Split desktop artifact verification by platform

[AnthonyRonning]

Summary

• split desktop artifact verification so Linux artifacts are verified on Linux and macOS artifacts are verified on macOS
• keep aggregate desktop verifier job names as lightweight gates for existing dependencies/branch protection
• add master Windows artifact checksum proof generation and a separate Windows artifact verifier
• keep release Linux desktop verification out of the final macOS aggregate verifier; the Linux release verifier gates it separately

Why

The master Desktop App CI failure was caused by the macOS aggregate verifier trying to run Linux package metadata checks. Those checks are intentionally Linux-specific because they inspect AppImage/.deb ELF metadata with Linux tooling.

Verification

• git diff --check
• nix develop .#ci -c actionlint .github/workflows/desktop-build.yml .github/workflows/release.yml
• nix develop .#ci -c bash -n scripts/ci/verify-release-artifacts.sh scripts/ci/_common.sh
• temporary fixture verified desktop-release-windows-final.sha256 works for windows and present targets
• pre-commit hook passed via nix develop .#ci: Prettier, frontend build, Bun tests

---

Summary by CodeRabbit

• Chores
  • Refactored desktop release artifact reproducibility verification into separate, platform-specific jobs for Linux, macOS, and Windows.
  • Updated the Windows release verification flow to be more resilient by using checksum fallback inputs when release hashes aren’t available.
  • Adjusted the release verification scope to align with the platform-split desktop verification (e.g., removing Linux from a later shared verification step).

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	d28ee83
Status:	✅  Deploy successful!
Preview URL:	https://e62c84d6.maple-ca8.pages.dev
Branch Preview URL:	https://fix-split-desktop-artifact-v.maple-ca8.pages.dev

View logs

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 734f8c32-ecbb-4c39-8606-fad07dc713fc

📥 Commits

Reviewing files that changed from the base of the PR and between f7cfc58 and d28ee83.

📒 Files selected for processing (3)

• .github/workflows/desktop-build.yml
• .github/workflows/release.yml
• scripts/ci/verify-release-artifacts.sh

🚧 Files skipped from review as they are similar to previous changes (2)

• scripts/ci/verify-release-artifacts.sh
• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

Platform-specific reproducibility verification is split across both CI workflows. desktop-build.yml gains a Linux verification job, a Windows SHA-256 collection step, and a Windows verification job. release.yml extracts Linux into its own job and removes linux from the combined verifier. verify-release-artifacts.sh makes Windows release proof files and runtime DLL manifests optional with fallback to PR proof files.

Changes

Per-platform desktop artifact verification

Layer / File(s)	Summary
verify-release-artifacts.sh: optional Windows proof files scripts/ci/verify-release-artifacts.sh	verify_windows switches from unconditional proof file requirements to optional desktop-release-* with fallback to desktop-pr-*; conditionally runs runtime-DLL manifest verification; verify_present triggers on either release or PR Windows final proof.
desktop-build: Linux verification job and macOS-only target .github/workflows/desktop-build.yml	Adds verify-linux-desktop-artifacts job that downloads maple-linux and runs verify-release-artifacts.sh ... linux; replaces the combined macOS/Linux step with a macOS-only target.
desktop-build: Windows SHA-256 collection and verification job .github/workflows/desktop-build.yml	Adds a "Collect Windows release checksums" step collecting NSIS bundle outputs into desktop-release-windows-final.sha256; adds verify-windows-desktop-artifacts job; updates verify-desktop-artifacts to depend on all three platform verification jobs.
release.yml: split Linux desktop verification and drop linux from combined job .github/workflows/release.yml	Adds verify-linux-desktop-release-artifacts job running verification for linux via the desktop-linux Nix shell; updates verify-desktop-release-artifacts to depend on both Linux and macOS jobs with an echo completion; removes linux from the later verify-release-artifacts invocation.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Possibly related PRs

• OpenSecretCloud/Maple#550: Also modifies release.yml to reshape desktop reproducibility verification jobs and their dependencies, splitting/ordering Linux vs. macOS verification.
• OpenSecretCloud/Maple#552: Adds a parity-check script that asserts release-workflow invariants around the same verifier invocations and proof/SHA-256 expectations changed here.
• OpenSecretCloud/Maple#563: Previously added the windows verification target to verify-release-artifacts.sh triggered by desktop-pr-windows-final.sha256, which this PR extends with optional release-proof fallback.

Poem

🐇 Three platforms checked, each in its own lane,
Linux hops first, then macOS in the rain,
Windows collects its NSIS bundles with care,
Optional proofs with fallbacks declared fair,
The verify script adapts with a flexible paw —
No missing file shall break the build's law! 🍁

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: splitting desktop artifact verification into platform-specific jobs (Linux, macOS, and Windows), which directly addresses the core objective of the PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/split-desktop-artifact-verifiers

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[devin-ai-integration]

Devin Review found 2 potential issues.