build(desktop): allow controlled unsigned v0.1.0 release

frontend/scripts/verify-release-build-env.mjs

@@ -2,10 +2,13 @@ import { execFileSync } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { loadDesktopReleasePolicy, resolveDesktopReleasePolicy } from "./desktop-release-policy.mjs";
 
 const frontendDir = fileURLToPath(new URL("../", import.meta.url));
 const rootDir = resolve(frontendDir, "..");
 const packageInfo = JSON.parse(await readFile(resolve(frontendDir, "package.json"), "utf8"));
+const desktopReleasePolicy = await loadDesktopReleasePolicy();
+const desktopReleaseResolution = resolveDesktopReleasePolicy(packageInfo.version, desktopReleasePolicy);
 const failures = [];
 
 const allowedChannels = new Set(["dev", "main", "release", "local"]);
@@ -20,6 +23,17 @@ const isTagBuild = env.GITHUB_REF_TYPE === "tag";
 const isReleaseBuild = env.RELEASE_BUILD === "true" || isTagBuild || channel === "release";
 const requiresMacosSigning = env.REQUIRE_DESKTOP_SIGNING === "true";
 const requiresWindowsSigning = env.REQUIRE_WINDOWS_SIGNING === "true";
+const requiresUpdaterSigning = env.REQUIRE_UPDATER_SIGNING === "true";
+const allowsUnsignedPlatformRelease = env.ALLOW_UNSIGNED_PLATFORM_RELEASE === "true";
+const desktopPlatformSigningMode = env.DESKTOP_PLATFORM_SIGNING_MODE;
+const desktopReleasePlatform = env.DESKTOP_RELEASE_PLATFORM;
+const isNativeDesktopRelease = Boolean(
+  desktopReleasePlatform ||
+    desktopPlatformSigningMode ||
+    requiresMacosSigning ||
+    requiresWindowsSigning ||
+    requiresUpdaterSigning,
+);
 
 const fail = (message) => failures.push(message);
 const assert = (condition, message) => {
@@ -27,7 +41,7 @@ const assert = (condition, message) => {
 };
 
 const requireEnv = (name) => {
-  assert(Boolean(env[name]), `${name} must be configured for signed desktop release builds.`);
+  assert(Boolean(env[name]), `${name} must be configured for this desktop release build.`);
 };
 
 const gitHead = () => {
@@ -74,13 +88,59 @@ assert(
   "macOS and Windows signing requirements must be checked in their native jobs.",
 );
 
-if (requiresMacosSigning) {
-  assert(process.platform === "darwin", "Signed macOS desktop release builds must run on macOS.");
+if (isNativeDesktopRelease) {
+  assert(isReleaseBuild, "Native desktop release settings may only be used for release builds.");
+  assert(
+    desktopReleasePolicy.updaterSigningRequired === true && requiresUpdaterSigning,
+    "Formal desktop releases must set REQUIRE_UPDATER_SIGNING=true; updater signing cannot be disabled.",
+  );
+  assert(
+    desktopPlatformSigningMode === desktopReleaseResolution.platformSigningMode,
+    `DESKTOP_PLATFORM_SIGNING_MODE must be ${desktopReleaseResolution.platformSigningMode} for v${packageInfo.version}.`,
+  );
+  assert(
+    desktopReleasePlatform === "macos" || desktopReleasePlatform === "windows",
+    "DESKTOP_RELEASE_PLATFORM must be macos or windows for native desktop release builds.",
+  );
   if (isCi) {
-    assert(isTagBuild, "Signed desktop release candidate builds in CI must run from a release tag.");
+    assert(isTagBuild, "Native desktop release candidate builds in CI must run from a release tag.");
   }
+}
+
+if (requiresUpdaterSigning) {
   requireEnv("TAURI_SIGNING_PRIVATE_KEY");
   requireEnv("TAURI_SIGNING_PRIVATE_KEY_PASSWORD");
+}
+
+if (desktopPlatformSigningMode === "signed") {
+  assert(!allowsUnsignedPlatformRelease, "Signed releases must not enable ALLOW_UNSIGNED_PLATFORM_RELEASE.");
+  assert(
+    (desktopReleasePlatform === "macos" && requiresMacosSigning && !requiresWindowsSigning) ||
+      (desktopReleasePlatform === "windows" && requiresWindowsSigning && !requiresMacosSigning),
+    "Signed native release jobs must enable only their matching platform signing requirement.",
+  );
+}
+
+if (desktopPlatformSigningMode === "unsigned-exception") {
+  assert(
+    desktopReleaseResolution.platformSigningMode === "unsigned-exception",
+    `v${packageInfo.version} has no approved unsigned platform release exception.`,
+  );
+  assert(allowsUnsignedPlatformRelease, "The approved exception requires ALLOW_UNSIGNED_PLATFORM_RELEASE=true.");
+  assert(
+    !requiresMacosSigning && !requiresWindowsSigning,
+    "Unsigned platform exceptions must not claim Apple or Windows platform signing.",
+  );
+  if (desktopReleasePlatform === "macos") {
+    assert(process.platform === "darwin", "The macOS ad-hoc release exception must run on macOS.");
+  }
+  if (desktopReleasePlatform === "windows") {
+    assert(process.platform === "win32", "The unsigned Windows release exception must run on Windows.");
+  }
+}
+
+if (requiresMacosSigning) {
+  assert(process.platform === "darwin", "Signed macOS desktop release builds must run on macOS.");
   requireEnv("APPLE_ID");
   requireEnv("APPLE_PASSWORD");
   requireEnv("APPLE_TEAM_ID");
@@ -95,11 +155,6 @@ if (requiresMacosSigning) {
 
 if (requiresWindowsSigning) {
   assert(process.platform === "win32", "Signed Windows desktop release builds must run on Windows.");
-  if (isCi) {
-    assert(isTagBuild, "Signed Windows desktop release candidate builds in CI must run from a release tag.");
-  }
-  requireEnv("TAURI_SIGNING_PRIVATE_KEY");
-  requireEnv("TAURI_SIGNING_PRIVATE_KEY_PASSWORD");
   requireEnv("WINDOWS_CERTIFICATE");
   requireEnv("WINDOWS_CERTIFICATE_PASSWORD");
   requireEnv("WINDOWS_TIMESTAMP_URL");