From a73b5ec1ea24097f770c152e429befc1d867e83e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan-Otto=20Kr=C3=B6pke?= <mail@jkroepke.de>
Date: Thu, 15 Oct 2026 22:47:00 +0200
Subject: [PATCH] installer: fail the package build when wix fails or an MSI is
 missing (#2727)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
---
 .github/workflows/ci.yml | 11 ++++++++
 installer/build.ps1      | 54 +++++++++++++++++++++++++++++-----------
 2 files changed, 51 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3a781566..567187eb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -335,6 +335,17 @@ jobs:
       - name: Generate checksums
         run: |
           $ErrorActionPreference = "Stop"
+          $Version = Get-Content output\VERSION
+
+          # Checksum only a complete set of artifacts.
+          foreach($Arch in "amd64", "arm64") {
+            foreach($Extension in "exe", "msi") {
+              $Artifact = "output\windows_exporter-$Version-$Arch.$Extension"
+              if (-not (Test-Path -PathType Leaf $Artifact)) {
+                throw "Missing release artifact $Artifact"
+              }
+            }
+          }
 
           $checksums = Get-ChildItem -Path output -File |
             Where-Object { $_.Name -match '^windows_exporter-.*\.(exe|msi)$' } |
diff --git a/installer/build.ps1 b/installer/build.ps1
index 0ae1a172..da5eb68c 100644
--- a/installer/build.ps1
+++ b/installer/build.ps1
@@ -21,20 +21,46 @@ if (-not $MsiVersion) {
 
 # Get absolute path to executable before switching directories
 $PathToExecutable = Resolve-Path $PathToExecutable
-# Set working dir to this directory, reset previous on exit
+# Set working dir to this directory and restore the previous one on exit,
+# including on errors.
 Push-Location $PSScriptRoot
-Trap {
-    # Reset working dir on error
+try {
+    mkdir -Force Work | Out-Null
+    Copy-Item -Force $PathToExecutable Work/windows_exporter.exe
+
+    $msi = "windows_exporter-$Version-$Arch.msi"
+    Write-Verbose "Creating $msi"
+    $wixArch = @{"amd64" = "x64"; "arm64" = "arm64"}[$Arch]
+
+    # A package left over from an earlier build must not pass for this one.
+    if (Test-Path $msi) { Remove-Item -Force $msi }
+
+    # Pass the arguments as an array so that values such as the version are
+    # never parsed as PowerShell code.
+    $wixArgs = @(
+        "build"
+        "-sw1149"
+        "-arch", $wixArch
+        "-o", ".\$msi"
+        ".\files.wxs"
+        ".\main.wxs"
+        "-d", "ProductName=windows_exporter"
+        "-d", "Version=$MsiVersion"
+        "-ext", "WixToolset.Firewall.wixext"
+        "-ext", "WixToolset.UI.wixext"
+        "-ext", "WixToolset.Util.wixext"
+    )
+    & wix @wixArgs
+    # $ErrorActionPreference does not apply to native commands.
+    if ($LASTEXITCODE -ne 0) {
+        throw "wix build failed with exit code $LASTEXITCODE for $msi"
+    }
+
+    if (-not (Test-Path -PathType Leaf $msi)) {
+        throw "wix build did not create $msi"
+    }
+
+    Write-Verbose "Done!"
+} finally {
     Pop-Location
 }
-
-mkdir -Force Work | Out-Null
-Copy-Item -Force $PathToExecutable Work/windows_exporter.exe
-
-Write-Verbose "Creating windows_exporter-${Version}-${Arch}.msi"
-$wixArch = @{"amd64" = "x64"; "arm64" = "arm64"}[$Arch]
-
-Invoke-Expression "wix build -sw1149 -arch $wixArch -o .\windows_exporter-$($Version)-$($Arch).msi .\files.wxs .\main.wxs -d ProductName=windows_exporter -d Version=$($MsiVersion) -ext WixToolset.Firewall.wixext -ext WixToolset.UI.wixext -ext WixToolset.Util.wixext"
-
-Write-Verbose "Done!"
-Pop-Location