merge: integrate origin/main into windows distribution smoke

Author: PerishCode

.github/workflows/desktop-build.yml

@@ -53,12 +53,27 @@ permissions:
 
 jobs:
   build:
-    runs-on: macos-14
+    strategy:
+      matrix:
+        include:
+          - runner: macos-14
+            arch: arm64
+          - runner: macos-15-intel
+            arch: x64
+    runs-on: ${{ matrix.runner }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Validate channel input
+        shell: bash
+        run: |
+          case "${{ inputs.channel }}" in
+            stable|beta|nightly) ;;
+            *) echo "Invalid channel: ${{ inputs.channel }}" >&2; exit 1 ;;
+          esac
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
@@ -74,6 +89,8 @@ jobs:
       - name: Resolve build metadata
         id: meta
         shell: bash
+        env:
+          ARCH: ${{ matrix.arch }}
         run: |
           set -euo pipefail
 
@@ -103,7 +120,7 @@ jobs:
             echo "build_date=$build_date"
             echo "short_sha=$short_sha"
             echo "channel=$channel"
-            echo "artifact_name=desktop-${channel}-${build_date}-${short_sha}"
+            echo "artifact_name=desktop-${channel}-${ARCH}-${build_date}-${short_sha}"
           } >> "$GITHUB_OUTPUT"
 
       - name: Prepare Apple signing certificate
@@ -142,6 +159,7 @@ jobs:
           BUILD_SOURCE: ${{ inputs.build_source }}
           BUILD_BRANCH: ${{ github.ref_name }}
           BUILD_COMMIT: ${{ github.sha }}
+          BUILD_ARCH: ${{ matrix.arch }}
           SENTRY_DSN_TEST: ${{ secrets.SENTRY_DSN_NEXU_DESKTOP_TEST }}
           SENTRY_DSN_PROD: ${{ secrets.SENTRY_DSN_NEXU_DESKTOP_PROD }}
         run: |
@@ -158,13 +176,14 @@ jobs:
               NEXU_LINK_URL: process.env.LINK_URL === "null" ? null : process.env.LINK_URL,
               NEXU_SENTRY_ENV: process.env.SENTRY_ENV,
               NEXU_DESKTOP_APP_VERSION: version,
+              NEXU_DESKTOP_UPDATE_CHANNEL: "${{ inputs.channel }}",
               NEXU_DESKTOP_BUILD_SOURCE: process.env.BUILD_SOURCE,
               NEXU_DESKTOP_BUILD_BRANCH: process.env.BUILD_BRANCH,
               NEXU_DESKTOP_BUILD_COMMIT: process.env.BUILD_COMMIT,
               NEXU_DESKTOP_BUILD_TIME: process.env.BUILT_AT,
             };
             if (process.env.UPDATE_FEED_URL) {
-              config.NEXU_UPDATE_FEED_URL = process.env.UPDATE_FEED_URL;
+              config.NEXU_UPDATE_FEED_URL = `${process.env.UPDATE_FEED_URL.replace(/\/$/, "")}/${process.env.BUILD_ARCH}`;
             }
             if (sentryDsn) {
               config.NEXU_DESKTOP_SENTRY_DSN = sentryDsn;
@@ -183,7 +202,10 @@ jobs:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          NEXU_DESKTOP_TARGET_ARCH: ${{ matrix.arch }}
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          VITE_AMPLITUDE_API_KEY: ${{ secrets.AMPLITUDE_API_KEY }}
+          AMPLITUDE_API_KEY: ${{ secrets.AMPLITUDE_API_KEY }}
         run: pnpm --filter @nexu/desktop dist:mac
 
       - name: Prepare artifacts
@@ -192,6 +214,8 @@ jobs:
         env:
           CHANNEL: ${{ inputs.channel }}
           VERSION: ${{ steps.meta.outputs.desktop_version }}
+          SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
+          ARCH: ${{ matrix.arch }}
         run: |
           set -euo pipefail
           shopt -s nullglob
@@ -207,11 +231,21 @@ jobs:
             exit 1
           fi
 
