fix(release): honor --publish never, guard Windows signing, fix desktop spawn

Second pass after the cache/arch fix unblocked `pnpm build` and surfaced
later-stage failures:

- Desktop packaging called `pnpm --filter @fusion/desktop dist:mac -- <args>`,
  but pnpm leaks the `--` separator into the script args. electron-builder
  stops parsing at `--`, so `--publish never` was ignored — it auto-published
  to api.github.com/repos/gsxdsm/fusion/releases and 404'd. The same leak
  dropped Linux's `--x64 --arm64`. Switch all four desktop packaging steps to
  `pnpm --filter @fusion/desktop exec electron-builder ...`, which forwards
  args cleanly (verified locally).
- Windows CLI signing now skips when WINDOWS_CERTIFICATE_BASE64 is absent,
  mirroring the macOS guard (was hard-failing the bun-windows-x64 job).
- Desktop build spawns workspace .cmd bins with shell:true on Windows; Node
  rejects .cmd/.bat spawns without a shell (EINVAL) since CVE-2024-27980,
  which broke `@fusion/desktop build` on the Windows runner.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.changeset/fix-release-binary-publishing.md

@@ -0,0 +1,12 @@
+---
+"@runfusion/fusion": patch
+---
+
+Fix the Binary Release workflow so platform binaries publish to GitHub Releases again:
+
+- The release job now tolerates a single failing build leg instead of being skipped, which previously suppressed all assets.
+- The node_modules cache key includes CPU arch so arm64 runners no longer restore x64 native deps (fixes the `@rollup/rollup-linux-arm64-gnu` build crash).
+- The macOS and Windows CLI signing steps are skipped gracefully when their certificate secrets are absent, so unsigned binaries still publish.
+- Desktop packaging now invokes `electron-builder` directly via `pnpm exec` instead of the `dist:*` scripts: pnpm leaked the `--` separator into script args, which made electron-builder ignore `--publish never` (auto-publishing to the wrong repo and 404ing) and drop the Linux `--x64 --arm64` flags.
+- The desktop build spawns workspace `.cmd` bins with a shell on Windows, fixing the `spawn EINVAL` failure.
+- The dependency-graph plugin build uses a cross-platform copy step that no longer breaks the Windows desktop build.

.github/workflows/release.yml

@@ -25,10 +25,11 @@ jobs:
     name: Build ${{ matrix.target }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
-    # Job-level env so the macOS signing step's `if:` can detect whether the
+    # Job-level env so the signing steps' `if:` can detect whether the
-    # Apple certificate secret is configured (secrets can't be read in `if:` directly).
+    # signing certificate secrets are configured (secrets can't be read in `if:` directly).
     env:
       APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
+      WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
     strategy:
       fail-fast: false
       matrix:
@@ -82,9 +83,10 @@ jobs:
         run: bash scripts/sign-macos.sh packages/cli/dist/${{ matrix.binary }} packages/cli/dist/runtime
 
       - name: Sign Windows binary
-        if: runner.os == 'Windows'
+        # Skip when the Windows certificate secret is absent so unsigned binaries
+        # still publish, mirroring the macOS signing fallback.
+        if: ${{ runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 != '' }}
         env:
-          WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
           WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
         run: pwsh scripts/sign-windows.ps1 packages/cli/dist/${{ matrix.binary }}
 
@@ -138,7 +140,10 @@ jobs:
         run: pnpm --filter @fusion/desktop build
 
       - name: Package Windows desktop EXE
-        run: pnpm --filter @fusion/desktop dist:win -- --publish never
+        # Use `exec electron-builder` rather than the `dist:win` script: pnpm leaks
+        # the `--` separator into script args (electron-builder then stops parsing
+        # at `--` and ignores `--publish never`, auto-publishing to the wrong repo).
+        run: pnpm --filter @fusion/desktop exec electron-builder --win --publish never
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -191,7 +196,7 @@ jobs:
 
       - name: Package signed macOS desktop DMG/ZIP
         if: ${{ env.APPLE_CERTIFICATE_BASE64 != '' }}
-        run: pnpm --filter @fusion/desktop dist:mac -- --publish never
+        run: pnpm --filter @fusion/desktop exec electron-builder --mac --publish never
         env:
           APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
           CSC_LINK: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
@@ -204,7 +209,7 @@ jobs:
 
       - name: Package unsigned macOS desktop DMG/ZIP
         if: ${{ env.APPLE_CERTIFICATE_BASE64 == '' }}
-        run: pnpm --filter @fusion/desktop dist:mac -- --publish never -c.mac.notarize=false
+        run: pnpm --filter @fusion/desktop exec electron-builder --mac --publish never -c.mac.notarize=false
         env:
           APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
@@ -290,7 +295,7 @@ jobs:
 
       - name: Package Linux desktop artifacts
         # Linux desktop code-signing is deferred to FN-5605; Linux ARM64 CLI binaries are tracked in FN-5606.
-        run: pnpm --filter @fusion/desktop dist:linux -- --x64 --arm64 --publish never
+        run: pnpm --filter @fusion/desktop exec electron-builder --linux --x64 --arm64 --publish never
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

packages/desktop/scripts/workspace-tools.ts

@@ -23,6 +23,10 @@ export function runWorkspaceBin(command: string, args: string[], cwd: string): P
       cwd,
       stdio: "inherit",
       env: process.env,
+      // On Windows the resolved bin is a .cmd shim; Node refuses to spawn
+      // .cmd/.bat without a shell (EINVAL) since CVE-2024-27980. resolveBin
+      // produces an absolute, space-free path, so shell quoting is safe here.
+      shell: process.platform === "win32",
     });
 
     child.on("error", rejectPromise);