.github/workflows/build-packages.yml - master - githubmirror/salt

.github/workflows/build-packages.yml
601 строка23 KB
Daniel A. Wozniak
Fix incorrect version reported in built packages
21 май 2026, 01:37
21 май 2026, 01:373ddb167
---
name: Build Packages

on:
  workflow_call:
    inputs:
      salt-version:
        type: string
        required: true
        description: The Salt version to set prior to building packages.
      relenv-version:
        type: string
        required: true
        description: The relenv version to set prior to building packages.
      python-version:
        required: true
        type: string
        description: The version of python to use with relenv
      ci-python-version:
        required: true
        type: string
        description: The version of python to use in workflows
      sign-rpm-packages:
        type: boolean
        default: false
        description: Sign RPM Packages
      sign-macos-packages:
        type: boolean
        default: false
        description: Sign MacOS Packages
      sign-windows-packages:
        type: boolean
        default: false
        description: Sign Windows Packages
      environment:
        type: string
        description: The GitHub Environment where this workflow should run
        default: ci
      source:
        required: true
        type: string
        description: The backend to build the packages with
      cache-prefix:
        required: true
        type: string
        description: Seed used to invalidate caches
      matrix:
        required: true
        type: string
        description: Json job matrix config
      linux_arm_runner:
        required: true
        type: string
        description: Json job matrix config



env:
  COLUMNS: 190
  PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
  PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
  PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
  PIP_DISABLE_PIP_VERSION_CHECK: "1"

jobs:

  build-deb-packages:
    name: DEB
    if: ${{ toJSON(fromJSON(inputs.matrix)['linux']) != '[]' }}
    runs-on:
      - ${{ matrix.arch == 'x86_64' && 'ubuntu-24.04' || inputs.linux_arm_runner }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(inputs.matrix)['linux'] }}

    container:
      image: ghcr.io/saltstack/salt-ci-containers/testing:debian-13

    env:
      RELENV_DATA: "${{ github.workspace }}/.relenv"

    steps:
      # Checkout here so we can easily use custom actions
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      # We need a more recent rustc
      - name: Install a more recent `rustc`
        if: ${{ inputs.source == 'src' }}
        uses: actions-rust-lang/setup-rust-toolchain@v1

      - name: Set rust environment variables
        if: ${{ inputs.source == 'src' }}
        run: |
          CARGO_HOME=${CARGO_HOME:-${HOME}/.cargo}
          export CARGO_HOME
          echo "CARGO_HOME=${CARGO_HOME}" | tee -a "${GITHUB_ENV}"
          echo "${CARGO_HOME}/bin" | tee -a "${GITHUB_PATH}"

      # Checkout here for the build process
      - name: Checkout in build directory
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          path:
            pkgs/checkout/

      - name: Install build dependencies
        run: |
          apt-get update -y
          # Installing python3.13-venv for Python 3.13 support
          apt-get install -y python3.13-venv
          # Installing devscripts for source package builds (provides debuild)
          apt-get install -y devscripts
          # Installing patchelf for relenv ELF binary patching
          apt-get install -y patchelf

      - name: Download Onedir Tarball as an Artifact
        if:  inputs.source == 'onedir'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: salt-${{ inputs.salt-version }}-onedir-linux-${{ matrix.arch }}.tar.xz
          path: pkgs/checkout/artifacts/

      - name: Install toolchain
        if: inputs.source != 'onedir'
        run: |
          mkdir -p ~/.local/relenv
          python3 -m venv venv
          venv/bin/python3 -m pip install ppbt relenv==${{ inputs.relenv-version }}
          venv/bin/python3 -c 'from relenv import common; common.get_toolchain()'

      - name: Download Release Patch
        if: ${{ startsWith(github.event.ref, 'refs/tags') == false }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: salt-${{ inputs.salt-version }}.patch
          path: pkgs/checkout/

      - name: Download MAN Pages
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: man-pages-${{ inputs.salt-version }}
          path: pkgs/checkout/doc/man/

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts
        with:
          cwd: pkgs/checkout/
          cache-prefix: ${{ inputs.cache-prefix }}

      - name: Setup Salt Version
        id: setup-salt-version
        uses: ./.github/actions/setup-salt-version
        with:
          salt-version: "${{ inputs.salt-version }}"
          cwd: pkgs/checkout/

