desktop-build.yml

name: desktop-build

# Desktop packaging: builds installable packages and publishes the latest main
# build as an auto-managed GitHub Release.
#
# macOS signing/notarization is opt-in: if the APPLE_* / CSC_* secrets are present it
# signs, otherwise it builds an UNSIGNED package (testers right-click → Open to launch).
# Windows signing is likewise opt-in via the AZURE_TRUSTED_SIGNING_* secrets (W-c);
# Linux packages are unsigned here.

on:
  # Only the dev->main merge (push to main); ad-hoc runs via workflow_dispatch.
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      channel:
        description: "Build channel"
        required: false
        default: "prod"
        type: choice
        options:
          - beta
          - prod
      platforms:
        description: "Which platforms to build"
        required: false
        default: "all"
        type: choice
        options:
          - all
          - mac
          - linux
          - windows
      artifact_mode:
        description: "Release packaging or isolated unsigned candidate artifacts"
        required: false
        default: "release"
        type: choice
        options:
          - release
          - test
      owner_issuance_run_id:
        description: "Successful publish run containing this version's owner-authorization and release-owner-public-key artifacts (required for release mode)"
        required: false
        type: string

permissions:
  contents: write
  actions: write

concurrency:
  group: desktop-build-${{ github.ref }}-${{ inputs.artifact_mode || 'release' }}
  cancel-in-progress: ${{ inputs.artifact_mode != 'test' }}

jobs:
  test-candidate:
    if: github.event_name == 'workflow_dispatch' && inputs.artifact_mode == 'test'
    permissions:
      contents: read
    uses: ./.github/workflows/desktop-test-package.yml
    with:
      platforms: ${{ inputs.platforms || 'all' }}

  cleanup:
    needs: setup
    if: github.event_name != 'workflow_dispatch' || inputs.artifact_mode != 'test'
    runs-on: ubuntu-24.04
    steps:
      - name: Delete previous desktop artifacts
        env:
          GH_TOKEN: ${{ github.token }}
          REPOSITORY: ${{ github.repository }}
        run: |
          gh api "repos/$REPOSITORY/actions/artifacts" --paginate \
            --jq '.artifacts[] | select(.name | startswith("deepagent-code-desktop-")) | .id' \
            | while read -r artifact_id; do
                gh api -X DELETE "repos/$REPOSITORY/actions/artifacts/$artifact_id"
              done

  # Build the matrix from the `platforms` input. Job-level `if` cannot read the matrix
  # context, so the selection happens here and the build job consumes the JSON.
  setup:
    if: github.event_name != 'workflow_dispatch' || inputs.artifact_mode != 'test'
    runs-on: ubuntu-24.04
    outputs:
      matrix: ${{ steps.gen.outputs.matrix }}
      owner_issuance_run_id: ${{ steps.owner-source.outputs.owner_issuance_run_id }}
    steps:
      - name: Require the existing publish owner issuance
        id: owner-source
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          REPOSITORY: ${{ github.repository }}
          OWNER_ISSUANCE_RUN_ID: ${{ inputs.owner_issuance_run_id }}
        run: |
          set -euo pipefail
          if [[ ! "$OWNER_ISSUANCE_RUN_ID" =~ ^[1-9][0-9]*$ ]]; then
            echo "::error::Release Desktop packaging requires owner_issuance_run_id from the existing successful publish run; no new owner issuer will be created."
            exit 1
          fi
          verified_run=$(gh api "repos/$REPOSITORY/actions/runs/$OWNER_ISSUANCE_RUN_ID" \
            --jq 'select((.path | split("@")[0]) == ".github/workflows/publish.yml" and .status == "completed" and .conclusion == "success") | .id')
          if [[ "$verified_run" != "$OWNER_ISSUANCE_RUN_ID" ]]; then
            echo "::error::owner_issuance_run_id must identify a successful completed publish workflow in this repository."
            exit 1
          fi
          echo "owner_issuance_run_id=$OWNER_ISSUANCE_RUN_ID" >> "$GITHUB_OUTPUT"

