deepseek-harness/.github/workflows/desktop-publish.yml

name: Publish Desktop · COS

run-name: Publish Desktop package ${{ inputs.package_run_id }} / attempt ${{ inputs.package_run_attempt || 'latest' }}

on:
  workflow_dispatch:
    inputs:
      package_run_id:
        description: '打包运行 ID：填写成功的 Package Desktop run ID；发布环境和 release ID 沿用原包'
        type: string
        required: true
      package_run_attempt:
        description: '打包尝试次数：留空选择最新一次，且必须成功；失败时不会回退到旧包'
        type: string
        required: false
        default: ''

permissions:
  contents: read
  actions: read

jobs:
  route:
    runs-on: ubuntu-latest
    outputs:
      selection: ${{ steps.route.outputs.selection }}
      runner: ${{ steps.route.outputs.runner }}
    steps:
      - name: Require master for publication
        run: node -e "if (process.env.GITHUB_REF !== 'refs/heads/master') throw new Error('Desktop publication must be dispatched from master')"
      - uses: actions/[email protected]
        with:
          persist-credentials: false
      - name: Reject debugging packages before dependency installation
        id: preflight
        env:
          GH_TOKEN: ${{ github.token }}
        run: node apps/desktop/scripts/preflight-desktop-publish.mjs
      - uses: pnpm/[email protected]
      - uses: actions/[email protected]
        with:
          node-version: '24'
      - run: pnpm install --frozen-lockfile
      - name: Resolve original package and machine
        id: route
        env:
          GH_TOKEN: ${{ github.token }}
          DESKTOP_PUBLISH_RUNNERS: ${{ vars.DESKTOP_PUBLISH_RUNNERS }}
          DESKTOP_PACKAGE_ATTEMPT: ${{ steps.preflight.outputs.attempt }}
        run: node --import tsx apps/desktop/scripts/resolve-desktop-publish-ci.ts

  prepare:
    needs: route
    runs-on: [self-hosted, '${{ needs.route.outputs.runner }}']
    timeout-minutes: 30
    outputs:
      route: ${{ steps.local.outputs.route }}
      preset: ${{ steps.local.outputs.preset }}
      approval: ${{ steps.check.outputs.approval }}
      label: ${{ steps.check.outputs.label }}
    env:
      DESKTOP_PACKAGE_SELECTION: ${{ needs.route.outputs.selection }}
      DSH_TELEMETRY_DISABLED: '1'
    steps:
      - uses: actions/[email protected]
        with:
          persist-credentials: false
          clean: false
          path: desktop-publisher
      - uses: pnpm/[email protected]
        with:
          package_json_file: desktop-publisher/package.json
          dest: ${{ runner.temp }}/publish-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
      - uses: actions/[email protected]
        with:
          node-version: '24'
      - name: Check local publication configuration before dependency installation
        working-directory: desktop-publisher
        run: node apps/desktop/scripts/preflight-desktop-publish-local.mjs
      - run: pnpm install --frozen-lockfile
        working-directory: desktop-publisher
      - name: Resolve retained package and approval environment
        id: local
        working-directory: desktop-publisher
        env:
          GH_TOKEN: ${{ github.token }}
        run: node --import tsx apps/desktop/scripts/resolve-retained-desktop-publish-ci.ts
      - name: Verify local package without upload credentials
        id: check
        working-directory: desktop-publisher
        env:
          DESKTOP_PUBLISH_ROUTE: ${{ steps.local.outputs.route }}
        run: node --import tsx apps/desktop/scripts/publish-desktop-ci.ts --check

  publish:
    name: Approve ${{ needs.prepare.outputs.label }}
    needs: [route, prepare]
    runs-on: [self-hosted, '${{ needs.route.outputs.runner }}']
    environment: ${{ needs.prepare.outputs.preset == 'production' && 'desktop-production' || 'desktop-test' }}
    concurrency:
      group: desktop-publish-${{ needs.route.outputs.runner }}-${{ needs.prepare.outputs.preset }}
      cancel-in-progress: false
    timeout-minutes: 90
    env:
      DESKTOP_APPROVED_PACKAGE: ${{ needs.prepare.outputs.approval }}
      DESKTOP_PUBLISH_ROUTE: ${{ needs.prepare.outputs.route }}
      DSH_TELEMETRY_DISABLED: '1'
    steps:
      - uses: actions/[email protected]
        with:
          persist-credentials: false
          clean: false
          path: desktop-publisher
      - uses: pnpm/[email protected]
        with:
          package_json_file: desktop-publisher/package.json
          dest: ${{ runner.temp }}/publish-pnpm-${{ github.run_id }}-${{ github.run_attempt }}
      - uses: actions/[email protected]
        with:
          node-version: '24'
      - name: Check local publication configuration before dependency installation
        working-directory: desktop-publisher
        run: node apps/desktop/scripts/preflight-desktop-publish-local.mjs
      - run: pnpm install --frozen-lockfile
        working-directory: desktop-publisher
      - name: Verify local package without upload credentials
        id: check
        working-directory: desktop-publisher
        run: node --import tsx apps/desktop/scripts/publish-desktop-ci.ts --check
      - name: Read machine GitHub App key
        if: needs.prepare.outputs.preset == 'production'
        id: key
        env:
          APP_KEY_FILE: ${{ steps.check.outputs.app-key-file }}
        working-directory: desktop-publisher
        run: node apps/desktop/scripts/read-desktop-app-key.mjs
      - name: Create short-lived tag token
        if: needs.prepare.outputs.preset == 'production'
        id: app
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
          client-id: ${{ steps.check.outputs.app-client-id }}
          private-key: ${{ steps.key.outputs.private-key }}
          owner: ${{ github.repository_owner }}
          repositories: ${{ github.event.repository.name }}
          permission-contents: write
      - name: Publish files, update feeds and record release tag
        id: publish
        working-directory: desktop-publisher
        env:
          DESKTOP_TAG_TOKEN: ${{ steps.app.outputs.token }}
        run: node --import tsx apps/desktop/scripts/publish-desktop-ci.ts --publish
      - name: Retain publication audit
        if: always() && steps.publish.outputs.record != ''
        uses: actions/[email protected]
        with:
          name: desktop-publication-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ steps.publish.outputs.record }}/
          if-no-files-found: error
          retention-days: 30