## Summary
- **Windows CI:** run the embedded Postgres smoke as non-admin
`fusion-pg` (with profile prewarm) so elevated `windows-latest` runners
stop failing with PostgreSQL’s admin-token refusal. Packaging still runs
as the job user.
- **Linux AppImage:** add a packaging content verifier for
`main-bootstrap`, `@embedded-postgres` natives, and `omp-runtime` dist
entrypoints; wire it into `release.yml`, `test-release.yml`, and the
advisory **Desktop packaging** PR lane (after `electron-builder --dir`).
- Fix eslint `no-undef` on bare `URL` in the verifier script (was red on
#2131).
## Context
Desktop packaging on Ubuntu was mostly green; Windows desktop builds and
the AppImage packaging PR (#2131 lint) were the remaining red paths. The
win-pg-diag pivot (run smoke as non-admin) proved green on CI; this
ports that approach without removing main’s elevated-token product path
for end-user “Run as administrator” cases (smoke simply does not take
that path when the process is non-admin).
## Test plan
- [x] `pnpm --filter @fusion/desktop exec vitest run
src/__tests__/release-workflow.test.ts`
- [x] `pnpm exec eslint scripts/verify-desktop-linux-pg-packaging.mjs`
- [ ] Desktop packaging workflow on this PR
- [ ] Desktop Windows Build (workflow_dispatch)
- [ ] Confirm #2131 supersession if this lands the same AppImage checks
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Strengthened Linux desktop AppImage validation to confirm embedded
PostgreSQL artifacts, required binaries, symlink hydration, and the
expected app entrypoints are present after packaging.
* Improved Windows embedded PostgreSQL smoke testing by running under a
non-administrator helper user with a prewarmed profile environment.
* **Tests**
* Added automated packaging/release workflow verification steps (Linux
and Windows) to catch embedded PostgreSQL content regressions earlier,
including during artifact build and release verification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Desktop "Local" mode crashed with ERR_MODULE_NOT_FOUND because electron-builder's
pnpm collector drops `deduped` subtrees, so engine's transitive closure
(@modelcontextprotocol/sdk, pi-ai provider SDKs, etc.) was never packed. Stage the
complete flat prod closure with `pnpm deploy --legacy --config.node-linker=hoisted`
and package it via `electron-builder --projectDir deploy`, bypassing the lossy
collector entirely.
Also make the dashboard-imported example plugins loadable under plain Node (the
Electron main runtime): cursor/droid/roadmap now expose compiled `dist` on the
`import` condition (keeping `source`→src for the bun CLI) and are built during the
desktop build. Add `source` conditions to paperclip/agent-browser/even-cards/
even-realities-glasses/whatsapp-chat so the bun `--conditions=source` Windows CLI
compile resolves them from source.
Validated on macOS: @fusion/core|engine|dashboard import cleanly from the staged
deploy; packing yields a complete 705-package asar; bun-windows-x64 cross-compiles
with all plugin dist removed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The github-release job downloaded artifacts but never checked out the repo,
so the new "Extract release notes from CHANGELOG" step threw ENOENT and failed
the whole job — v0.47.0 published 0 binaries despite every bun build succeeding.
Sparse-checkout CHANGELOG.md and harden the notes script to fall back to a plain
release body instead of crashing the publish.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Chain distillation into release:version so both local and CI versioning
flows get distilled notes. Update release.yml to use curated CHANGELOG
notes instead of GitHub's auto-generated release notes.
macos-13 runners are too scarce — the darwin-x64 leg sat queued for hours
and blocked the release publish job (which needs all build legs). Ship the
CLI Apple-Silicon-only for macOS; desktop macOS DMG/ZIP stays universal.
