Skip to content

Commit bc8875c

Browse files
TheodoreSpeaksTheodoreSpeaks
committed
fix(desktop): validate prerelease authentication
1 parent c07e736 commit bc8875c

2 files changed

Lines changed: 56 additions & 31 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -788,8 +788,11 @@ jobs:
788788
desktop-prerelease:
789789
name: Desktop Prerelease Build
790790
needs: [create-desktop-prerelease, check-desktop-signing]
791+
# The reusable workflow declares contents: write for its stable-release
792+
# path. GitHub cannot elevate a caller's token, even though this prerelease
793+
# path uses the dedicated cross-repository token for its actual upload.
791794
permissions:
792-
contents: read
795+
contents: write
793796
uses: ./.github/workflows/desktop-release.yml
794797
with:
795798
version: ${{ needs.create-desktop-prerelease.outputs.version }}

‎.github/workflows/desktop-release.yml‎

Lines changed: 52 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,46 @@ jobs:
5454
- name: Checkout code
5555
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
5656

57+
# Prerelease versions carry their environment in the tag: -dev.N is a
58+
# dev build, -staging.N a staging build. Legacy -alpha/-beta tags remain
59+
# accepted while already-published builds age out. The channel decides the app's
60+
# identity (name/bundle id — a separate app per environment, installable
61+
# side by side) and the default origin baked into the bundle, which in
62+
# turn selects the update feed the installed app polls.
63+
- name: Resolve channel identity
64+
id: channel
65+
env:
66+
VERSION: ${{ inputs.version }}
67+
run: |
68+
case "$VERSION" in
69+
*-dev.*|*-alpha.*)
70+
NAME='Sim Dev'; APP_ID=ai.sim.desktop.dev; ORIGIN=https://www.dev.sim.ai; RELEASE_REPOSITORY=simstudioai/sim-desktop-releases; TOKEN_KIND=prerelease ;;
71+
*-staging.*|*-beta.*)
72+
NAME='Sim Staging'; APP_ID=ai.sim.desktop.staging; ORIGIN=https://www.staging.sim.ai; RELEASE_REPOSITORY=simstudioai/sim-desktop-releases; TOKEN_KIND=prerelease ;;
73+
*)
74+
NAME='Sim'; APP_ID=ai.sim.desktop; ORIGIN=''; RELEASE_REPOSITORY="$GITHUB_REPOSITORY"; TOKEN_KIND=stable ;;
75+
esac
76+
{
77+
echo "name=$NAME"
78+
echo "app_id=$APP_ID"
79+
echo "origin=$ORIGIN"
80+
echo "release_repository=$RELEASE_REPOSITORY"
81+
echo "token_kind=$TOKEN_KIND"
82+
} >> "$GITHUB_OUTPUT"
83+
echo "Building $NAME ($APP_ID) for $RELEASE_REPOSITORY; default origin: ${ORIGIN:-production}"
84+
85+
- name: Validate release authentication
86+
if: ${{ inputs.publish }}
87+
env:
88+
DESKTOP_RELEASE_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
89+
RELEASE_REPOSITORY: ${{ steps.channel.outputs.release_repository }}
90+
TOKEN_KIND: ${{ steps.channel.outputs.token_kind }}
91+
run: |
92+
if [ "$TOKEN_KIND" = prerelease ] && [ -z "$DESKTOP_RELEASE_TOKEN" ]; then
93+
echo "::error::DESKTOP_RELEASE_TOKEN is required to publish prereleases to $RELEASE_REPOSITORY."
94+
exit 1
95+
fi
96+
5797
- name: Setup Bun
5898
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
5999
with:
@@ -91,34 +131,6 @@ jobs:
91131
exit 1
92132
fi
93133
94-
# Prerelease versions carry their environment in the tag: -dev.N is a
95-
# dev build, -staging.N a staging build. Legacy -alpha/-beta tags remain
96-
# accepted while already-published builds age out. The channel decides the app's
97-
# identity (name/bundle id — a separate app per environment, installable
98-
# side by side) and the default origin baked into the bundle, which in
99-
# turn selects the update feed the installed app polls.
100-
- name: Resolve channel identity
101-
id: channel
102-
env:
103-
VERSION: ${{ inputs.version }}
104-
run: |
105-
case "$VERSION" in
106-
*-dev.*|*-alpha.*)
107-
NAME='Sim Dev'; APP_ID=ai.sim.desktop.dev; ORIGIN=https://www.dev.sim.ai; RELEASE_REPOSITORY=simstudioai/sim-desktop-releases; TOKEN_KIND=prerelease ;;
108-
*-staging.*|*-beta.*)
109-
NAME='Sim Staging'; APP_ID=ai.sim.desktop.staging; ORIGIN=https://www.staging.sim.ai; RELEASE_REPOSITORY=simstudioai/sim-desktop-releases; TOKEN_KIND=prerelease ;;
110-
*)
111-
NAME='Sim'; APP_ID=ai.sim.desktop; ORIGIN=''; RELEASE_REPOSITORY="$GITHUB_REPOSITORY"; TOKEN_KIND=stable ;;
112-
esac
113-
{
114-
echo "name=$NAME"
115-
echo "app_id=$APP_ID"
116-
echo "origin=$ORIGIN"
117-
echo "release_repository=$RELEASE_REPOSITORY"
118-
echo "token_kind=$TOKEN_KIND"
119-
} >> "$GITHUB_OUTPUT"
120-
echo "Building $NAME ($APP_ID) for $RELEASE_REPOSITORY; default origin: ${ORIGIN:-production}"
121-
122134
- name: Bundle main and preload
123135
working-directory: apps/desktop
124136
env:
@@ -179,14 +191,24 @@ jobs:
179191
- name: Upload artifacts to the release
180192
if: ${{ inputs.publish }}
181193
env:
182-
GH_TOKEN: ${{ steps.channel.outputs.token_kind == 'prerelease' && secrets.DESKTOP_RELEASE_TOKEN || github.token }}
194+
DESKTOP_RELEASE_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
183195
RELEASE_REPOSITORY: ${{ steps.channel.outputs.release_repository }}
196+
SOURCE_RELEASE_TOKEN: ${{ github.token }}
197+
TOKEN_KIND: ${{ steps.channel.outputs.token_kind }}
184198
VERSION: ${{ inputs.version }}
185199
run: |
200+
case "$TOKEN_KIND" in
201+
prerelease) GH_TOKEN="$DESKTOP_RELEASE_TOKEN" ;;
202+
stable) GH_TOKEN="$SOURCE_RELEASE_TOKEN" ;;
203+
*)
204+
echo "::error::Unknown desktop release token kind: $TOKEN_KIND"
205+
exit 1 ;;
206+
esac
186207
if [ -z "$GH_TOKEN" ]; then
187-
echo "::error::DESKTOP_RELEASE_TOKEN is required to publish prereleases to $RELEASE_REPOSITORY."
208+
echo "::error::No GitHub token is available to publish to $RELEASE_REPOSITORY."
188209
exit 1
189210
fi
211+
export GH_TOKEN
190212
# electron-builder's GitHub provider always names the manifest
191213
# latest-mac.yml (channels are a generic-provider concept), and the
192214
# update feed expects exactly that asset name on every release —

0 commit comments

Comments
 (0)