      - id: gen
        shell: bash
        env:
          PLATFORMS: ${{ github.event.inputs.platforms || 'all' }}
          EVENT_NAME: ${{ github.event_name }}
          GIT_REF: ${{ github.ref }}
        run: |
          mac_arm64='{"host":"macos-14","target":"darwin-arm64","platform_flag":"--mac dmg zip --arm64","group":"mac"}'
          mac_x64='{"host":"macos-15-intel","target":"darwin-x64","platform_flag":"--mac dmg zip --x64","group":"mac"}'
          linux='{"host":"ubuntu-24.04","target":"linux-amd64","platform_flag":"--linux deb --x64","group":"linux"}'
          win='{"host":"windows-2025","target":"win-x64","platform_flag":"--win nsis --x64","group":"win"}'
          # Dev mainline pushes exercise only the Windows packaging path (the newest and
          # least-runner-covered one); everything else follows the platforms selection.
          if [ "$EVENT_NAME" = "push" ] && [ "$GIT_REF" = "refs/heads/dev" ]; then
            items="$win"
          else
            case "$PLATFORMS" in
              mac)       items="$mac_arm64,$mac_x64" ;;
              linux)     items="$linux" ;;
              windows)   items="$win" ;;
              *)         items="$mac_arm64,$mac_x64,$linux,$win" ;;
            esac
          fi
          echo "matrix={\"include\":[$items]}" >> "$GITHUB_OUTPUT"

  build:
    needs:
      - cleanup
      - setup
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.setup.outputs.matrix) }}
    runs-on: ${{ matrix.host }}
    env:
      # Mapped here so step-level `if` can test them (the `secrets` context is not
      # available in `if`, but `env` is).
      HAS_APPLE_CERT: ${{ secrets.APPLE_CERTIFICATE != '' }}
      # Notarization uses the Apple ID method (matches packages/desktop/signing.env), so it
      # needs the Apple ID + app-specific password + team id. electron-builder.config.ts treats
      # mac signing as available when all three are set.
      HAS_APPLE_NOTARY: ${{ secrets.APPLE_ID != '' && secrets.APPLE_APP_SPECIFIC_PASSWORD != '' && secrets.APPLE_TEAM_ID != '' }}
      # Windows signing uses Azure Trusted Signing (script/sign-windows.ps1, wired through
      # electron-builder's per-file sign hook). The script authenticates with the Azure CLI,
      # so the pipeline needs a federated service principal in addition to the endpoint /
      # account / profile names. When any piece is missing the build proceeds unsigned.
      HAS_TRUSTED_SIGNING: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT != '' && secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME != '' && secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE != '' && secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID != '' && secrets.AZURE_TRUSTED_SIGNING_TENANT_ID != '' && secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID != '' }}
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/setup-bun
        env:
          ELECTRON_SKIP_BINARY_DOWNLOAD: ${{ matrix.target == 'darwin-arm64' && '1' || '' }}

      - uses: actions/setup-node@v4
        with:
          node-version: "24"

      - name: Read the reviewed Desktop release version
        id: release-version
        shell: bash
        run: |
          dac_release_version=$(node -p 'require("./packages/desktop/package.json").version')
          echo "version=$dac_release_version" >> "$GITHUB_OUTPUT"

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: owner-authorization
          path: ${{ runner.temp }}/owner-auth
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ needs.setup.outputs.owner_issuance_run_id }}

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: release-owner-public-key
          path: ${{ runner.temp }}/owner-key
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ needs.setup.outputs.owner_issuance_run_id }}