-          # New naming: nexu-{version}-{channel}-{arch}.{ext}
-          versioned_dmg="nexu-${VERSION}-${CHANNEL}-arm64.dmg"
-          versioned_zip="nexu-${VERSION}-${CHANNEL}-arm64.zip"
-          latest_dmg="nexu-latest-${CHANNEL}-arm64.dmg"
-          latest_zip="nexu-latest-${CHANNEL}-arm64.zip"
+          artifact_version="$VERSION"
+          if [ "$CHANNEL" != "stable" ]; then
+            artifact_version="${VERSION}.${SHORT_SHA}"
+          fi
+
+          latest_name_prefix="nexu-latest-mac-${ARCH}"
+          if [ "$CHANNEL" != "stable" ]; then
+            latest_name_prefix="nexu-latest-${CHANNEL}-mac-${ARCH}"
+          fi
+
+          versioned_dmg="nexu-${artifact_version}-mac-${ARCH}.dmg"
+          versioned_zip="nexu-${artifact_version}-mac-${ARCH}.zip"
+          latest_dmg="${latest_name_prefix}.dmg"
+          latest_zip="${latest_name_prefix}.zip"
+          checksum_file="desktop-${ARCH}-sha256.txt"
 
           cp "${dmg_files[0]}" "apps/desktop/channel-artifacts/${versioned_dmg}"
           cp "${zip_files[0]}" "apps/desktop/channel-artifacts/${versioned_zip}"
@@ -221,13 +255,14 @@ jobs:
           shasum -a 256 \
             "apps/desktop/channel-artifacts/${versioned_dmg}" \
             "apps/desktop/channel-artifacts/${versioned_zip}" \
-            > apps/desktop/channel-artifacts/desktop-sha256.txt
+            > "apps/desktop/channel-artifacts/${checksum_file}"
 
           {
             echo "versioned_dmg=$versioned_dmg"
             echo "versioned_zip=$versioned_zip"
             echo "latest_dmg=$latest_dmg"
             echo "latest_zip=$latest_zip"
+            echo "checksum_file=$checksum_file"
           } >> "$GITHUB_OUTPUT"
 
       - name: Upload workflow artifacts
@@ -237,7 +272,7 @@ jobs:
           path: |
             apps/desktop/channel-artifacts/${{ steps.artifacts.outputs.versioned_dmg }}
             apps/desktop/channel-artifacts/${{ steps.artifacts.outputs.versioned_zip }}
-            apps/desktop/channel-artifacts/desktop-sha256.txt
+            apps/desktop/channel-artifacts/${{ steps.artifacts.outputs.checksum_file }}
           retention-days: 7
           if-no-files-found: error
 
@@ -266,13 +301,14 @@ jobs:
           files: |
             apps/desktop/channel-artifacts/${{ steps.artifacts.outputs.versioned_dmg }}
             apps/desktop/channel-artifacts/${{ steps.artifacts.outputs.versioned_zip }}
-            apps/desktop/channel-artifacts/desktop-sha256.txt
+            apps/desktop/channel-artifacts/${{ steps.artifacts.outputs.checksum_file }}
 
       - name: Patch latest-mac.yml for channel naming
         if: inputs.update_feed_url != ''
         env:
           VERSION: ${{ steps.meta.outputs.desktop_version }}
           CHANNEL: ${{ inputs.channel }}
+          ARCH: ${{ matrix.arch }}
           VERSIONED_DMG: ${{ steps.artifacts.outputs.versioned_dmg }}
           VERSIONED_ZIP: ${{ steps.artifacts.outputs.versioned_zip }}
         shell: bash
@@ -284,11 +320,11 @@ jobs:
             exit 0
           fi
 
