[cu1ch3n]

Every pull request that touched src/ built and tested all six desktop installers on three platforms, then main built them again after the merge. A pull request waited about 14 minutes, gated by the macOS x64 job, which is also the one that flakes. Timing the jobs shows where that goes: in each desktop job, making the installers takes most of the build step (DMG + zip about 2.7 of 3.6 minutes on macOS arm64 and about 6 of 10 on x64; AppImage + deb about 3.2 of 3.7 on Linux). The smoke test only launches the unpacked app.

Changes

• Desktop (desktop.yml) only builds and tests and never publishes. With quick, it builds the unpacked app (npm run desktop:build -- --dir) on macOS arm64 and Linux and runs the same smoke test; otherwise it builds and tests every installer on all three platforms. Run workflow builds any branch, fully unless quick is checked.

• CI picks the desktop check from the changed files with scripts/desktop-scope.sh:

  • docs, the site, tests, translations and Markdown outside skills/ and examples/: none;
  • anything else: quick;
  • every installer, for a pull request that changes either:
    • the shell fingerprint (scripts/desktop-layer.mjs, the rule the Dev channel uses for new installers: Electron, Node, Codex, production dependencies, desktop/), or
    • how installers are made and tested (desktop-layer.mjs, check-desktop.mjs, check-desktop-linux.sh, desktop.yml).

  Pushes to main get at most the quick check, so a bad merge shows within minutes; the nightly build makes main's installers. The script reads the file list before classifying it, so a failed diff fails the job instead of skipping the desktop check.

• Desktop Dev (desktop-dev.yml, new) takes over the nightly build and the desktop-dev publishing from desktop.yml, unchanged. Run on another branch, it now fails with a pointer to Desktop instead of building without publishing.

• Release runs CI (both Node versions, the site and pack checks) and the full desktop build, and publishes only after both pass. Its own repeats of typecheck, tests and i18n checks go. A tag pushed without a pull request is therefore still checked on Node 22. The contents: write grant to the desktop job goes too, because Desktop no longer has a publishing job.

• CI runs on pull requests, pushes to main and from Release. A branch with a pull request is checked once, not twice; a branch without one is not checked. The stale codex/electron-desktop trigger goes; that branch is fully merged.

• A new push to a pull request replaces its run. Every other run has its own concurrency group, so no commit on main is skipped.

• Timeouts:

  • the checks job: 20 minutes;
  • the desktop smoke tests: 10–15 minutes each, so a hung test fails then instead of at 45.

• A CI passed job sums up the run (a skipped desktop check counts as passed), so branch rules can require one check.

Testing

• actionlint 1.7.12 with shellcheck 0.11.0: no problems in the changed files. One existing SC2016 note in release.yml's CHANGELOG awk is also on main.
• scripts/desktop-scope.sh on the merge commits of the last 18 pull requests:
  • none: Redesign the landing page and keep demo annotations aligned #34 and Fix dark mode in website demos #39 (site);
  • every installer: Add Windows desktop support and fix compiler PATH discovery #13 (desktop/) and Replace native selects with a managed list #32 (the smoke test). Show CJK text from fonts without a Unicode map in the PDF view #30's three-parent merge also lands here;
  • quick: the rest, including Add a paper Q&A pane with saved sessions and reasoning controls #38 (a test:ui line in package.json).
• The same script on synthetic commits:
  • quick: skills/ Markdown, examples/, a src/ change, a test:ui line;
  • none: desktop/README.md alone, docs + site, an empty commit;
  • every installer: check-desktop.mjs, an Electron bump, desktop/main.ts, renaming desktop/builder.cjs away;
  • a bad base exits 128 instead of printing none.
• Runs on this branch:
  • this pull request's CI took the full path (it changes desktop.yml) and passed on all three platforms;
  • a manual quick run of Desktop passed in 2m15s (macOS arm64) and 1m42s (Linux), building no installers.

Review

Codex (gpt-6-astra, xhigh) and Claude (Opus 5.5, high) reviewed the first commit independently. Both found nothing that lets a regression reach npm, a release or the Dev channel without a full build. The second commit fixes what they did find:

• a failed diff read as no change;
• the smoke test and shipped Markdown were under-classified;
• no desktop check after a merge;
• untagged-branch and Node 22 coverage for releases;
• the main concurrency comment;
• two README statements.

Left as is: lockfile-only bumps of electron-builder's own dependencies and package.json metadata written into the deb change the installer without changing the fingerprint, so those pull requests get the quick check. The nightly and release builds still build those installers before anything is published.