Repository navigation
ci(desktop): fix release signing and allow attaching the app to an existing release - #95
Merged
Merged
Conversation
…isting release - Secrets that are not configured arrive as empty strings; electron-builder treats an empty CSC_LINK as a certificate path and fails with "<dir> not a file", which broke the v1.4.0 release build. Unset the signing variables when no certificate is configured so the build falls back to ad-hoc signing. - Set CSC_FOR_PULL_REQUEST so pull request builds sign too: electron-builder skips signing on PRs by default, which is why PR CI never caught this. - workflow_dispatch accepts a tag: it builds that tag and uploads the .dmg/.zip to its release, to fill in v1.4.0 and any future release whose build needs a retry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QnDqAyRdicRYnwAAXydYoB
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Fixes the Desktop App build that failed on the v1.4.0 release (run):
Root cause: the signing secrets aren't configured, so
CSC_LINKarrives as an empty string. electron-builder only skips signing whenCSC_LINKisnull. An empty string goes toimportCertificate(""), which resolves to the current directory and fails with "not a file". I reproduced this locally with the same electron-builder version. Pull request builds never hit it because electron-builder skips signing on PRs by default.Changes (
.github/workflows/desktop.ymlonly):CSC_LINK/CSC_KEY_PASSWORDbefore building. electron-builder then falls back to the ad-hoc identity (-) already set inelectron-builder.config.cjs.CSC_FOR_PULL_REQUEST=trueso PR builds sign exactly like releases. This PR's own CI therefore exercises the fixed path. Fork PRs never receive secrets, so this only affects same-repo PRs.workflow_dispatchtakes an optionaltag. It checks out that tag, builds it and uploads the.dmg/.zipto its release. The tag goes through an env var, not interpolated into the script. This is how v1.4.0 gets its app after this merges: a rerun of the failed job would use the old workflow file from the tag.Type of change
Related issue
Follow-up to #91 (release 1.4.0).
Checklist
bun run lintpasses (no source changes)bun run testpasses (no source changes)bun run buildsucceedsNotes for reviewer
The npm publish for 1.4.0 also failed, with
404 Not Found - PUT https://registry.npmjs.org/mac-cleaner-cli. That comes from theNPM_TOKENsecret, not from code: the token no longer has publish rights, most likely because it expired. It needs a new token in the repo secrets, then a re-run of the failedpublishjob.🤖 Generated with Claude Code
https://claude.ai/code/session_01QnDqAyRdicRYnwAAXydYoB
Generated by Claude Code