-          # electron-builder generates filenames without channel, we need to patch them
-          # Original: nexu-0.1.3-arm64.dmg
-          # Target:   nexu-0.1.3-nightly-arm64.dmg
-          original_dmg="nexu-${VERSION}-arm64.dmg"
-          original_zip="nexu-${VERSION}-arm64.zip"
+          # electron-builder generates filenames without the final public naming format.
+          # Original: nexu-0.1.3-nightly.20260325-arm64.dmg
+          # Target:   nexu-0.1.3-nightly.20260325.ab12cd3-mac-arm64.dmg
+          original_dmg="nexu-${VERSION}-${ARCH}.dmg"
+          original_zip="nexu-${VERSION}-${ARCH}.zip"
 
           echo "Patching latest-mac.yml:"
           echo "  ${original_dmg} → ${VERSIONED_DMG}"
@@ -309,6 +345,7 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           UPDATE_FEED_URL: ${{ inputs.update_feed_url }}
           CHANNEL: ${{ inputs.channel }}
+          ARCH: ${{ matrix.arch }}
           VERSIONED_DMG: ${{ steps.artifacts.outputs.versioned_dmg }}
           VERSIONED_ZIP: ${{ steps.artifacts.outputs.versioned_zip }}
           LATEST_DMG: ${{ steps.artifacts.outputs.latest_dmg }}
@@ -317,34 +354,42 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Extract R2 prefix from feed URL path (e.g. https://desktop-releases.nexu.io/nightly → nightly)
-          r2_prefix=$(node -e "process.stdout.write(new URL(process.env.UPDATE_FEED_URL).pathname.slice(1))")
+          upload_prefix() {
+            local prefix="$1"
 
-          echo "[r2] uploading to prefix: ${r2_prefix}/"
+            echo "[r2] uploading to prefix: ${prefix}/"
 
-          # Upload patched latest-mac.yml for auto-update
-          if [ -f "apps/desktop/release/latest-mac.yml" ]; then
-            echo "Uploading latest-mac.yml → ${r2_prefix}/latest-mac.yml"
-            npx wrangler r2 object put "nexu-desktop-releases/${r2_prefix}/latest-mac.yml" --file "apps/desktop/release/latest-mac.yml" --remote
-          fi
+            if [ -f "apps/desktop/release/latest-mac.yml" ]; then
+              echo "Uploading latest-mac.yml → ${prefix}/latest-mac.yml"
+              npx wrangler r2 object put "nexu-desktop-releases/${prefix}/latest-mac.yml" --file "apps/desktop/release/latest-mac.yml" --remote
+            fi
+
+            echo "Uploading ${VERSIONED_DMG} → ${prefix}/${VERSIONED_DMG}"
+            npx wrangler r2 object put "nexu-desktop-releases/${prefix}/${VERSIONED_DMG}" --file "apps/desktop/channel-artifacts/${VERSIONED_DMG}" --remote
+
+            echo "Uploading ${VERSIONED_ZIP} → ${prefix}/${VERSIONED_ZIP}"
+            npx wrangler r2 object put "nexu-desktop-releases/${prefix}/${VERSIONED_ZIP}" --file "apps/desktop/channel-artifacts/${VERSIONED_ZIP}" --remote
+
+            echo "Uploading ${LATEST_DMG} → ${prefix}/${LATEST_DMG}"
+            npx wrangler r2 object put "nexu-desktop-releases/${prefix}/${LATEST_DMG}" --file "apps/desktop/channel-artifacts/${LATEST_DMG}" --remote
 
-          # Upload versioned artifacts
-          echo "Uploading ${VERSIONED_DMG} → ${r2_prefix}/${VERSIONED_DMG}"
-          npx wrangler r2 object put "nexu-desktop-releases/${r2_prefix}/${VERSIONED_DMG}" --file "apps/desktop/channel-artifacts/${VERSIONED_DMG}" --remote
+            echo "Uploading ${LATEST_ZIP} → ${prefix}/${LATEST_ZIP}"
+            npx wrangler r2 object put "nexu-desktop-releases/${prefix}/${LATEST_ZIP}" --file "apps/desktop/channel-artifacts/${LATEST_ZIP}" --remote
 
