Skip to content

ci(desktop): keep unsigned verification out of updater signing #5338

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lidge-jun merged 9 commits into from
Sep 20, 2026
Merged

ci(desktop): keep unsigned verification out of updater signing #5338

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
66cf989
ci(desktop): keep the release updater key out of the verification build
lidge-jun Sep 20, 2026
724f72f
test(lab): fold the conformance developer role with the destination d…
lidge-jun Sep 20, 2026
6809e9f
docs(lab): describe the folded chat fixture contract
Ingwannu Sep 20, 2026
d356cb1
test(lab): pin the undeclared chat role fixture
Ingwannu Sep 20, 2026
58f5a40
test(lab): defer to the merged developer-role fixture fix
Ingwannu Sep 20, 2026
128b0f2
Merge remote-tracking branch 'origin/dev' into fix/5338-fixture-comment
Ingwannu Sep 20, 2026
4d42760
test(openai-chat): align dangling barriers with role folding
Ingwannu Sep 20, 2026
100ed66
Revert "test(openai-chat): align dangling barriers with role folding"
Ingwannu Sep 20, 2026
7206312
Merge remote-tracking branch 'origin/dev' into fix/5338-fixture-comment
Ingwannu Sep 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1193,7 +1193,14 @@ jobs:

- name: Build unsigned desktop app
working-directory: desktop
run: bunx tauri build --ci --bundles app
# `createUpdaterArtifacts` is on and the updater public key is committed, so a plain
# `tauri build` stops with "A public key has been found, but no private key" unless
# TAURI_SIGNING_PRIVATE_KEY is set. This job proves the appex and the app bundle build
# and that the widget is embedded; it does not ship an update, and a verification
# build has no business holding the release key. Updater artifacts are therefore off
# here and the signing path stays in release.yml, which already reads the secret and
# refuses to publish a manifest when it is absent.
run: bunx tauri build --ci --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'

- name: Verify WidgetKit appex and desktop app
run: |
Expand Down
Loading