      - name: Configure Git
        if: ${{ startsWith(github.event.ref, 'refs/tags') == false }}
        working-directory: pkgs/checkout/
        run: |
          tools pkg configure-git

      - name: Apply release patch
        if: ${{ startsWith(github.event.ref, 'refs/tags') == false }}
        working-directory: pkgs/checkout/
        run: |
          tools pkg apply-release-patch salt-${{ inputs.salt-version }}.patch --delete
          echo "${{ inputs.salt-version }}" > salt/_version.txt

      - name: Build Deb
        working-directory: pkgs/checkout/
        env:
          SALT_VERSION: "${{ inputs.salt-version }}"
        run: |
          tools pkg build deb --relenv-version=${{ inputs.relenv-version }} --python-version=${{ inputs.python-version }} ${{
              inputs.source == 'onedir' &&
              format('--onedir=salt-{0}-onedir-linux-{1}.tar.xz', inputs.salt-version, matrix.arch)
              ||
              format('--arch={0}', matrix.arch)
          }}

      - name: Cleanup
        run: |
          rm -rf pkgs/checkout/

      - name: Set Artifact Name
        id: set-artifact-name
        run: |
          if [ "${{ inputs.source }}" != "src" ]; then
            echo "artifact-name=salt-${{ inputs.salt-version }}-${{ matrix.arch }}-deb" >> "$GITHUB_OUTPUT"
          else
            echo "artifact-name=salt-${{ inputs.salt-version }}-${{ matrix.arch }}-deb-from-src" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload DEBs
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ${{ steps.set-artifact-name.outputs.artifact-name }}
          path: ${{ github.workspace }}/pkgs/*
          retention-days: 7
          if-no-files-found: error

  build-rpm-packages:
    name: RPM
    environment: ${{ inputs.environment }}
    if: ${{ toJSON(fromJSON(inputs.matrix)['linux']) != '[]' }}
    runs-on:
      - ${{ matrix.arch == 'x86_64' && 'ubuntu-24.04' || inputs.linux_arm_runner }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(inputs.matrix)['linux'] }}

    container:
      image: ghcr.io/saltstack/salt-ci-containers/testing:fedora-42

    env:
      RELENV_DATA: "${{ github.workspace }}/.relenv"

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install rpmsign
        run: |
          dnf install -y rpmsign

      - name: Download Onedir Tarball as an Artifact
        if:  inputs.source == 'onedir'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: salt-${{ inputs.salt-version }}-onedir-linux-${{ matrix.arch }}.tar.xz
          path: artifacts/

      - name: Install toolchain
        if: inputs.source != 'onedir'
        run: |
          mkdir -p ~/.local/relenv
          python3 -m venv venv
          venv/bin/python3 -m pip install ppbt relenv==${{ inputs.relenv-version }}
          venv/bin/python3 -c 'from relenv import common; common.get_toolchain()'

      - name: Download Release Patch
        if: ${{ startsWith(github.event.ref, 'refs/tags') == false }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: salt-${{ inputs.salt-version }}.patch

      - name: Download MAN Pages
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: man-pages-${{ inputs.salt-version }}
          path: doc/man/

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts
        with:
          cache-prefix: ${{ inputs.cache-prefix }}

      - name: Setup Salt Version
        id: setup-salt-version
        uses: ./.github/actions/setup-salt-version
        with:
          salt-version: "${{ inputs.salt-version }}"

      - name: Setup GnuPG
        if: ${{ inputs.sign-rpm-packages }}
        env:
          SIGNING_GPG_KEY: ${{ secrets.SIGNING_GPG_KEY }}
          SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
        run: |
          install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
          GNUPGHOME="$(mktemp -d -p /run/gpg)"
          export GNUPGHOME
          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
          cat <<EOF > "${GNUPGHOME}/gpg.conf"
          batch
          no-tty
          pinentry-mode loopback
          passphrase-file ${GNUPGHOME}/passphrase
          EOF
          echo "${SIGNING_PASSPHRASE}" > "${GNUPGHOME}/passphrase"
          echo "${SIGNING_GPG_KEY}" | gpg --import -

      - name: Configure Git
        if: ${{ startsWith(github.event.ref, 'refs/tags') == false }}
        run: |
          tools pkg configure-git

      - name: Apply release patch
        if: ${{ startsWith(github.event.ref, 'refs/tags') == false }}
        run: |
          tools pkg apply-release-patch salt-${{ inputs.salt-version }}.patch --delete
          echo "${{ inputs.salt-version }}" > salt/_version.txt

