build(desktop): allow controlled unsigned v0.1.0 release

frontend/scripts/resolve-desktop-release-policy.mjs

@@ -0,0 +1,47 @@
+import { appendFile, readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadDesktopReleasePolicy, resolveDesktopReleasePolicy } from "./desktop-release-policy.mjs";
+
+const frontendDir = fileURLToPath(new URL("../", import.meta.url));
+const packageInfo = JSON.parse(await readFile(resolve(frontendDir, "package.json"), "utf8"));
+const args = process.argv.slice(2);
+const value = (name) => {
+  const index = args.indexOf(name);
+  return index >= 0 ? args[index + 1] : undefined;
+};
+
+const policy = await loadDesktopReleasePolicy();
+const resolution = resolveDesktopReleasePolicy(packageInfo.version, policy);
+const expectedTag = `v${packageInfo.version}`;
+
+if (args.includes("--require-tag")) {
+  if (process.env.GITHUB_REF_TYPE !== "tag" || process.env.GITHUB_REF_NAME !== expectedTag) {
+    throw new Error(
+      `Desktop release policy must be resolved from tag ${expectedTag}; found ${process.env.GITHUB_REF_TYPE || "<missing>"} ${process.env.GITHUB_REF_NAME || "<missing>"}.`,
+    );
+  }
+}
+
+const outputs = {
+  version: resolution.version,
+  platform_signing_mode: resolution.platformSigningMode,
+  macos_signing: resolution.macosSigning,
+  windows_signing: resolution.windowsSigning,
+  artifact_label: resolution.artifactLabel,
+  distribution: resolution.distribution,
+  warning_required: String(resolution.warningRequired),
+  updater_signing_required: String(policy.updaterSigningRequired),
+};
+
+const githubOutput = value("--github-output");
+if (githubOutput) {
+  await appendFile(githubOutput, `${Object.entries(outputs).map(([key, output]) => `${key}=${output}`).join("\n")}\n`);
+}
+
+console.log("Desktop release policy check passed.");
+console.log(`  version: ${resolution.version}`);
+console.log(`  platform signing mode: ${resolution.platformSigningMode}`);
+console.log(`  macOS: ${resolution.macosSigning}`);
+console.log(`  Windows: ${resolution.windowsSigning}`);
+console.log("  updater signing: required");