ci(release): automate desktop release preparation

[AprilNEA]

Summary

• add manifest-mode release-please for the Desktop product, keeping the existing unprefixed vX.Y.Z tag contract
• maintain release PRs on master, then finalize only the exact Release PR merge SHA that passed CI
• create a draft GitHub Release before the existing signed Desktop workflow publishes R2, GitHub assets, and Homebrew
• fail closed on partial tag/draft creation and reconcile release-please lifecycle labels on retry
• keep GitHub API policy in a tested Octokit module loaded through pinned actions/github-script
• reserve an independent future mobile-vX.Y.Z component without activating Mobile before an EAS delivery pipeline exists

Release safety

• every master SHA gets an independent CI group, so a release merge cannot be canceled or replaced by a later push
• finalization stays bound to the exact successful Release PR merge SHA even if master advances; config, manifest, and automation policy must remain byte-identical
• the privileged workflow_run checks out only protected master with credentials disabled and verifies the automation script blob before minting the App token
• the Desktop workflow refuses to upload R2 or publish unless the release-please Release already exists and targets the tag SHA
• the current v0.6.3 tag/SHA and Desktop package version seed the manifest; this PR does not move or republish it

Rollout requirement

BOT_APP_ID and BOT_APP_PRIVATE_KEY must be available as repository/org Actions secrets (not only in the protected release environment). The App needs Contents, Issues, and Pull requests read/write for this repository.

Validation

• release-please@17.3.0 debug-config --dry-run against this branch
• actionlint 1.7.12 with ShellCheck 0.11.0 (ignoring only pre-existing shell style diagnostics)
• focused ESLint for the release automation module and tests
• pnpm format:check
• pnpm typecheck
• pnpm test — 227 files, 1,791 tests passed
• release config invariants and git diff --check

pnpm check:ci could not complete locally because ESLint auto-concurrency exhausted an orb worker's ~2 GB heap. A serial lint completed with no errors, but exited on pre-existing unpruned suppressions; GitHub CI remains authoritative for the normal configured lint command.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 423a930aea

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[greptile-apps]

Greptile Summary

This PR automates Desktop release preparation through release-please. The main changes are:

• Adds manifest-mode release-please configuration for the Desktop root component.
• Adds a finalizer workflow that turns a CI-tested release PR merge into a draft GitHub Release and tag.
• Updates the Desktop release workflow to verify the release-please draft before publishing artifacts.
• Adjusts CI concurrency so every master SHA can finish validation.
• Adds tests and documentation for the new release lifecycle.

Confidence Score: 5/5

Safe to merge with low release-automation risk.

The changed release path has checks for candidate resolution, config drift, release/tag target matching, and Desktop publish preflight. Focused Vitest coverage was added for the new automation helpers. No verified blocking issues remain.

No files require special attention.

T-Rex Logs

What T-Rex did

• Ran the Vitest suite and confirmed 5 tests passed with exit code 0.
• Validated the release config invariants by running the invariants script and confirming all assertions passed with exit code 0.
• Reviewed the git diff checks and verified that the diff check passed.
• Reviewed the tool availability log and noted that optional local tools were unavailable.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/scripts/release-automation.cjs	Adds Octokit helpers to resolve tested release PRs, verify release config drift, and preflight draft/tag targets.
.github/scripts/release-automation.test.mjs	Adds Vitest coverage for release candidate resolution, label recovery, config drift rejection, and draft/tag verification.
.github/workflows/ci.yml	Adjusts CI concurrency so master SHAs are not canceled while PR and release-branch runs still collapse to latest.
.github/workflows/finalize-releases.yml	Adds workflow_run finalization that validates the tested release PR and invokes release-please to create a draft release and tag.
.github/workflows/release-desktop.yml	Pins release actions and adds a release-please target check before publishing R2 and GitHub assets.
.github/workflows/release-please.yml	Adds release-please maintenance workflow using the repository GitHub App token without creating releases.
release-please-config.json	Introduces manifest-mode release-please configuration for the unprefixed Desktop root component.

Sequence Diagram

sequenceDiagram
participant Dev as Developer
participant RP as Release Please workflow
participant CI as CI workflow
participant Final as Finalize Releases
participant GH as GitHub Releases/Tags
participant Desktop as Release Desktop
participant R2 as Cloudflare R2

Dev->>RP: Push to master
RP->>RP: Maintain Desktop release PR
Dev->>CI: Merge release PR to master
CI-->>Final: workflow_run success for tested SHA
Final->>Final: Resolve pending release PR and verify config/script blobs
Final->>GH: Create draft Release and vX.Y.Z tag for tested SHA
GH-->>Desktop: Tag push triggers signed release
Desktop->>GH: Verify draft Release targets tag SHA
Desktop->>R2: Upload updater feed and installers
Desktop->>GH: Upload assets and publish draft Release

Loading

_{Reviews (4): Last reviewed commit: "docs(release): document tested policy in..." | Re-trigger Greptile}

[linear-code]

ABXD-121