ci(release): smoke-test the built exe before publishing it

.github/workflows/release_exe.yml

@@ -4,19 +4,68 @@ on:
   push:
     branches:
       - main
+
+  # Lets the smoke test run against a branch without publishing anything: the release step
+  # below is gated on a push to main.
+  workflow_dispatch:
+
+# The smoke test adds a real install, so two merges in quick succession can overlap. Queue
+# them rather than cancelling: the release step deletes the tag before recreating it, and a
+# run cancelled inside that window would leave no release at all.
+concurrency:
+  group: release-windows-build
+  cancel-in-progress: false
+
 jobs:
   windows-release:
-    uses: ./.github/workflows/python-job.yml
-    secrets: inherit
-    with:
-      runner: windows-latest
-      python-version: "3.9"
-      run: |
-        pyinstaller --onefile --exclude demo dk-installer.py
-        export RELEASE_TAG=latest
-        gh release delete "${RELEASE_TAG}" -y || true
-        git push origin --delete "${RELEASE_TAG}" || true
-        git tag "${RELEASE_TAG}"
-        git push origin "${RELEASE_TAG}"
-        gh release create "${RELEASE_TAG}" ./dist/dk-installer.exe \
-          --title "Latest Release"
+    runs-on: windows-latest
+    # The install pulls uv, a Python 3.13 and TestGen's dependency tree, so a bad network day
+    # is much slower than a good one.
+    timeout-minutes: 45
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          cache: 'pip'
+          python-version: "3.9"
+
+      - name: Install project dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install .[dev,test]
+
+      - name: Build the executable
+        run: pyinstaller --onefile --exclude demo dk-installer.py
+
+      # Installs TestGen for real in pip mode, checks the app serves, kills the installer and
+      # uninstalls. Ahead of the release step so a failure leaves the previous release in
+      # place instead of replacing it with a broken build.
+      - name: Smoke-test the executable
+        run: python tests/e2e/smoke_exe.py dist/dk-installer.exe
+
+      - name: Upload smoke-test logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: smoke-test-logs
+          path: smoke/
+          if-no-files-found: ignore
+
+      - name: Publish the release
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          export RELEASE_TAG=latest
+          gh release delete "${RELEASE_TAG}" -y || true
+          git push origin --delete "${RELEASE_TAG}" || true
+          git tag "${RELEASE_TAG}"
+          git push origin "${RELEASE_TAG}"
+          gh release create "${RELEASE_TAG}" ./dist/dk-installer.exe \
+            --title "Latest Release"