      - name: Verify the existing owner issuance for this Desktop version
        shell: bash
        env:
          DAC_OWNER_VERSION: ${{ steps.release-version.outputs.version }}
          DEEPAGENT_CODE_RELEASE_OWNER_AUTHORIZATION_FILE: ${{ runner.temp }}/owner-auth/owner-authorization.json
          DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY: ${{ runner.temp }}/owner-key/release-owner-public-key.pem
        run: |
          bun - <<'BUN'
            import { createHash, createPublicKey, verify } from "node:crypto";
            import { V2OwnerAuthorization } from "./packages/core/src/session/runner/v2-owner-authorization";
            import { V2ProviderTurn } from "./packages/core/src/session/runner/v2-provider-turn";
            const version = process.env.DAC_OWNER_VERSION;
            const row = await Bun.file(process.env.DEEPAGENT_CODE_RELEASE_OWNER_AUTHORIZATION_FILE).json();
            const pin = await Bun.file(process.env.DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY).text();
            const key = createPublicKey(pin);
            const fields = { authorizationID: row.authorization_id, campaignID: row.campaign_id,
              subjectCommit: row.subject_commit, subjectTree: row.subject_tree, schemaDigest: row.schema_digest,
              buildID: row.build_id, packageDigest: row.package_digest, validFrom: row.valid_from, expiresAt: row.expires_at };
            const identity = V2ProviderTurn.buildIdentityFromVersion(version);
            const payload = V2OwnerAuthorization.authorizationPayload(fields);
            if (pin.includes("PRIVATE KEY") || key.asymmetricKeyType !== "ed25519" ||
                row.build_identity !== version || row.campaign_id !== `v2-owner-${version}` || row.status !== "active" ||
                !Number.isSafeInteger(row.valid_from) || !Number.isSafeInteger(row.expires_at) ||
                row.valid_from > Date.now() || row.expires_at <= Date.now() ||
                Object.entries(identity).some(([name, value]) => fields[name] !== value) ||
                typeof row.signature_digest !== "string" || !/^[0-9a-f]{128}$/.test(row.signature_digest) ||
                createHash("sha256").update(payload).digest("hex") !== row.authorization_digest ||
                !verify(null, Buffer.from(payload), key, Buffer.from(row.signature_digest, "hex")))
              throw new Error("Existing owner issuance does not verify for the reviewed Desktop version");
            console.log(JSON.stringify({ state: "verified_existing_owner_issuance", version, campaign: row.campaign_id }));
          BUN

      - name: Download Electron runtime for macOS arm64
        if: matrix.target == 'darwin-arm64'
        working-directory: packages/desktop
        shell: bash
        run: |
          for attempt in 1 2 3; do
            echo "Electron download attempt $attempt/3"
            if node node_modules/electron/install.js &&
               node -e 'require("node:fs").accessSync(require("electron"))'; then
              exit 0
            fi
            if [ "$attempt" -eq 3 ]; then
              echo "::error::Electron runtime download failed after 3 attempts; check access to Electron release assets"
              exit 1
            fi
            sleep $((attempt * 15))
          done

      # Import the Developer ID cert only when the secret is configured; otherwise the
      # build proceeds unsigned (DEEPAGENT_CODE_ALLOW_UNSIGNED below).
      - name: Import Apple signing certificate
        if: matrix.group == 'mac' && env.HAS_APPLE_CERT == 'true'
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      # Trusted Signing authenticates through the Azure CLI credential chain
      # (sign-windows.ps1 keeps only AzureCliCredential enabled), so log in with
      # a federated workload identity before packaging.
      - name: Azure login for Trusted Signing
        if: matrix.group == 'win' && env.HAS_TRUSTED_SIGNING == 'true'
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TRUSTED_SIGNING_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_TRUSTED_SIGNING_SUBSCRIPTION_ID }}

      - name: Verify Windows browser file stages
        if: runner.os == 'Windows'
        shell: pwsh
        timeout-minutes: 5
        run: ./.github/scripts/test-windows-browser-file-stages.ps1

