions/upload-artifact@v4
         with:

scripts/generate-appx-assets.mjs

@@ -280,58 +280,76 @@ function compose(icon, canvasWidth, canvasHeight, size, shiftY) {
 
 // --- Generation -------------------------------------------------------------------
 
-async function main() {
-	const icon = decodePng(await readFile(SOURCE_ICON));
-
-	// Wipe first: a renamed or dropped asset left behind in build/appx/ would still be
-	// mapped into the package by electron-builder, which copies the directory wholesale.
-	await rm(OUT_DIR, { recursive: true, force: true });
-	await mkdir(OUT_DIR, { recursive: true });
-
-	const written = [];
-	const write = async (name, width, height, pixels) => {
-		const file = path.join(OUT_DIR, name);
-		await writeFile(file, encodePng(width, height, pixels));
-		written.push(name);
-	};
-
+/**
+ * Every asset this generator owns, as {name, width, height, size, shiftY}, derived from
+ * ASSETS/TARGET_SIZES alone — no filesystem involved.
+ *
+ * This table, not the contents of build/appx/, is the authority on what the package must
+ * contain. `--list` exposes it so CI can tell "this asset is missing" apart from "this
+ * asset was never expected": a check that reads build/appx/ to decide what to look for
+ * passes happily once a file is deleted there, which is precisely when electron-builder
+ * swaps a blank placeholder in.
+ *
+ * The targetsize variants come out of compose() too rather than a bare resample: at
+ * size == width == height with no shift, the canvas is fully covered, so the two are the
+ * same pixels — and there is then a single code path to keep honest.
+ */
+function plannedAssets() {
+	const planned = [];
 	for (const asset of ASSETS) {
 		const shiftY = asset.shiftY ?? 0;
 		for (const scale of [100, ...(asset.scales ?? [])]) {
 			const width = Math.round((asset.width * scale) / 100);
 			const height = Math.round((asset.height * scale) / 100);
 			const size = Math.round(Math.min(width, height) * asset.fill);
-			if (size > icon.width) {
-				throw new Error(
-					`${asset.name} at ${scale}% needs a ${size}px icon; master is ${icon.width}px`,
-				);
-			}
 			// The 100% variant stays unqualified so it is also the neutral MRT candidate:
 			// if resources.pri ever fails to resolve a scale, Windows still finds art.
 			const suffix = scale === 100 ? "" : `.scale-${scale}`;
-			await write(
-				`${asset.name}${suffix}.png`,
-				width,
-				height,
-				compose(icon, width, height, size, shiftY),
-			);
+			planned.push({ name: `${asset.name}${suffix}.png`, width, height, size, shiftY });
 		}
 	}
-
 	for (const target of TARGET_SIZES) {
-		const pixels = resample(icon.pixels, icon.width, icon.height, target, target);
-		await write(`Square44x44Logo.targetsize-${target}.png`, target, target, pixels);
-		await write(
-			`Square44x44Logo.targetsize-${target}_altform-unplated.png`,
-			target,
-			target,
-			pixels,
-		);
+		for (const suffix of ["", "_altform-unplated"]) {
+			planned.push({
+				name: `Square44x44Logo.targetsize-${target}${suffix}.png`,
+				width: target,
+				height: target,
+				size: target,
+				shiftY: 0,
+			});
+		}
+	}
+	return planned;
+}
+
+async function main() {
+	const planned = plannedAssets();
+
+	if (process.argv.includes("--list")) {
+		console.log(planned.map((it) => it.name).join("\n"));
+		return;
+	}
+
+	const icon = decodePng(await readFile(SOURCE_ICON));
+	for (const { name, size } of planned) {
+		if (size > icon.width) {
+			throw new Error(`${name} needs a ${size}px icon; master is ${icon.width}px`);
+		}
+	}
+
+	// Wipe first: a renamed or dropped asset left behind in build/appx/ would still be
+	// mapped into the package by electron-builder, which copies the directory wholesale.
+	await rm(OUT_DIR, { recursive: true, force: true });
+	await mkdir(OUT_DIR, { recursive: true });
+
+	for (const { name, width, height, size, shiftY } of planned) {
+		const pixels = compose(icon, width, height, size, shiftY);
+		await writeFile(path.join(OUT_DIR, name), encodePng(width, height, pixels));
 	}
 
 	const total = (await readdir(OUT_DIR)).length;
 	console.log(
-		`${written.length} assets written to ${path.relative(ROOT, OUT_DIR)} (${total} files)`,
+		`${planned.length} assets written to ${path.relative(ROOT, OUT_DIR)} (${total} files)`,
 	);
 }