From 8b94845604a2abbc2952d137634aed20188aac9d Mon Sep 17 00:00:00 2001
From: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>
Date: Fri, 26 Jun 2026 21:27:40 +0800
Subject: [PATCH] ci: make desktop PR/E2E builds fork-safe (no signing secret
 required)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Builds triggered by `pull_request` from a fork don't receive repository
secrets, so TAURI_SIGNING_PRIVATE_KEY is empty. With createUpdaterArtifacts
enabled, `tauri build` then fails ("a public key has been found, but no
private key"), which is why the `build` and `e2e-desktop` jobs are red on
fork PRs (e.g. #191) while every secret-free check passes.

PR validation only needs a runnable app binary, not signed updater artifacts
(the desktop E2E suite never consumes them — its update-check tests are mocked
or skipped). Disable updater-artifact creation for the PR/E2E builds so they
require no secrets:

- ci.yml `build`: tauri build --config '{"bundle":{"createUpdaterArtifacts":false}}'
- e2e-desktop.yml Linux: drop the `updater` bundle + the same --config override
- e2e-desktop.yml Windows: same override, run under bash so PowerShell does not
  mangle the inline JSON quotes

Real signed updater artifacts are still produced by the release flow
(build-tauri.yml / nightly.yml) on trusted refs, which is the only place the
signing key is exposed.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>
---
 .github/workflows/ci.yml          |  9 ++++++---
 .github/workflows/e2e-desktop.yml | 17 ++++++++++-------
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c3e84257..d3320f81 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -239,10 +239,13 @@ jobs:
             tauri-cli-${{ runner.os }}-
 
       - run: pnpm install --frozen-lockfile
-      - run: pnpm build
+      # PR build verification only: disable updater-artifact signing so the build
+      # needs no secrets. Fork PRs don't receive repository secrets, so requiring
+      # TAURI_SIGNING_PRIVATE_KEY here makes every fork PR fail. Real signed
+      # updater artifacts are produced by the release flow (build-tauri.yml /
+      # nightly.yml) on trusted refs, which is the only place the key belongs.
+      - run: pnpm --filter @mcpmux/desktop exec tauri build --config '{"bundle":{"createUpdaterArtifacts":false}}'
         env:
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           # Ad-hoc signing (no Apple Developer ID)
           APPLE_SIGNING_IDENTITY: '-'
 
diff --git a/.github/workflows/e2e-desktop.yml b/.github/workflows/e2e-desktop.yml
index ef677233..78ba9706 100644
--- a/.github/workflows/e2e-desktop.yml
+++ b/.github/workflows/e2e-desktop.yml
@@ -97,20 +97,23 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
+      # E2E only needs a runnable app binary, not signed updater artifacts.
+      # Drop the `updater` bundle and disable updater-artifact creation so the
+      # build requires no signing key — fork PRs don't receive repository
+      # secrets, so requiring the key here makes every fork PR fail. Signed
+      # updater artifacts are produced by the release flow on trusted refs.
       - name: Build app (Linux)
         if: matrix.os == 'ubuntu-latest'
-        run: pnpm --filter @mcpmux/desktop exec tauri build --bundles deb,rpm,updater
+        run: pnpm --filter @mcpmux/desktop exec tauri build --bundles deb,rpm --config '{"bundle":{"createUpdaterArtifacts":false}}'
         env:
           PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
 
       - name: Build app (Windows)
         if: matrix.os == 'windows-latest'
-        run: pnpm build
-        env:
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        # shell: bash so the inline --config JSON is passed verbatim; PowerShell's
+        # native-argument handling would mangle the embedded double quotes.
+        shell: bash
+        run: pnpm --filter @mcpmux/desktop exec tauri build --config '{"bundle":{"createUpdaterArtifacts":false}}'
 
       # TODO(playwright-migration): desktop E2E has stale assertions from the IA
       # redesign and is being replaced (tauri-playwright spike). Non-blocking