-          echo "Uploading ${VERSIONED_ZIP} → ${r2_prefix}/${VERSIONED_ZIP}"
-          npx wrangler r2 object put "nexu-desktop-releases/${r2_prefix}/${VERSIONED_ZIP}" --file "apps/desktop/channel-artifacts/${VERSIONED_ZIP}" --remote
+            echo "Uploading ${{ steps.artifacts.outputs.checksum_file }} → ${prefix}/${{ steps.artifacts.outputs.checksum_file }}"
+            npx wrangler r2 object put "nexu-desktop-releases/${prefix}/${{ steps.artifacts.outputs.checksum_file }}" --file "apps/desktop/channel-artifacts/${{ steps.artifacts.outputs.checksum_file }}" --remote
+          }
 
-          # Upload latest artifacts (overwrite each time)
-          echo "Uploading ${LATEST_DMG} → ${r2_prefix}/${LATEST_DMG}"
-          npx wrangler r2 object put "nexu-desktop-releases/${r2_prefix}/${LATEST_DMG}" --file "apps/desktop/channel-artifacts/${LATEST_DMG}" --remote
+          # Extract R2 prefix from feed URL path (e.g. https://desktop-releases.nexu.io/nightly → nightly)
+          channel_prefix=$(node -e 'const path = new URL(process.env.UPDATE_FEED_URL).pathname.replace(/^\//, "").replace(/\/$/, ""); process.stdout.write(path);')
+          r2_prefix="${channel_prefix}/${ARCH}"
 
-          echo "Uploading ${LATEST_ZIP} → ${r2_prefix}/${LATEST_ZIP}"
-          npx wrangler r2 object put "nexu-desktop-releases/${r2_prefix}/${LATEST_ZIP}" --file "apps/desktop/channel-artifacts/${LATEST_ZIP}" --remote
+          upload_prefix "$r2_prefix"
 
-          # Upload checksum
-          echo "Uploading desktop-sha256.txt → ${r2_prefix}/desktop-sha256.txt"
-          npx wrangler r2 object put "nexu-desktop-releases/${r2_prefix}/desktop-sha256.txt" --file "apps/desktop/channel-artifacts/desktop-sha256.txt" --remote
+          if [ "${ARCH}" = "arm64" ]; then
+            echo "[r2] uploading legacy arm64 compatibility feed to prefix: ${channel_prefix}/"
+            upload_prefix "$channel_prefix"
+          fi
 
       - name: Purge Cloudflare CDN cache for latest artifacts
         if: inputs.update_feed_url != '' && env.CLOUDFLARE_ZONE_ID != ''
@@ -354,17 +399,27 @@ jobs:
           UPDATE_FEED_URL: ${{ inputs.update_feed_url }}
           LATEST_DMG: ${{ steps.artifacts.outputs.latest_dmg }}
           LATEST_ZIP: ${{ steps.artifacts.outputs.latest_zip }}
+          ARCH: ${{ matrix.arch }}
         shell: bash
         run: |
           set -euo pipefail
 
-          base_url="${UPDATE_FEED_URL%/}"
+          base_url="${UPDATE_FEED_URL%/}/${ARCH}"
           urls=(
             "${base_url}/${LATEST_DMG}"
             "${base_url}/${LATEST_ZIP}"
             "${base_url}/latest-mac.yml"
           )
 
+          if [ "${ARCH}" = "arm64" ]; then
+            legacy_base_url="${UPDATE_FEED_URL%/}"
+            urls+=(
+              "${legacy_base_url}/${LATEST_DMG}"
+              "${legacy_base_url}/${LATEST_ZIP}"
+              "${legacy_base_url}/latest-mac.yml"
+            )
+          fi
+
           files_json=$(printf '%s\n' "${urls[@]}" | jq -R . | jq -sc '.')
           echo "[cf-purge] Purging: ${files_json}"
 
