ci: add manual windows internal installer build

.github/workflows/build-windows-manual.yml

@@ -0,0 +1,112 @@
+name: Build Windows Internal Installer
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Internal test installer version"
+        required: true
+        default: "0.1.1"
+      artifact_name:
+        description: "Uploaded artifact name"
+        required: true
+        default: "Guanghu-Windows-x64-internal"
+
+env:
+  NODE_OPTIONS: --max-old-space-size=4096
+  RUST_TARGET_CACHE_VERSION: v2026-07-16-guanghu-windows-internal
+
+jobs:
+  build-windows:
+    name: Build Windows x64 internal installer
+    runs-on: windows-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "pnpm"
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-pc-windows-msvc
+
+      - name: Cache Rust dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~\.cargo\registry
+            ~\.cargo\git
+            src-tauri\target
+          key: ${{ runner.os }}-internal-windows-cargo-x86_64-pc-windows-msvc-${{ env.RUST_TARGET_CACHE_VERSION }}-${{ hashFiles('src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-internal-windows-cargo-x86_64-pc-windows-msvc-${{ env.RUST_TARGET_CACHE_VERSION }}-
+
+      - name: Cache Tauri Windows tools
+        uses: actions/cache@v4
+        with:
+          path: ~\AppData\Local\tauri
+          key: ${{ runner.os }}-tauri-tools-nsis-3.11-nsis-tauri-utils-0.5.3
+
+      - name: Prefetch Tauri NSIS toolchain
+        shell: pwsh
+        run: ./.github/scripts/prefetch-tauri-nsis.ps1
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Clear cached Windows bundle artifacts
+        shell: pwsh
+        run: |
+          Remove-Item -Recurse -Force -ErrorAction SilentlyContinue "src-tauri/target/x86_64-pc-windows-msvc/release/bundle"
+
+      - name: Set internal app version
+        shell: pwsh
+        run: |
+          $version = "${{ inputs.version }}"
+          $tauri = Get-Content "src-tauri/tauri.conf.json" | ConvertFrom-Json
+          $tauri.version = $version
+          $tauri | ConvertTo-Json -Depth 100 | Set-Content "src-tauri/tauri.conf.json"
+          (Get-Content "src-tauri/Cargo.toml") -replace '^version = ".*"$', "version = `"$version`"" | Set-Content "src-tauri/Cargo.toml"
+
+      - name: Build unsigned NSIS installer for internal testing
+        shell: pwsh
+        env:
+          VITE_SENTRY_DSN: ""
+          SENTRY_DSN: ""
+          VITE_POSTHOG_KEY: ""
+          VITE_POSTHOG_HOST: ""
+        run: |
+          pnpm tauri build --target x86_64-pc-windows-msvc --bundles nsis
+
+      - name: Validate installer
+        shell: pwsh
+        run: |
+          $bundleDir = "src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis"
+          $installers = @(Get-ChildItem -Path $bundleDir -Filter "*-setup.exe" -File -ErrorAction SilentlyContinue)
+          if ($installers.Count -eq 0) {
+            throw "Windows build produced no NSIS setup executable."
+          }
+          foreach ($installer in $installers) {
+            if ($installer.Name -notlike "*${{ inputs.version }}*") {
+              throw "Windows installer has unexpected version in filename: $($installer.Name)"
+            }
+            Write-Host "Built Windows internal installer: $($installer.FullName)"
+          }
+
+      - name: Upload Windows internal installer
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ inputs.artifact_name }}
+          path: src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe
+          if-no-files-found: error
+          retention-days: 7