root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(release): honor --publish never, guard Windows signing, fix desktop spawn

Browse Source 
Second pass after the cache/arch fix unblocked `pnpm build` and surfaced
later-stage failures:

- Desktop packaging called `pnpm --filter @fusion/desktop dist:mac -- <args>`,
  but pnpm leaks the `--` separator into the script args. electron-builder
  stops parsing at `--`, so `--publish never` was ignored — it auto-published
  to api.github.com/repos/gsxdsm/fusion/releases and 404'd. The same leak
  dropped Linux's `--x64 --arm64`. Switch all four desktop packaging steps to
  `pnpm --filter @fusion/desktop exec electron-builder ...`, which forwards
  args cleanly (verified locally).
- Windows CLI signing now skips when WINDOWS_CERTIFICATE_BASE64 is absent,
  mirroring the macOS guard (was hard-failing the bun-windows-x64 job).
- Desktop build spawns workspace .cmd bins with shell:true on Windows; Node
  rejects .cmd/.bat spawns without a shell (EINVAL) since CVE-2024-27980,
  which broke `@fusion/desktop build` on the Windows runner.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
gsxdsm
2026-05-30 00:30:39 -07:00
parent f659a07a25
commit 4148f43ce4
3 changed files with 29 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
.changeset/fix-release-binary-publishing.md Normal file
View File

@@ -0,0 +1,12 @@
---
"@runfusion/fusion": patch
---
Fix the Binary Release workflow so platform binaries publish to GitHub Releases again:
- The release job now tolerates a single failing build leg instead of being skipped, which previously suppressed all assets.
- The node_modules cache key includes CPU arch so arm64 runners no longer restore x64 native deps (fixes the `@rollup/rollup-linux-arm64-gnu` build crash).
- The macOS and Windows CLI signing steps are skipped gracefully when their certificate secrets are absent, so unsigned binaries still publish.
- Desktop packaging now invokes `electron-builder` directly via `pnpm exec` instead of the `dist:*` scripts: pnpm leaked the `--` separator into script args, which made electron-builder ignore `--publish never` (auto-publishing to the wrong repo and 404ing) and drop the Linux `--x64 --arm64` flags.
- The desktop build spawns workspace `.cmd` bins with a shell on Windows, fixing the `spawn EINVAL` failure.
- The dependency-graph plugin build uses a cross-platform copy step that no longer breaks the Windows desktop build.

21
.github/workflows/release.yml vendored
View File

@@ -25,10 +25,11 @@ jobs:
name: Build ${{ matrix.target }}
runs-on: ${{ matrix.os }}
timeout-minutes: 30
# Job-level env so the macOS signing step's `if:` can detect whether the
# Apple certificate secret is configured (secrets can't be read in `if:` directly).
# Job-level env so the signing steps' `if:` can detect whether the
# signing certificate secrets are configured (secrets can't be read in `if:` directly).
env:
APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
strategy:
fail-fast: false
matrix:
@@ -82,9 +83,10 @@ jobs:
run: bash scripts/sign-macos.sh packages/cli/dist/${{ matrix.binary }} packages/cli/dist/runtime
- name: Sign Windows binary
if: runner.os == 'Windows'
# Skip when the Windows certificate secret is absent so unsigned binaries
# still publish, mirroring the macOS signing fallback.
if: ${{ runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 != '' }}
env:
WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
run: pwsh scripts/sign-windows.ps1 packages/cli/dist/${{ matrix.binary }}
@@ -138,7 +140,10 @@ jobs:
run: pnpm --filter @fusion/desktop build
- name: Package Windows desktop EXE
run: pnpm --filter @fusion/desktop dist:win -- --publish never
# Use `exec electron-builder` rather than the `dist:win` script: pnpm leaks
# the `--` separator into script args (electron-builder then stops parsing
# at `--` and ignores `--publish never`, auto-publishing to the wrong repo).
run: pnpm --filter @fusion/desktop exec electron-builder --win --publish never
env:
CSC_IDENTITY_AUTO_DISCOVERY: "false"
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -191,7 +196,7 @@ jobs:
- name: Package signed macOS desktop DMG/ZIP
if: ${{ env.APPLE_CERTIFICATE_BASE64 != '' }}
run: pnpm --filter @fusion/desktop dist:mac -- --publish never
run: pnpm --filter @fusion/desktop exec electron-builder --mac --publish never
env:
APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
CSC_LINK: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
@@ -204,7 +209,7 @@ jobs:
- name: Package unsigned macOS desktop DMG/ZIP
if: ${{ env.APPLE_CERTIFICATE_BASE64 == '' }}
run: pnpm --filter @fusion/desktop dist:mac -- --publish never -c.mac.notarize=false
run: pnpm --filter @fusion/desktop exec electron-builder --mac --publish never -c.mac.notarize=false
env:
APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
CSC_IDENTITY_AUTO_DISCOVERY: "false"
@@ -290,7 +295,7 @@ jobs:
- name: Package Linux desktop artifacts
# Linux desktop code-signing is deferred to FN-5605; Linux ARM64 CLI binaries are tracked in FN-5606.
run: pnpm --filter @fusion/desktop dist:linux -- --x64 --arm64 --publish never
run: pnpm --filter @fusion/desktop exec electron-builder --linux --x64 --arm64 --publish never
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

4
packages/desktop/scripts/workspace-tools.ts
View File

@@ -23,6 +23,10 @@ export function runWorkspaceBin(command: string, args: string[], cwd: string): P
cwd,
stdio: "inherit",
env: process.env,
// On Windows the resolved bin is a .cmd shim; Node refuses to spawn
// .cmd/.bat without a shell (EINVAL) since CVE-2024-27980. resolveBin
// produces an absolute, space-free path, so shell quoting is safe here.
shell: process.platform === "win32",
});
child.on("error", rejectPromise);