ci: address review on the rehearsal gates

Two comments, both correct.

The macOS note still said manual runs "stay free to build unsigned", which
this change had just made false, and the Windows note described unsigned
artifacts as an outcome rather than a failure. Both now describe what the
run actually does.

The test only looked for the tag condition, so `if: github.event_name ==
'workflow_dispatch'` would satisfy it while skipping the tag path — the same
hole entered from the other side. It now rejects any condition on those
steps, and that scenario fails it.

Author: elkaix

.github/workflows/desktop-release.yml

@@ -184,9 +184,10 @@ jobs:
             echo 'No macOS signing certificate configured; building unsigned.'
           fi
 
-      # A tag build that quietly produces an unsigned app is worse than a failed
+      # A build that quietly produces an unsigned app is worse than a failed
       # one: macOS rejects unsigned updates, so it ships a release users cannot
-      # install or update from. Manual runs stay free to build unsigned.
+      # install or update from. Manual runs are held to the same bar, which is
+      # what makes them a rehearsal rather than a smoke test.
       - name: Require signing
         working-directory: apps/desktop
         run: node --import tsx scripts/assert-release-signing.ts
@@ -316,9 +317,9 @@ jobs:
         working-directory: apps/desktop
         run: node --import tsx scripts/stage-runtime.ts
 
-      # Only non-empty WIN_CSC_* signing secrets are exported. Without them,
-      # Windows artifacts are unsigned and installers trigger a SmartScreen
-      # warning on first run.
+      # Only non-empty WIN_CSC_* signing secrets are exported. Without them the
+      # artifacts are unsigned and installers trigger a SmartScreen warning, so
+      # the credential check below fails the run rather than shipping one.
       - name: Resolve Windows signing credentials
         shell: bash
         env:

apps/desktop/tests/desktop-release-workflow.spec.ts

@@ -55,7 +55,11 @@ describe('desktop release workflow', () => {
       const stepIndex = workflow.indexOf(step)
       expect(stepIndex).toBeGreaterThan(-1)
       const precedingStep = workflow.lastIndexOf('      - name:', stepIndex)
-      expect(workflow.slice(precedingStep, stepIndex)).not.toContain('refs/tags/desktop-v')
+      // Any condition at all, not just a tag test, would skip one trigger:
+      // `github.event_name == 'workflow_dispatch'` reintroduces the same hole
+      // from the other side. These steps must be unconditional.
+      const declaration = workflow.slice(precedingStep, stepIndex)
+      expect(declaration).not.toMatch(/^\s+if:/mu)
     }
   })