Removed from release.yml + test-release.yml matrices, updated ci-workflow
assertions (5→4 targets) and RELEASING.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
electron-builder emits Fusion-<v>-linux-x86_64.AppImage for x64 (deb uses
amd64, tar.gz uses x64). The verify step globbed -linux-x64.AppImage and
failed with "No Fusion Linux x64 AppImage artifacts produced" even though
the AppImage built. Upload globs already used the broad -linux-*.AppImage.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Lets workflow_dispatch runs build and upload binaries as artifacts for
validation without creating a release (previously dispatch on a branch
would attempt a release tagged with the branch name).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Second pass after the cache/arch fix unblocked `pnpm build` and surfaced
later-stage failures:
- Desktop packaging called `pnpm --filter @fusion/desktop dist:mac -- <args>`,
but pnpm leaks the `--` separator into the script args. electron-builder
stops parsing at `--`, so `--publish never` was ignored — it auto-published
to api.github.com/repos/gsxdsm/fusion/releases and 404'd. The same leak
dropped Linux's `--x64 --arm64`. Switch all four desktop packaging steps to
`pnpm --filter @fusion/desktop exec electron-builder ...`, which forwards
args cleanly (verified locally).
- Windows CLI signing now skips when WINDOWS_CERTIFICATE_BASE64 is absent,
mirroring the macOS guard (was hard-failing the bun-windows-x64 job).
- Desktop build spawns workspace .cmd bins with shell:true on Windows; Node
rejects .cmd/.bat spawns without a shell (EINVAL) since CVE-2024-27980,
which broke `@fusion/desktop build` on the Windows runner.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Binary Release workflow stopped producing any GitHub Release assets
because every release had at least one failing build leg, and the
github-release job (needs: all four builds, no if:) was skipped whenever
any leg failed — suppressing even successfully-built platforms.
Root causes fixed:
- github-release: add `if: !cancelled()` + zero-artifact guard so a single
failing leg yields a partial release instead of none.
- setup-node-pnpm cache key: add runner.arch. runner.os is only
Linux/macOS/Windows, so arm64 runners restored x64 node_modules missing
native deps (@rollup/rollup-linux-arm64-gnu), crashing `pnpm build`.
- macOS CLI sign step: guard on APPLE_CERTIFICATE_BASE64 so unsigned
binaries still publish when certs are absent; add timeout-minutes: 30 to
build-binaries to avoid 24h runner hangs.
- dependency-graph plugin: replace unix cp/mkdir -p (failed on Windows
cmd.exe) with a cross-platform node copy script.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Prior attempt accepted either fs.watch failure path (sync throw vs async
error event) — but on Linux Node, fs.watch with `recursive: true` on a
missing directory silently succeeds (returns a no-op watcher, never
throws, never emits an error). Neither catch arm fires, so the warning
the test wants to assert never appears.
Switch to a NUL-byte-embedded path. Node validates the path argument up
front and throws ERR_INVALID_ARG_VALUE synchronously on every platform,
guaranteeing the `watch:fs-watch-setup` catch arm runs. Restore the
strict assertions on phase + message.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds macOS code signing and notarization infrastructure (FN-5609), introducing hardened runtime entitlements, electron-builder config for signed builds, and signing-enabled release workflows, with tests validating the configuration and docs covering the signing flow.
Fusion-Task-Id: FN-5609
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5609
Adds Linux ARM64 as a target architecture to the desktop release pipeline, including dual-arch release and test-release workflows, electron-builder configuration updates, and corresponding tests and documentation.
Fusion-Task-Id: FN-5608
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5608
Add multi-platform updater feed configuration for the desktop app, including Windows, Mac, and Linux feed files with a collector, wired into the release and test-release workflows, plus corresponding tests and documentation.
Fusion-Task-Id: FN-5607
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5607
Adds ARM64 (Apple Silicon) as a target platform in both the release and test-release CI matrices, with corresponding test assertions covering the updated workflow configurations.
Fusion-Task-Id: FN-5606
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5606
Implements Linux GPG signing for the release pipeline by adding a `sign-linux.sh` helper, wiring it into the release and test-release workflows, including `.asc` signature files in release collectors, and documenting the full signing workflow in CODE_SIGNING.md with a note in the desktop README.
