macos-13 runners are too scarce — the darwin-x64 leg sat queued for hours
and blocked the release publish job (which needs all build legs). Ship the
CLI Apple-Silicon-only for macOS; desktop macOS DMG/ZIP stays universal.
Removed from release.yml + test-release.yml matrices, updated ci-workflow
assertions (5→4 targets) and RELEASING.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Windows desktop build now succeeds (artifact builds + uploads), but the
job was marked failed on the post-job cache *save*: build-binaries
(windows-x64) and build-desktop-windows share runner.os/arch and thus the
same cache key, so concurrent saves hit "unable to reserve cache ... another
job may be creating this cache." Adding github.job to the key gives each job
its own cache and eliminates the race.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(b) Windows desktop build flakily failed with "Property 'ok'/'status' does
not exist on type 'Response'" because the workspace resolved multiple
@types/node versions (incl. an ancient 12.20.55 from @manypkg/find-root that
predates global fetch types). plugin-sdk compiles with lib:["ES2022"] and no
DOM lib, so Response comes solely from @types/node — nondeterministic across
runners. Pin via pnpm.overrides "@types/node": "^25.5.2"; collapses the
lockfile to one version. Verified: plugin-sdk build + desktop + full
workspace typecheck all pass.
Also: build-exe-cross tests cross-compiled all 5 platforms on every CI run
(auto-enabled via Boolean(process.env.CI)) — a release-build dependency in
the normal lane. Made them opt-in (FUSION_TEST_BUILD_EXE=1) and pointed the
root test:slow-cli at the CLI slow lane instead of test:pre-release, so
everyday CI no longer depends on release builds. test:pre-release and
test-release.yml still validate binaries deliberately.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
electron-builder emits Fusion-<v>-linux-x86_64.AppImage for x64 (deb uses
amd64, tar.gz uses x64). The verify step globbed -linux-x64.AppImage and
failed with "No Fusion Linux x64 AppImage artifacts produced" even though
the AppImage built. Upload globs already used the broad -linux-*.AppImage.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
electron-builder's fpm target requires author 'email' in package.json;
without it the arm64/x64 .deb build failed (`Please specify author 'email'`).
Surfaced once the electron-builder --x64 --arm64 flags actually parsed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Second pass after the cache/arch fix unblocked `pnpm build` and surfaced
later-stage failures:
- Desktop packaging called `pnpm --filter @fusion/desktop dist:mac -- <args>`,
but pnpm leaks the `--` separator into the script args. electron-builder
stops parsing at `--`, so `--publish never` was ignored — it auto-published
to api.github.com/repos/gsxdsm/fusion/releases and 404'd. The same leak
dropped Linux's `--x64 --arm64`. Switch all four desktop packaging steps to
`pnpm --filter @fusion/desktop exec electron-builder ...`, which forwards
args cleanly (verified locally).
- Windows CLI signing now skips when WINDOWS_CERTIFICATE_BASE64 is absent,
mirroring the macOS guard (was hard-failing the bun-windows-x64 job).
- Desktop build spawns workspace .cmd bins with shell:true on Windows; Node
rejects .cmd/.bat spawns without a shell (EINVAL) since CVE-2024-27980,
which broke `@fusion/desktop build` on the Windows runner.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