      - name: Build RPM
        env:
          SALT_VERSION: "${{ inputs.salt-version }}"
        run: |
          tools pkg build rpm  --relenv-version=${{ inputs.relenv-version }} --python-version=${{ inputs.python-version }} ${{
              inputs.source == 'onedir' &&
              format('--onedir=salt-{0}-onedir-linux-{1}.tar.xz', inputs.salt-version, matrix.arch)
              ||
              format('--arch={0}', matrix.arch)
          }} ${{ inputs.sign-rpm-packages && '--key-id=64CBBC8173D76B3F' || '' }}

      - name: Set Artifact Name
        id: set-artifact-name
        run: |
          if [ "${{ inputs.source }}" != "src" ]; then
            echo "artifact-name=salt-${{ inputs.salt-version }}-${{ matrix.arch }}-rpm" >> "$GITHUB_OUTPUT"
          else
            echo "artifact-name=salt-${{ inputs.salt-version }}-${{ matrix.arch }}-rpm-from-src" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload RPMs
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ${{ steps.set-artifact-name.outputs.artifact-name }}
          path: ~/rpmbuild/RPMS/${{ matrix.arch == 'arm64' && 'aarch64' || matrix.arch }}/*.rpm
          retention-days: 7
          if-no-files-found: error

  build-macos-pkgs:
    name: macOS
    if: ${{ toJSON(fromJSON(inputs.matrix)['macos']) != '[]' }}
    environment: ${{ inputs.environment }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(inputs.matrix)['macos'] }}
    env:
      PIP_INDEX_URL: https://pypi.org/simple
    runs-on:
      - ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-15-intel' }}

    steps:
      - name: Check Package Signing Enabled
        shell: bash
        id: check-pkg-sign
        run: |
          if [ "${{ inputs.sign-macos-packages }}" == "true" ]; then
            if [ "${{ (secrets.MAC_SIGN_APPLE_ACCT != '' && contains(fromJSON('["nightly", "staging"]'), inputs.environment)) && 'true' || 'false' }}" != "true" ]; then
              MSG="Secrets for signing packages are not available. The packages created will NOT be signed."
              echo "${MSG}"
              echo "${MSG}" >> "${GITHUB_STEP_SUMMARY}"
              echo "sign-pkgs=false" >> "$GITHUB_OUTPUT"
            else
              MSG="The packages created WILL be signed."
              echo "${MSG}"
              echo "${MSG}" >> "${GITHUB_STEP_SUMMARY}"
              echo "sign-pkgs=true" >> "$GITHUB_OUTPUT"
            fi
          else
            MSG="The sign-macos-packages input is false. The packages created will NOT be signed."
            echo "${MSG}"
            echo "${MSG}" >> "${GITHUB_STEP_SUMMARY}"
            echo "sign-pkgs=false" >> "$GITHUB_OUTPUT"
          fi

      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ inputs.ci-python-version }}

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts
        with:
          cache-prefix: ${{ inputs.cache-prefix }}

      - name: Setup Salt Version
        id: setup-salt-version
        uses: ./.github/actions/setup-salt-version
        with:
          salt-version: "${{ inputs.salt-version }}"

      - name: Download Onedir Tarball as an Artifact
        if:  inputs.source == 'onedir'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: salt-${{ inputs.salt-version }}-onedir-macos-${{ matrix.arch }}.tar.xz
          path: artifacts/

      - name: Download MAN Pages
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: man-pages-${{ inputs.salt-version }}
          path: doc/man/

      - name: Setup Keychain
        if: ${{ steps.check-pkg-sign.outputs.sign-pkgs == 'true' }}
        env:
          APP_CERT_BASE64: "${{ secrets.MAC_SIGN_DEV_APP_CERT_B64 }}"
          INS_CERT_BASE64: "${{ secrets.MAC_SIGN_DEV_INSTALL_CERT_B64 }}"
          SIGNING_PASSWORD: "${{ secrets.MAC_SIGN_DEV_PASSWORD }}"
          KEYCHAIN_NAME: "${{ secrets.MAC_SIGN_DEV_KEYCHAIN }}"
        run: |
          # https://docs.github.com/en/actions/how-tos/deploy/deploy-to-third-party-platforms/sign-xcode-applications#add-a-step-to-your-workflow

