fix(desktop): stage the runtime on Windows and skip empty signing credentials

Node refuses to spawn a .cmd shim without a shell, so pnpm.cmd raised EINVAL
and the Windows job never staged the Host closure. Spawn a bare pnpm through a
shell on Windows and quote arguments cmd.exe would otherwise split.

An unset GitHub secret interpolates to an empty string rather than to an absent
variable, and electron-builder resolves an empty CSC_LINK as a certificate path
-- path.resolve(appDir, '') is the app directory, so the mac job died on 'not a
file'. Export only credentials that carry a value, and state the unsigned macOS
path explicitly.

Author: elkaix

.changeset/desktop-windows-ci-fixes.md

@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-desktop': patch
+---
+
+Fix Windows runtime staging and skip empty signing credentials in the desktop release workflow

.github/workflows/desktop-release.yml

@@ -51,16 +51,33 @@ jobs:
       # Without Developer ID signing secrets, electron-builder publishes an
       # ad-hoc/self-signed app. macOS auto-update will not accept unsigned updates,
       # but this still proves packaging and the feed shape.
+      # An unset GitHub secret interpolates to an empty string, and
+      # electron-builder resolves an empty CSC_LINK as a certificate path
+      # (path.resolve(appDir, '') === appDir), failing with "not a file".
+      # Export only the variables that carry a value.
+      - name: Resolve macOS signing credentials
+        shell: bash
+        env:
+          IN_CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
+          IN_CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
+          IN_APPLE_ID: ${{ secrets.APPLE_ID }}
+          IN_APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          IN_APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          for name in CSC_LINK CSC_KEY_PASSWORD APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID; do
+            input="IN_${name}"
+            value="${!input:-}"
+            if [ -n "$value" ]; then printf '%s<<__EOF__\n%s\n__EOF__\n' "$name" "$value" >> "$GITHUB_ENV"; fi
+          done
+          if [ -z "${IN_CSC_LINK:-}" ]; then
+            echo 'CSC_IDENTITY_AUTO_DISCOVERY=false' >> "$GITHUB_ENV"
+            echo 'No macOS signing certificate configured; building unsigned.'
+          fi
       - name: Package and publish desktop release
         working-directory: apps/desktop
         run: pnpm exec electron-builder --mac dmg zip --publish always
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
-          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
       - name: Upload macOS artifacts for manual runs
         if: github.event_name == 'workflow_dispatch'
@@ -107,15 +124,25 @@ jobs:
         working-directory: apps/desktop
         run: node --import tsx scripts/stage-runtime.ts
 
-      # Without WIN_CSC_* signing secrets, Windows artifacts are unsigned and
-      # installers trigger a SmartScreen warning on first run.
+      # Only non-empty WIN_CSC_* signing secrets are exported. Without them,
+      # Windows artifacts are unsigned and installers trigger a SmartScreen
+      # warning on first run.
+      - name: Resolve Windows signing credentials
+        shell: bash
+        env:
+          IN_WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
+          IN_WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
+        run: |
+          for name in WIN_CSC_LINK WIN_CSC_KEY_PASSWORD; do
+            input="IN_${name}"
+            value="${!input:-}"
+            if [ -n "$value" ]; then printf '%s<<__EOF__\n%s\n__EOF__\n' "$name" "$value" >> "$GITHUB_ENV"; fi
+          done
       - name: Package and publish desktop release
         working-directory: apps/desktop
         run: pnpm exec electron-builder --win nsis --x64 --publish always
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
-          WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
 
       - name: Upload Windows artifacts for manual runs
         if: github.event_name == 'workflow_dispatch'

apps/desktop/scripts/stage-runtime.ts

@@ -5,6 +5,7 @@ import { existsSync } from 'node:fs'
 import { cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join, resolve, sep } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 const desktopRoot = resolve(import.meta.dirname, '..')
 const repositoryRoot = resolve(desktopRoot, '../..')
@@ -14,9 +15,42 @@ const entry = join(staging, 'node_modules/@pymodel/pythinker-code/dist/launcher.
 const frontend = join(staging, 'node_modules/@pymodel/pythinker-code/dist-web/index.html')
 const workspaceState = join(repositoryRoot, 'node_modules/.pnpm-workspace-state-v1.json')
 