      - name: Build, package and verify Desktop Native assets
        uses: ./.github/actions/package-desktop
        timeout-minutes: 90
        with:
          version: ${{ steps.release-version.outputs.version }}
          channel: ${{ github.event_name == 'push' && 'prod' || (github.event.inputs.channel || 'prod') }}
          platform-flags: ${{ matrix.platform_flag }}
          macos-signed: ${{ matrix.group == 'mac' && env.HAS_APPLE_CERT == 'true' && env.HAS_APPLE_NOTARY == 'true' }}
        env:
          NODE_OPTIONS: --max-old-space-size=4096
          DEEPAGENT_CODE_RELEASE_OWNER_AUTHORIZATION_FILE: ${{ runner.temp }}/owner-auth/owner-authorization.json
          DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY: ${{ runner.temp }}/owner-key/release-owner-public-key.pem
          # Preserve the existing opt-in certificate + Apple ID signing contract.
          DEEPAGENT_CODE_ALLOW_UNSIGNED: ${{ ((matrix.group == 'mac' && env.HAS_APPLE_CERT == 'true' && env.HAS_APPLE_NOTARY == 'true') || (matrix.group == 'win' && env.HAS_TRUSTED_SIGNING == 'true')) && '0' || '1' }}
          CSC_NAME: ${{ matrix.group == 'mac' && secrets.APPLE_CSC_NAME || '' }}
          APPLE_ID: ${{ matrix.group == 'mac' && secrets.APPLE_ID || '' }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ matrix.group == 'mac' && secrets.APPLE_APP_SPECIFIC_PASSWORD || '' }}
          APPLE_TEAM_ID: ${{ matrix.group == 'mac' && secrets.APPLE_TEAM_ID || '' }}
          AZURE_TRUSTED_SIGNING_ENDPOINT: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
          AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
          AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}

      # Assert that packaging produced the supported x64 installer and, when
      # Trusted Signing ran, that its signature validates on Windows.
      - name: Assert NSIS installers and signatures
        if: matrix.group == 'win'
        working-directory: packages/desktop
        shell: pwsh
        run: |
          $installers = Get-ChildItem -Path dist -Filter "deepagent-code-desktop-win-*.exe" -File
          $x64 = $installers | Where-Object { $_.Name -eq "deepagent-code-desktop-win-x64.exe" }
          if (-not $x64 -or $installers.Count -ne 1) {
            Write-Error "NSIS installers mismatch: expected only win-x64, found: $($installers.Name -join ', ')"
            exit 1
          }
          if ($env:HAS_TRUSTED_SIGNING -eq "true") {
            foreach ($installer in @($x64)) {
              $signature = Get-AuthenticodeSignature -FilePath $installer.FullName
              if ($signature.Status -ne "Valid") {
                Write-Error "$($installer.Name) signature status '$($signature.Status)': $($signature.StatusMessage)"
                exit 1
              }
              Write-Host "$($installer.Name) signed by $($signature.SignerCertificate.Subject)"
            }
          } else {
            Write-Host "Trusted Signing not configured; asserting installer presence only"
          }

      - name: Smoke test packaged macOS app
        if: matrix.group == 'mac'
        working-directory: packages/desktop
        run: |
          executable=$(find dist -maxdepth 5 -type f -path '*/Contents/MacOS/DeepAgent Code*' -perm +111 -print -quit)
          test -n "$executable"
          DEEPAGENT_CODE_DESKTOP_EXECUTABLE="$executable" bun run test:subagents-cold-start

