root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(release): honor --publish never, guard Windows signing, fix desktop spawn

Browse Source 
Second pass after the cache/arch fix unblocked `pnpm build` and surfaced
later-stage failures:

- Desktop packaging called `pnpm --filter @fusion/desktop dist:mac -- <args>`,
  but pnpm leaks the `--` separator into the script args. electron-builder
  stops parsing at `--`, so `--publish never` was ignored — it auto-published
  to api.github.com/repos/gsxdsm/fusion/releases and 404'd. The same leak
  dropped Linux's `--x64 --arm64`. Switch all four desktop packaging steps to
  `pnpm --filter @fusion/desktop exec electron-builder ...`, which forwards
  args cleanly (verified locally).
- Windows CLI signing now skips when WINDOWS_CERTIFICATE_BASE64 is absent,
  mirroring the macOS guard (was hard-failing the bun-windows-x64 job).
- Desktop build spawns workspace .cmd bins with shell:true on Windows; Node
  rejects .cmd/.bat spawns without a shell (EINVAL) since CVE-2024-27980,
  which broke `@fusion/desktop build` on the Windows runner.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
gsxdsm
2026-05-30 00:30:39 -07:00
parent f659a07a25
commit 4148f43ce4
3 changed files with 29 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
.changeset/fix-release-binary-publishing.md Normal file
View File

@@ -0,0 +1,12 @@
---
"@runfusion/fusion": patch
---
Fix the Binary Release workflow so platform binaries publish to GitHub Releases again:
- The release job now tolerates a single failing build leg instead of being skipped, which previously suppressed all assets.
- The node_modules cache key includes CPU arch so arm64 runners no longer restore x64 native deps (fixes the `@rollup/rollup-linux-arm64-gnu` build crash).
- The macOS and Windows CLI signing steps are skipped gracefully when their certificate secrets are absent, so unsigned binaries still publish.
- Desktop packaging now invokes `electron-builder` directly via `pnpm exec` instead of the `dist:*` scripts: pnpm leaked the `--` separator into script args, which made electron-builder ignore `--publish never` (auto-publishing to the wrong repo and 404ing) and drop the Linux `--x64 --arm64` flags.
- The desktop build spawns workspace `.cmd` bins with a shell on Windows, fixing the `spawn EINVAL` failure.
- The dependency-graph plugin build uses a cross-platform copy step that no longer breaks the Windows desktop build.