+/** Windows characters that make an argument unsafe to hand to `cmd.exe` unquoted. */
+const WINDOWS_UNSAFE_ARGUMENT = /[\s"&()<>^|]/u
+
+/**
+ * Decide how to invoke a package manager on one platform.
+ *
+ * Node refuses to spawn a `.cmd` or `.bat` shim without a shell, so Windows
+ * needs `shell: true`. With a shell, Node does not quote arguments, so any
+ * argument carrying whitespace or a `cmd.exe` metacharacter is quoted here.
+ * @param platform - The value of `process.platform`.
+ * @param command - The package-manager binary name.
+ * @param args - Arguments in their unquoted form.
+ * @returns The command, arguments and shell flag to pass to `spawn`.
+ */
+export function packageManagerInvocation(platform: string, command: string, args: readonly string[]): {
+  readonly command: string
+  readonly args: readonly string[]
+  readonly shell: boolean
+} {
+  if (platform !== 'win32') return { command, args, shell: false }
+  return {
+    command,
+    args: args.map(argument => (WINDOWS_UNSAFE_ARGUMENT.test(argument) ? `"${argument}"` : argument)),
+    shell: true,
+  }
+}
+
 async function run(command: string, args: readonly string[]): Promise<void> {
+  const invocation = packageManagerInvocation(process.platform, command, args)
   await new Promise<void>((accept, reject) => {
-    const child = spawn(command, args, { cwd: repositoryRoot, env: { ...process.env, CI: 'true' }, stdio: 'inherit' })
+    const child = spawn(invocation.command, [...invocation.args], {
+      cwd: repositoryRoot,
+      env: { ...process.env, CI: 'true' },
+      stdio: 'inherit',
+      shell: invocation.shell,
+    })
     child.once('error', reject)
     child.once('exit', (code, signal) => {
       if (code === 0) accept()
@@ -60,7 +94,7 @@ async function materializeLinks(): Promise<void> {
 async function deploy(target: string): Promise<void> {
   const savedWorkspaceState = existsSync(workspaceState) ? await readFile(workspaceState) : undefined
   try {
-    await run(process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm', [
+    await run('pnpm', [
       '--config.verify-deps-before-run=false', '--filter', deployPackage, 'deploy', '--legacy', '--prod',
       '--config.node-linker=hoisted', '--config.auto-install-peers=false', '--config.link-workspace-packages=true', target,
     ])
@@ -96,4 +130,7 @@ async function main(): Promise<void> {
   console.log(`desktop runtime staged at ${staging}`)
 }
 
-await main()
+const invokedPath = process.argv[1]
+if (invokedPath !== undefined && resolve(invokedPath) === fileURLToPath(import.meta.url)) {
+  await main()
+}

apps/desktop/tests/stage-runtime.spec.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from 'vitest'
+import { packageManagerInvocation } from '../scripts/stage-runtime'
+
+describe('package manager invocation', () => {
+  it('leaves non-Windows invocations untouched', () => {
+    const args = ['--filter', 'x', '/tmp/a b']
+
+    expect(packageManagerInvocation('darwin', 'pnpm', args)).toEqual({
+      command: 'pnpm',
+      args,
+      shell: false,
+    })
+  })
+
+  it('uses a shell on Windows', () => {
+    expect(packageManagerInvocation('win32', 'pnpm', ['deploy']).shell).toBe(true)
+  })
+
+  it('quotes a Windows path containing a space', () => {
+    expect(packageManagerInvocation('win32', 'pnpm', ['deploy', 'C:\\Users\\John Doe\\tmp']).args)
+      .toEqual(['deploy', '"C:\\Users\\John Doe\\tmp"'])
+  })
+
+  it('leaves a safe Windows argument alone', () => {
+    expect(packageManagerInvocation('win32', 'pnpm', ['--config.node-linker=hoisted']).args)
+      .toEqual(['--config.node-linker=hoisted'])
+  })
+
+  it('quotes a Windows cmd metacharacter', () => {
+    expect(packageManagerInvocation('win32', 'pnpm', ['deploy&verify']).args)
+      .toEqual(['"deploy&verify"'])
+  })
+})