Fusion-Task-Id: FN-5605
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5605
Added GitHub Actions workflows for macOS and Linux desktop release artifacts (`release.yml` and `test-release.yml`), wired in new `dist` scripts across platforms, and extended test coverage for electron-builder config and release workflow logic, with updated documentation for the new artifacts.
Fusion-Task-Id: FN-5603
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5603
Adds a Windows desktop build job to the release pipeline, wires the desktop artifacts into both release and test-release workflows, includes workflow shape assertions in tests, and documents the Windows release artifacts in the desktop README.
Fusion-Task-Id: FN-5593
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5593
Refactors GitHub Actions workflow setup into a reusable composite action, consolidating repeated setup logic across CI, mobile, release, test-release, and version workflows (176 lines removed). Adds corresponding tests for the workflow configuration.
Fusion-Task-Id: FN-4100
Move the publishable CLI under the new @runfusion npm org for the first
public release. Reset version to 0.0.1 since the previous name was never
actually published. Rewrite packages/cli/README.md (the npm page) to
mirror the root README marketing — Fusion logo, reel GIFs pulled from
raw.githubusercontent.com, feature grid, tagline — and fix the stale
dustinbyrne/kb image link and ISC-vs-MIT license mismatch. Propagates
the name through root scripts, RELEASING.md, workflows, and docs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Update GitHub Actions workflows to use Node.js 24 (actions/setup-node@v5)
- Add private packages to .changeset/config.json ignore array
- Fix version string tests to read dynamically from package.json
- Add FN-1537 documentation to .fusion/memory.md
- Update CLI build and runtime paths to emit and reference fn-named binaries across default and cross-target builds
- Adjust Bun binary bootstrap stubs and native patch temp/symlink prefixes to use fn naming consistently
- Update CI, release, and test-release workflows to validate and collect fn-prefixed artifacts
- Align CLI build and package config tests with fn binary expectations and add a patch changeset for @gsxdsm/fusion
- Update CI, release, and test-release workflows to reference @gsxdsm/fusion package\n- Remove obsolete changeset file for unpause fix\n- Clean up unused code in packages/core/src/store.ts
- Rename npm packages from @kb/* to @hai/* and update all workspace references
- Rename CLI binary from kb to hai and config directory from .kb to .hai
- Update dashboard UI branding, titles, and references from kb to hai
- Update all test files, CI workflows, and documentation to reflect new naming
- Run comprehensive grep verification to ensure no stale kb references remain
- Remove binary build steps from CI and delete release/test-release workflows
- Replace release workflow with npm publish via version.yml and changesets
- Configure all packages (cli, core, dashboard, engine) for npm publishing
- Add package-config tests to verify publishConfig and package metadata
- Update README and documentation to reflect npm-based distribution
- Add macOS signing script with codesign, notarization, and stapling support
- Add Windows signing script using signtool with PFX certificate
- Integrate signing steps into release and test-release workflows
- Add signing workflow tests and verification coverage
- Add CODE_SIGNING.md documentation and update README
- Install and configure @changesets/cli with commit/access settings
- Create version PR workflow (.github/workflows/version.yml) for automated version bumps
- Update existing release and test-release workflows with version validation
- Add example changeset and version tests for CI verification
- Add RELEASING.md guide and update README with versioning documentation
- Convert release.yml and test-release.yml to matrix strategy with Linux, macOS (arm64/x64), and Windows runners
- Add platform-specific checksum generation (sha256sum, shasum, Get-FileHash)
- Split release into build and release jobs with artifact upload/download
- Add matrix build assertion tests for both workflow files
- Update README with supported platforms table and binary details
- Add CI workflow for pull requests and pushes with lint, test, and build steps
- Add release workflow for tagged versions with automated publishing
- Add manual test-release workflow for on-demand validation
- Add workflow validation tests and remove obsolete build/test files
- Update README with CI/CD documentation and badge references
