build(desktop): allow controlled unsigned v0.1.0 release

frontend/scripts/verify-desktop-release-readiness.mjs

@@ -2,10 +2,13 @@ import { execFileSync } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { loadDesktopReleasePolicy, resolveDesktopReleasePolicy } from "./desktop-release-policy.mjs";
 
 const frontendDir = fileURLToPath(new URL("../", import.meta.url));
 const rootDir = resolve(frontendDir, "..");
 const packageInfo = JSON.parse(await readFile(resolve(frontendDir, "package.json"), "utf8"));
+const desktopReleasePolicy = await loadDesktopReleasePolicy();
+const desktopReleaseResolution = resolveDesktopReleasePolicy(packageInfo.version, desktopReleasePolicy);
 const failures = [];
 
 const env = process.env;
@@ -13,6 +16,10 @@ const fullShaPattern = /^[0-9a-f]{40}$/i;
 const expectedTag = `v${packageInfo.version}`;
 const requiresMacosSigning = env.REQUIRE_DESKTOP_SIGNING === "true";
 const requiresWindowsSigning = env.REQUIRE_WINDOWS_SIGNING === "true";
+const requiresUpdaterSigning = env.REQUIRE_UPDATER_SIGNING === "true";
+const allowsUnsignedPlatformRelease = env.ALLOW_UNSIGNED_PLATFORM_RELEASE === "true";
+const desktopPlatformSigningMode = env.DESKTOP_PLATFORM_SIGNING_MODE;
+const desktopReleasePlatform = env.DESKTOP_RELEASE_PLATFORM;
 const requiredUpdaterEnv = ["TAURI_SIGNING_PRIVATE_KEY", "TAURI_SIGNING_PRIVATE_KEY_PASSWORD"];
 const requiredMacosEnv = ["APPLE_ID", "APPLE_PASSWORD", "APPLE_TEAM_ID"];
 const requiredWindowsEnv = ["WINDOWS_CERTIFICATE", "WINDOWS_CERTIFICATE_PASSWORD"];
@@ -38,7 +45,7 @@ const gitMaybe = (args) => {
 };
 
 const requireEnv = (name) => {
-  assert(Boolean(env[name]), `${name} must be configured for signed desktop release readiness.`);
+  assert(Boolean(env[name]), `${name} must be configured for desktop release readiness.`);
 };
 
 const validateBaseUrl = () => {
@@ -95,19 +102,54 @@ if (headSha && env.VITE_BUILD_COMMIT) {
   assert(env.VITE_BUILD_COMMIT === headSha, "VITE_BUILD_COMMIT must match the current release commit.");
 }
 
-assert(
-  requiresMacosSigning || requiresWindowsSigning,
-  "Release readiness requires REQUIRE_DESKTOP_SIGNING=true or REQUIRE_WINDOWS_SIGNING=true.",
-);
 assert(
   !(requiresMacosSigning && requiresWindowsSigning),
   "macOS and Windows signing readiness must be checked in their native jobs.",
 );
+assert(
+  desktopReleasePlatform === "macos" || desktopReleasePlatform === "windows",
+  "DESKTOP_RELEASE_PLATFORM must be macos or windows.",
+);
+assert(
+  desktopPlatformSigningMode === desktopReleaseResolution.platformSigningMode,
+  `DESKTOP_PLATFORM_SIGNING_MODE must be ${desktopReleaseResolution.platformSigningMode} for v${packageInfo.version}.`,
+);
+assert(
+  desktopReleasePolicy.updaterSigningRequired === true && requiresUpdaterSigning,
+  "Release readiness requires REQUIRE_UPDATER_SIGNING=true; updater signing cannot be disabled.",
+);
 
 for (const name of requiredUpdaterEnv) {
   requireEnv(name);
 }
 
+if (desktopPlatformSigningMode === "signed") {
+  assert(!allowsUnsignedPlatformRelease, "Signed releases must not enable ALLOW_UNSIGNED_PLATFORM_RELEASE.");
+  assert(
+    (desktopReleasePlatform === "macos" && requiresMacosSigning && !requiresWindowsSigning) ||
+      (desktopReleasePlatform === "windows" && requiresWindowsSigning && !requiresMacosSigning),
+    "Signed readiness must enable only the matching native platform signing requirement.",
+  );
+}
+
+if (desktopPlatformSigningMode === "unsigned-exception") {
+  assert(
+    desktopReleaseResolution.platformSigningMode === "unsigned-exception",
+    `v${packageInfo.version} has no approved unsigned platform release exception.`,
+  );
+  assert(allowsUnsignedPlatformRelease, "The approved exception requires ALLOW_UNSIGNED_PLATFORM_RELEASE=true.");
+  assert(
+    !requiresMacosSigning && !requiresWindowsSigning,
+    "Unsigned platform readiness must not claim Apple or Windows platform signing.",
+  );
+  if (desktopReleasePlatform === "macos") {
+    assert(process.platform === "darwin", "The macOS ad-hoc readiness check must run on macOS.");
+  }
+  if (desktopReleasePlatform === "windows") {
+    assert(process.platform === "win32", "The unsigned Windows readiness check must run on Windows.");
+  }
+}
+
 if (requiresMacosSigning) {
   assert(process.platform === "darwin", "Signed macOS desktop release readiness must run on macOS.");
   for (const name of requiredMacosEnv) {