From 68043d91ef65b2707f01db50749bf02cdd41b1e3 Mon Sep 17 00:00:00 2001
From: Mike Rodriguez <contact@mikethetech.com>
Date: Sat, 19 Sep 2026 04:36:22 -0700
Subject: [PATCH] ci: pin released UMDF baseline

---
 .github/workflows/ci-validation.yml | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci-validation.yml b/.github/workflows/ci-validation.yml
index 10efb56..3b153e5 100644
--- a/.github/workflows/ci-validation.yml
+++ b/.github/workflows/ci-validation.yml
@@ -28,6 +28,10 @@ env:
   BUILD_CONFIGURATION: Release
   VDD_SOLUTION: Virtual Display Driver (HDR)/MttVDD.sln
   CONTROL_PANEL_DIR: VirtualDriverControl
+  # Keep the project's Windows 10-compatible released UMDF baseline. Never
+  # select the highest directory from the runner: WDKs can contain preview WDF
+  # headers (for example 2.35) that retail Windows rejects at load time.
+  UMDF_VERSION: '2.25'
   # Signing is deliberate: release tags sign automatically, and a manual run
   # must explicitly opt in. Pull requests and ordinary branch pushes never
   # receive the SignPath token.
@@ -125,7 +129,7 @@ jobs:
           $sln = "${{ env.VDD_SOLUTION }}"
           if (-not (Test-Path $sln)) { throw "VDD solution file not found at: $sln" }
 
-          # Pick an available UMDF WDF header version on the runner.
+          # Resolve the project's explicitly supported UMDF WDF headers.
           # Kits can be laid out either versioned:
           #   Include\<sdk>\wdf\umdf\2.xx
           # or unversioned:
@@ -139,17 +143,17 @@ jobs:
             throw "UMDF WDF include root not found under $env:WINDOWS_SDK_DIR (tried versioned + unversioned layouts)"
           }
 
-          $umdfBest =
+          $umdfDirectory =
             $umdfRoots |
-            ForEach-Object { Get-ChildItem -Path $_ -Directory -ErrorAction SilentlyContinue } |
-            Where-Object { $_.Name -match '^\d+\.\d+$' } |
-            Sort-Object -Property Name -Descending |
+            ForEach-Object { Get-ChildItem -Path $_ -Directory -Filter $env:UMDF_VERSION -ErrorAction SilentlyContinue } |
             Select-Object -First 1
 
-          if (-not $umdfBest) { throw "No UMDF version directories found under: $($umdfRoots -join ', ')" }
+          if (-not $umdfDirectory) {
+            throw "Released UMDF $env:UMDF_VERSION headers were not found under: $($umdfRoots -join ', ')"
+          }
 
-          $umdfMinor = ($umdfBest.Name -split '\.')[1]
-          Write-Output "Using UMDF version: $($umdfBest.Name) (minor=$umdfMinor) from $($umdfBest.FullName)"
+          $umdfMinor = ($env:UMDF_VERSION -split '\.')[1]
+          Write-Output "Using pinned UMDF version: $env:UMDF_VERSION (minor=$umdfMinor) from $($umdfDirectory.FullName)"
 
           $now = [DateTime]::UtcNow
           $driverVersion = $env:RELEASE_VERSION
@@ -256,6 +260,11 @@ jobs:
             }
           }
 
+          $inf = Join-Path $dest "MttVDD.inf"
+          if ((Select-String -Path $inf -Pattern "^UmdfLibraryVersion=$([regex]::Escape($env:UMDF_VERSION))\.0\s*$").Count -ne 1) {
+            throw "Built INF does not target the required released UMDF $env:UMDF_VERSION baseline"
+          }
+
       - name: Upload unsigned driver package
         id: upload_unsigned_driver_package
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1