Gate release publishing on tag-scoped E2E, harden Droid agent-status routing against renderer layout races, and stabilize the affected E2E setup helpers.
* Revert "Fix signed Windows updater checksum metadata (#1712)"
This reverts commit 61f3d7c50e.
* Revert "Sign Windows releases with SignPath (#1300)"
This reverts commit ffa06c2b4a.
- release-cut.yml: require `^v[0-9]` tag shape when picking "latest
stable" from GitHub releases. Previously only `-rc.*` was excluded, so
publishing `mobile-v0.0.1` made it the latest stable, `strip_pre()`
reduced it to `mobile`, `Number("mobile")` → NaN → 0, and a patch-bump
produced `v0.0.1` (run 25304336767).
- homebrew-bump.yml: drop the blanket `release.published` trigger and
add tag-shape guards. Any published release in this repo (including
mobile) would otherwise fire the tap bump. Workflow_call from the
desktop pipeline is the only intended path now.
- Inline create-release / build / publish-release / e2e / homebrew-bump
jobs from release.yml into release-cut.yml, and delete release.yml.
Co-authored-by: Orca <help@stably.ai>
release.yml's publish-release job got `actions: write` in f6cc2aee so it
can dispatch homebrew-bump.yml, but reusable-workflow permissions are
capped by the caller. release-cut.yml and release-rc.yml only listed
`contents: write`, so the first cut after f6cc2aee died with
startup_failure (run 25244518794) before any job could start.
Grant `actions: write` on both callers to match what release.yml needs.
Co-authored-by: Orca <help@stably.ai>
If a cut pushes the tag but the workflow is cancelled (or the dependent
release.yml job otherwise fails to start) before a GitHub release is
published, every subsequent patch cut recomputes the same version and
dies on "Tag already exists." This wedged the pipeline on 2026-05-01
when v1.3.26 was pushed by cancelled run 25237882049 — patch cuts kept
failing for hours until release.yml was dispatched by hand.
When the tag exists but no published release is attached, skip the
bump/push steps and emit the existing tag as the job output so
release.yml runs against it and finishes what the prior attempt
started. Still refuse the collision when a real published release
exists — that's a genuine conflict (e.g. a hand-tagged version) and
needs human attention.
Co-authored-by: Orca <help@stably.ai>
Two interacting bugs produced v1.3.1-rc.4 today:
1. release-cut.yml used `gh release list --exclude-pre-releases` to
find latest_stable. That filter checks the GitHub `isPrerelease`
flag, which had been flipped to `false` on several RC releases
(including v1.3.22-rc.2 and v1.3.1-rc.3). The query returned an
RC tag, and bump() then silently mis-parsed `1.3.1-rc.3` via
`Number("1-rc") = NaN` -> `(NaN||0)+1 = 1`, yielding base=1.3.1.
Fix: filter by tag shape (no `-rc.`) in jq so an RC tag can never
be treated as stable, regardless of metadata. Also strip any
prerelease suffix in bump() and semver_gt() so the numeric math
is robust even if a caller passes a dirty input.
2. release.yml's final publish step only ran `--draft=false`, leaving
the `prerelease` flag at whatever electron-builder last wrote. When
that flag ended up false on an RC, GitHub marked the RC as the
"latest" release.
Fix: re-assert `--prerelease=<derived from tag>` alongside
`--draft=false` so the final state is a function of the tag name,
not of any intermediate publisher behavior.
Co-authored-by: Orca <help@stably.ai>
The rc branch previously derived the base version from the highest
git tag, which reopened an already-shipped series: after v1.3.21
stable was published, cutting an RC still produced v1.3.21-rc.N.
Anchor RCs to latest_stable + patch so a fresh RC after v1.3.21
correctly resolves to v1.3.22-rc.0. Minor/major RCs are cut by
running that stable kind first, which is a clearer workflow than
the old heuristic.
Co-authored-by: Orca <help@stably.ai>
Replaces the `stable` + optional `version` inputs with explicit
`rc | patch | minor | major` choices. Stable kinds are always computed
off the latest published stable release (ignoring intermediate RCs), so
there's nothing to type and no way to pick a version that regresses
electron-updater.
The stable-must-strictly-increase guard stays in place for patch/minor/
major. RC behavior is unchanged — continues an active series or starts
a new one on the next patch.
Replaces the local `pnpm release:{rc,patch,minor,major}` scripts with a
single manually-dispatched GitHub Actions workflow (`release-cut.yml`)
that takes `kind` (rc|stable), an optional `ref`, and an optional explicit
`version`.
Why: cutting releases locally was too easy to get wrong — `npm version
prerelease` behaves differently depending on whether the current version
is already an rc, there was no guard against tagging a dirty tree or an
off-main branch, and the "bad commit just landed, release the previous
one" case had no first-class answer. The new workflow:
- Resolves the next version automatically from GitHub Releases (or takes
an explicit override).
- Refuses to cut a stable release whose version isn't strictly greater
than the latest published stable. This is the only invariant
electron-updater needs within the `latest` channel.
- Only fast-forwards `main` with the version-bump commit when the caller
released the tip of `main`. Off-main releases publish only the tag, so
main is never polluted by a one-off RC against a feature branch.
CONTRIBUTING.md now documents the new flow with the common scenarios
(normal release, bad-commit-revert-to-previous-SHA, one-off RC, explicit
minor/major). The scheduled RC cron in release-rc.yml is untouched.
Neil
Brennan Benson