          # Create variables
          APP_CERT_PATH="$RUNNER_TEMP/app_cert.p12"
          INS_CERT_PATH="$RUNNER_TEMP/installer_cert.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/$KEYCHAIN_NAME"

          # Decode certificates from secrets
          echo -n "$APP_CERT_BASE64" | base64 --decode -o "$APP_CERT_PATH"
          echo -n "$INS_CERT_BASE64" | base64 --decode -o "$INS_CERT_PATH"

          # Create temporary keychain
          security create-keychain -p "$SIGNING_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$SIGNING_PASSWORD" "$KEYCHAIN_PATH"

          # Import certificates to keychain
          security import "$APP_CERT_PATH" -P "$SIGNING_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security import "$INS_CERT_PATH" -P "$SIGNING_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool,apple: -k "$SIGNING_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"

          # Cleanup certificate files
          rm "$APP_CERT_PATH"
          rm "$INS_CERT_PATH"

      - name: Build MacOS Package
        env:
          SALT_VERSION: "${{ inputs.salt-version }}"
          DEV_APP_CERT: "${{ secrets.MAC_SIGN_DEV_APP_CERT }}"
          DEV_INSTALL_CERT: "${{ secrets.MAC_SIGN_DEV_INSTALL_CERT }}"
          APPLE_ACCT: "${{ secrets.MAC_SIGN_APPLE_ACCT }}"
          APPLE_TEAM_ID: "${{ secrets.MAC_SIGN_APPLE_TEAM_ID }}"
          APP_SPEC_PWD: "${{ secrets.MAC_SIGN_APP_SPEC_PWD }}"
        run: |
          tools pkg build macos --relenv-version=${{ inputs.relenv-version }} --python-version=${{ inputs.python-version }} ${{
              inputs.source == 'onedir' &&
              format(
                '--onedir salt-{0}-onedir-macos-{1}.tar.xz --salt-version {0} {2}',
                inputs.salt-version,
                matrix.arch,
                steps.check-pkg-sign.outputs.sign-pkgs == 'true' && '--sign' || ''
              )
              ||
              format('--salt-version {0}', inputs.salt-version)
          }}

      - name: Clean Keychain
        if: ${{ steps.check-pkg-sign.outputs.sign-pkgs == 'true' }}
        env:
          KEYCHAIN_NAME: "${{ secrets.MAC_SIGN_DEV_KEYCHAIN }}"
        run: |
          # https://docs.github.com/en/actions/how-tos/deploy/deploy-to-third-party-platforms/sign-xcode-applications#add-a-step-to-your-workflow

          # Create Variables
          KEYCHAIN_PATH="$RUNNER_TEMP/$KEYCHAIN_NAME"

          # Cleanup
          security delete-keychain "$KEYCHAIN_PATH"

      - name: Set Artifact Name
        id: set-artifact-name
        run: |
          if [ "${{ inputs.source }}" != "src" ]; then
            echo "artifact-name=salt-${{ inputs.salt-version }}-${{ matrix.arch }}-macos" >> "$GITHUB_OUTPUT"
          else
            echo "artifact-name=salt-${{ inputs.salt-version }}-${{ matrix.arch }}-macos-from-src" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload ${{ matrix.arch }} Package
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ${{ steps.set-artifact-name.outputs.artifact-name }}
          path: pkg/macos/salt-${{ inputs.salt-version }}-py3-*.pkg
          retention-days: 7
          if-no-files-found: error

  build-windows-pkgs:
    name: Windows
    if: ${{ toJSON(fromJSON(inputs.matrix)['windows']) != '[]' }}
    environment: ${{ inputs.environment }}
    strategy:
      fail-fast: false
      max-parallel: 2
      matrix:
        include: ${{ fromJSON(inputs.matrix)['windows'] }}
    runs-on:
      - windows-latest
    env:
      SM_HOST: "${{ secrets.WIN_SIGN_HOST_PROD }}"
      SM_API_KEY: "${{ secrets.WIN_SIGN_API_KEY }}"
      SM_CLIENT_CERT_FILE: "D:\\Certificate_pkcs12.p12"
      SM_CLIENT_CERT_PASSWORD: "${{ secrets.WIN_SIGN_CERT_PASSWORD }}"
      SM_CLIENT_CERT_FILE_B64: "${{ secrets.WIN_SIGN_CERT_FILE_B64 }}"
      WIN_SIGN_CERT_SHA1_HASH: "${{ secrets.WIN_SIGN_CERT_SHA1_HASH }}"
      SM_CODE_SIGNING_CERT_SHA1_HASH: "${{ secrets.WIN_SIGN_CERT_SHA1_HASH }}"
      PIP_INDEX_URL: https://pypi.org/simple