      # W9.3: first real Windows run of the native-only sidecar routing (local
      # spawn, no platform fallback). Launches the packaged app and asserts
      # GET /global/health with Basic auth (the desktop sidecar always
      # configures a password, so the typed API route answers 401 to a
      # credential-less curl — the auth'd fetch proves the full sidecar
      # bootstrap path, not just a listening port).
      - name: Smoke test packaged Windows sidecar health
        if: matrix.group == 'win'
        working-directory: packages/desktop
        shell: pwsh
        run: |
          # win-unpacked holds the x64 app. Wildcard matches both prod ("DeepAgent Code.exe")
          # and beta ("DeepAgent Code Beta.exe") artifact names so the beta build
          # cannot silently fail this smoke because of an exact name filter.
          $exe = Get-ChildItem -Path "dist/win-unpacked" -Filter "*DeepAgent Code*.exe" -Recurse -File | Select-Object -First 1
          if (-not $exe) {
            Write-Error "Packaged executable not found under dist/win-unpacked"
            exit 1
          }
          $env:DEEPAGENT_CODE_DESKTOP_EXECUTABLE = $exe.FullName
          $env:DEEPAGENT_CODE_SMOKE_PORT = "3188"
          bun run test:sidecar-health-smoke

      - name: Upload package artifacts
        uses: actions/upload-artifact@v4
        with:
          name: deepagent-code-desktop-${{ matrix.target }}
          if-no-files-found: error
          compression-level: 9
          retention-days: 1
          path: |
            packages/desktop/dist/latest*.yml
            packages/desktop/dist/*.blockmap
            packages/desktop/dist/*.dmg
            packages/desktop/dist/*.zip
            packages/desktop/dist/*.deb
            packages/desktop/dist/*.exe

  release:
    needs: build
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: package.json

      - uses: actions/download-artifact@v4
        with:
          pattern: deepagent-code-desktop-*
          path: release-assets
          merge-multiple: true

      - uses: actions/download-artifact@v4
        with:
          name: deepagent-code-desktop-darwin-arm64
          path: /tmp/latest-yml-aarch64-apple-darwin

      - uses: actions/download-artifact@v4
        with:
          name: deepagent-code-desktop-darwin-x64
          path: /tmp/latest-yml-x86_64-apple-darwin

      - name: Publish latest desktop release
        env:
          GH_TOKEN: ${{ github.token }}
          REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail

          version=$(node -p 'require("./packages/desktop/package.json").version.replace(/-.*/, "")')
          tag="app-v${version}-main.${GITHUB_RUN_NUMBER}"

          # The two native Mac jobs each write latest-mac.yml; publish one feed
          # containing both supported architectures instead of whichever artifact
          # happened to win the merge-multiple download.
          LATEST_YML_DIR=/tmp GH_REPO="$REPOSITORY" DEEPAGENT_CODE_VERSION="$version" \
            RUNNER_TEMP="$RUNNER_TEMP" bun packages/desktop/scripts/finalize-latest-yml.ts --dry-run
          cp "$RUNNER_TEMP/latest-mac.yml" release-assets/latest-mac.yml

          mapfile -t assets < <(find release-assets -type f \( -name 'latest*.yml' -o -name '*.blockmap' -o -name '*.dmg' -o -name '*.zip' -o -name '*.deb' -o -name '*.exe' \) | sort)
          if [ "${#assets[@]}" -eq 0 ]; then
            echo "No desktop release assets found"
            exit 1
          fi
          for required in latest.yml latest-mac.yml; do
            if ! find release-assets -type f -name "$required" | grep -q .; then
              echo "Missing updater metadata: $required"
              exit 1
            fi
          done

          gh release list --repo "$REPOSITORY" --limit 100 --json tagName \
            --jq '.[] | select(.tagName | test("^app-v[0-9]+\\.[0-9]+\\.[0-9]+-main\\.")) | .tagName' \
            | while read -r old_tag; do
                if [ -n "$old_tag" ]; then
                  gh release delete "$old_tag" --repo "$REPOSITORY" --cleanup-tag -y
                fi
              done

          gh release create "$tag" "${assets[@]}" \
            --repo "$REPOSITORY" \
            --latest \
            --target "$GITHUB_SHA" \
            --title "DeepAgent Code Desktop ${version} (${GITHUB_SHA::7})" \
            --notes "Automated desktop build from main at ${GITHUB_SHA}."