@@ -383,11 +438,12 @@ jobs:
           VERSIONED_ZIP: ${{ steps.artifacts.outputs.versioned_zip }}
           LATEST_DMG: ${{ steps.artifacts.outputs.latest_dmg }}
           LATEST_ZIP: ${{ steps.artifacts.outputs.latest_zip }}
+          ARCH: ${{ matrix.arch }}
         shell: bash
         run: |
           set -euo pipefail
 
-          base_url="${UPDATE_FEED_URL%/}"
+          base_url="${UPDATE_FEED_URL%/}/${ARCH}"
           latest_yml_url="${base_url}/latest-mac.yml"
           versioned_dmg_url="${base_url}/${VERSIONED_DMG}"
           versioned_zip_url="${base_url}/${VERSIONED_ZIP}"

.github/workflows/desktop-ci-dev.yml

@@ -93,6 +93,7 @@ jobs:
         if: matrix.os == 'macos'
         env:
           NEXU_DESKTOP_CHECK_CAPTURE_DIR: ${{ runner.temp }}/desktop-ci
+          NEXU_USE_LAUNCHD: "0"
         run: pnpm check:dev
 
       - name: Verify Windows desktop build pipeline

.github/workflows/desktop-ci-dist.yml

@@ -50,11 +50,15 @@ jobs:
       matrix:
         include:
           - os: macos
-            runs_on: macos-14
+            runner: macos-14
+            arch: arm64
+          - os: macos
+            runner: macos-15-intel
+            arch: x64
           - os: windows
-            runs_on: windows-latest
-
-    runs-on: ${{ matrix.runs_on }}
+            runner: windows-latest
+            arch: x64
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
 
     steps:
@@ -81,7 +85,9 @@ jobs:
         run: pnpm exec electron --version
 
       - name: Build unsigned desktop bundle
-        run: ${{ matrix.os == 'macos' && 'pnpm dist:mac:unsigned' || 'pnpm --filter @nexu/desktop dist:win:unsigned' }}
+        env:
+          NEXU_DESKTOP_TARGET_ARCH: ${{ matrix.arch }}
+        run: ${{ matrix.os == 'windows' && 'pnpm --filter @nexu/desktop dist:win:unsigned' || 'pnpm dist:mac:unsigned' }}
 
       - name: Set packaged app paths
         shell: pwsh
@@ -93,7 +99,7 @@ jobs:
 
           if ("${{ matrix.os }}" -eq "macos") {
             $packagedUserDataDir = Join-Path $packagedHome "Library/Application Support/@nexu/desktop"
-            $packagedApp = "apps/desktop/release/mac-arm64/Nexu.app"
+            $packagedApp = "apps/desktop/release/mac-${{ matrix.arch }}/Nexu.app"
             $packagedExecutable = "$packagedApp/Contents/MacOS/Nexu"
           } else {
             $packagedUserDataDir = Join-Path $packagedHome "nexu-desktop"
@@ -131,6 +137,17 @@ jobs:
           if (-not (Test-Path $env:PACKAGED_APP)) { throw "Packaged app path missing: $env:PACKAGED_APP" }
           if (-not (Test-Path $env:PACKAGED_EXECUTABLE)) { throw "Packaged executable missing: $env:PACKAGED_EXECUTABLE" }
 
+      - name: Upload desktop build artifacts
+        if: success() && matrix.os == 'macos'
+        uses: actions/upload-artifact@v4
+        with:
+          name: desktop-ci-dist-${{ matrix.os }}-${{ matrix.arch }}
+          path: |
+            apps/desktop/release/*.dmg
+            apps/desktop/release/*.zip
+          if-no-files-found: error
+          retention-days: 3
+
       - name: Verify packaged runtime unit health
         if: matrix.os == 'macos'
         env:
@@ -161,7 +178,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: desktop-ci-logs-${{ matrix.os }}
+          name: desktop-ci-logs-${{ matrix.os }}-${{ matrix.arch }}
           path: ${{ runner.temp }}/desktop-ci
           if-no-files-found: warn
-          retention-days: 7
+          retention-days: 3