    steps:
      - name: Check Package Signing Enabled
        shell: bash
        id: check-pkg-sign
        run: |
          if [ "${{ inputs.sign-windows-packages }}" == "true" ]; then
            if [ "${{ (secrets.WIN_SIGN_API_KEY != '' && env.SM_HOST != '' && inputs.environment == 'staging') && 'true' || 'false' }}" != "true" ]; then
              MSG="Secrets for signing packages are not available. The packages created will NOT be signed."
              echo "${MSG}"
              echo "${MSG}" >> "${GITHUB_STEP_SUMMARY}"
              echo "sign-pkgs=false" >> "$GITHUB_OUTPUT"
            else
              MSG="The packages created WILL be signed."
              echo "${MSG}"
              echo "${MSG}" >> "${GITHUB_STEP_SUMMARY}"
              echo "sign-pkgs=true" >> "$GITHUB_OUTPUT"
            fi
          else
            MSG="The sign-windows-packages input is false. The packages created will NOT be signed."
            echo "${MSG}"
            echo "${MSG}" >> "${GITHUB_STEP_SUMMARY}"
            echo "sign-pkgs=false" >> "$GITHUB_OUTPUT"
          fi

      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ inputs.ci-python-version }}

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts
        with:
          cache-prefix: ${{ inputs.cache-prefix }}

      - name: Setup Salt Version
        id: setup-salt-version
        uses: ./.github/actions/setup-salt-version
        with:
          salt-version: "${{ inputs.salt-version }}"

      - name: Download Onedir Tarball as an Artifact
        if:  inputs.source == 'onedir'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: salt-${{ inputs.salt-version }}-onedir-windows-${{ matrix.arch }}.zip
          path: artifacts/

      - name: Download MAN Pages
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: man-pages-${{ inputs.salt-version }}
          path: doc/man/

      - name: Setup Certificate
        if: ${{ steps.check-pkg-sign.outputs.sign-pkgs == 'true' }}
        shell: bash
        run: |
          echo "${{ secrets.WIN_SIGN_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12

      - name: Code signing with Software Trust Manager
        if: ${{ steps.check-pkg-sign.outputs.sign-pkgs == 'true' }}
        uses: digicert/ssm-code-signing@v1.2.1

      - name: Build Windows Packages
        env:
          SALT_VERSION: "${{ inputs.salt-version }}"
        run: |
          tools pkg build windows --relenv-version=${{ inputs.relenv-version }} --python-version=${{ inputs.python-version }} ${{
            inputs.source == 'onedir' &&
            format(
              '--onedir salt-{0}-onedir-windows-{1}.zip --salt-version {0} --arch {1} {2}',
              inputs.salt-version,
              matrix.arch,
              steps.check-pkg-sign.outputs.sign-pkgs == 'true' && '--sign' || ''
            )
            ||
            format('--salt-version {0} --arch {1}', inputs.salt-version, matrix.arch)
          }}

      - name: Set Artifact Name
        id: set-artifact-name
        shell: bash
        run: |
          if [ "${{ inputs.source }}" != "src" ]; then
            echo "artifact-name-nsis=salt-${{ inputs.salt-version }}-${{ matrix.arch }}-NSIS" >> "$GITHUB_OUTPUT"
            echo "artifact-name-msi=salt-${{ inputs.salt-version }}-${{ matrix.arch }}-MSI" >> "$GITHUB_OUTPUT"
          else
            echo "artifact-name-nsis=salt-${{ inputs.salt-version }}-${{ matrix.arch }}-NSIS-from-src" >> "$GITHUB_OUTPUT"
            echo "artifact-name-msi=salt-${{ inputs.salt-version }}-${{ matrix.arch }}-MSI-from-src" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload ${{ matrix.arch }} NSIS Packages
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ${{ steps.set-artifact-name.outputs.artifact-name-nsis }}
          path: pkg/windows/build/Salt-*.exe
          retention-days: 7
          if-no-files-found: error

      - name: Upload ${{ matrix.arch }} MSI Package
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ${{ steps.set-artifact-name.outputs.artifact-name-msi }}
          path: pkg/windows/build/Salt-*.msi
          retention-days: 7
          if-no-files-found: error