Add AArch64 Windows build support and fix related CI failures

[Copilot]

Adds CI jobs for AArch64 targets (windows-11-arm, ubuntu-24.04-arm) and fixes three issues that surfaced as a result.

CI workflow

• New jobs: build-windows-binary-aarch64 (windows-11-arm) and build-pam-module-aarch64 (ubuntu-24.04-arm)
• Both jobs upload artifacts; the release job assembles them into a separate release-aarch64.tar.gz

windows crate: 0.32 → 0.39

windows_aarch64_msvc-0.32.0 ships an x64-compiled windows.lib, causing link errors on the ARM64 runner. 0.39 ships a correct ARM64 library. API adaptations required by the bump:

• alloc feature removed — dropped from Cargo.toml
• WinRT string params now require &HSTRING instead of &str
• IBuffer params now require a borrow (&buffer)
• FindWindowW takes &HSTRING + PCWSTR::null() instead of &str + PWSTR(null_mut())
• HWND null check via hwnd.0 != 0 (.ok() removed)

Strip handling

GNU strip on the windows-11-arm runner can't process ARM64 PE binaries. Removed the explicit strip calls from the Makefile for both targets and replaced with cargo's built-in strip = "symbols" in [profile.release], which uses the correct platform-native mechanism.

Clippy

New mismatched_lifetime_syntaxes lint: Cow<str> → Cow<'_, str> in wsl_hello_pam/src/auth.rs.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

Adds AArch64 (ARM64) build support to the project’s CI/release pipeline and updates the Windows bridge implementation to work on ARM64 runners by bumping the windows crate and adjusting affected API calls.

Changes:

• Add CI jobs to build Windows + PAM artifacts for AArch64 and package them into a separate release-aarch64.tar.gz.
• Bump windows crate 0.32 → 0.39 and update WinRT/Win32 call sites for the new signatures.
• Replace manual strip invocations with Cargo’s [profile.release] strip = "symbols"; address a new clippy lifetime-syntax lint.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
wsl_hello_pam/src/auth.rs	Updates Cow lifetime syntax to satisfy new clippy linting.
win_hello_bridge/src/creator.rs	Adapts WinRT APIs to windows 0.39 (HSTRING / IBuffer borrowing changes).
win_hello_bridge/src/authenticator.rs	Adapts WinRT/Win32 calls to windows 0.39 and updates FindWindowW usage.
win_hello_bridge/Cargo.toml	Bumps windows dependency to 0.39 and removes the alloc feature.
Makefile	Removes explicit strip calls now that stripping is handled by Cargo.
Cargo.toml	Enables release stripping via strip = "symbols".
Cargo.lock	Adds/updates lockfile for the workspace after dependency changes.
.github/workflows/cicd.yaml	Adds AArch64 build jobs and packages/upload AArch64 release artifacts.

Comments suppressed due to low confidence (3)

win_hello_bridge/src/authenticator.rs:22

• Similar to creator.rs, this call allocates a new HSTRING from key_name inline. Consider creating the HSTRING once near the start of verify_user and reusing it for OpenAsync (and any other WinRT calls) to reduce allocations and keep the parameter handling consistent.

    let key = {
        let result = KeyCredentialManager::OpenAsync(&HSTRING::from(key_name))?.get()?;
        FailureReason::from_credential_status(result.Status()?, key_name)?;

win_hello_bridge/src/creator.rs:24

• HSTRING::from(key_name) is being re-created multiple times within a single call (for RequestCreateAsync and again in the CredentialExists branch). Consider converting key_name to an HSTRING once (e.g., let key_name_h = HSTRING::from(key_name);) and reusing a borrowed reference to reduce allocations and simplify the code.

        let result = KeyCredentialManager::RequestCreateAsync(
            &HSTRING::from(key_name),
            KeyCredentialCreationOption::FailIfExists,
        )?
        .get()?;

        match FailureReason::from_credential_status(result.Status()?, key_name) {
            Ok(()) => result
                .Credential()?
                .RetrievePublicKeyWithDefaultBlobType()?,
            Err(FailureReason::CredentialExists) => {
                let result = KeyCredentialManager::OpenAsync(&HSTRING::from(key_name))?.get()?;
                FailureReason::from_credential_status(result.Status()?, key_name)?;

win_hello_bridge/src/authenticator.rs:49

• class_name is allocated as an HSTRING on every iteration of this polling loop. Since the class name is constant, move let class_name = HSTRING::from(...) outside the loop to avoid repeated allocations while waiting for the window to appear.

        let hwnd = loop {
            let class_name = HSTRING::from("Credential Dialog Xaml Host");
            let hwnd = unsafe { FindWindowW(&class_name, PCWSTR::null()) };

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.