fix(release): publish signed builds without Windows certificate - #87
Merged
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 72ef366c82
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+344
to
+345
| if [[ "$platform" == 'windows' ]] && ! compgen -G 'release-assets/*-setup.exe' >/dev/null; then | ||
| continue |
There was a problem hiding this comment.
When a non-draft, non-prerelease release is published with the default electron_bridge=true, these lines omit latest.yml, but the same workflow still passes --latest at line 363. gh release create --help defines --latest as “Mark this release as Latest,” while docs/design/desktop-electron-to-tauri-update-bridge.md:5 confirms that Windows Electron clients read latest.yml from the latest stable release. Those clients will therefore fail their update check instead of continuing to use the previous compatible bridge release; avoid marking this partial bridge release as Latest or retain a valid Windows bridge feed.
Useful? React with 👍 / 👎.
Comment on lines
33
to
+34
| for (const [platform, artifact] of platformArtifacts) { | ||
| if (!artifact) continue; |
There was a problem hiding this comment.
When a stable publish has no Windows artifact, this branch removes windows-x86_64 from latest.json, after which .github/workflows/desktop-build.yml:368-391 clobbers the shared desktop-latest feed with that incomplete manifest. Windows Tauri builds use this exact endpoint through packages/desktop-shell/src-tauri/tauri.conf.json:72-75, so their updater has no matching platform descriptor and update checks fail until a later release restores one. Use platform-specific feeds or otherwise avoid replacing the Windows-consumed feed with a manifest that lacks Windows.
Useful? React with 👍 / 👎.
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Published desktop releases build signed macOS and Linux installers while Windows remains in dry-run CI coverage. Update manifests omit Windows only when no Windows installer exists, and still require exactly one signed artifact for every platform that is published.
Why it's needed
The first OpenWork 0.2.1 release attempt failed before building because the repository has no Windows Authenticode certificate. Publishing an unsigned Windows installer would weaken release security, so this keeps Windows validation available without blocking signed macOS and Linux releases.
Reviewer Test Plan
How to verify
Targeted release contract check:
node packages/desktop-shell/scripts/test-release.jsWorkflow syntax check:
actionlint .github/workflows/desktop-build.yml .github/workflows/desktop-release.ymlEvidence (Before & After)
Before: OpenWork 0.2.1 release run failed during signing validation.
After: the release matrix no longer schedules Windows for a published release without a certificate; dry runs retain Windows coverage.
Tested on
Environment (optional)
Local Node.js release contract and actionlint validation.
Risk & Scope
Linked Issues
N/A
中文说明
这个 PR 做了什么
正式桌面版本只构建已签名的 macOS 和 Linux 安装包，同时继续在 dry-run CI 中保留 Windows 构建覆盖。更新清单会在没有 Windows 安装包时省略 Windows，但仍要求每个实际发布的平台都只能有一个带签名的更新产物。
为什么需要
OpenWork 0.2.1 第一次正式发布在构建前失败，因为仓库没有 Windows Authenticode 证书。发布未签名的 Windows 安装包会降低发布安全性，因此本改动保留 Windows 验证，但不再让它阻塞 macOS 和 Linux 的正式签名发布。
Reviewer Test Plan
如何验证
已运行针对性的发布契约检查：
node packages/desktop-shell/scripts/test-release.js已运行 workflow 语法检查：
actionlint .github/workflows/desktop-build.yml .github/workflows/desktop-release.yml前后对比证据
修复前：OpenWork 0.2.1 发布在签名配置校验阶段失败。
修复后：正式发布不再调度没有证书的 Windows；dry run 仍保留 Windows 覆盖。
已测试平台
环境
本地 Node.js 发布契约检查和 actionlint 校验。
风险与范围
关联问题
N/A