ci(release): publish main-process source maps with each release (#17630)

* ci(release): publish main-process source maps with each release Desktop bundles ship minified, and packaging drops out/**/*.map from app.asar, so a stack trace from a released build cannot be mapped back to source. main builds with sourcemap:'hidden' — the maps exist in CI but were never published anywhere. Zip them on the linux-x64 leg and upload to the draft release as orca-sourcemaps-<tag>.zip (33.7MB raw, ~8MB zipped, 69 files). The main bundle is platform-independent, so one leg covers the whole release. The step fails loudly if no maps are found, so a regression of build.sourcemap breaks the release instead of silently shipping undecodable builds. * fix(release): stage source map bundle outside the checkout Every entry in electron-builder's `files` is a negation, so app-builder hits containsOnlyIgnore() and prepends `**/*` (fileMatcher.js:285). A zip left in the workspace root would have been packed into the linux-x64 app.asar, growing that platform's installers by ~8MB and diverging them from arm64 — the same hazard the '!pr-evidence' exclusion already guards against. Stage it in $RUNNER_TEMP, matching the release-state file at :444.
2026-09-21 16:02:20 +00:00 · 2026-08-30 23:21:00 -07:00
parent 6a65d8406a
commit fc73903beb
2 changed files with 90 additions and 0 deletions
@@ -1316,6 +1316,38 @@ jobs:
          # Kill only its child and require both PTY and watch recovery before packaging.
          node config/scripts/relay-watcher-fault-harness.mjs

+      # Why: main ships minified with sourcemap:'hidden' and packaging drops
+      # out/**/*.map from app.asar, so a crash trace from a released build is
+      # otherwise undecodable. The main bundle is platform-independent, so one
+      # leg publishes the maps for the whole release.
+      - name: Bundle main-process source maps
+        if: matrix.platform == 'linux-x64'
+        shell: bash
+        env:
+          TAG: ${{ needs.cut.outputs.tag }}
+        run: |
+          set -euo pipefail
+          if [ -z "$(find out/main -name '*.js.map' -print -quit)" ]; then
+            echo "::error::No main-process source maps in out/main. Did build.sourcemap regress in electron.vite.config.ts?"
+            exit 1
+          fi
+          # Why: every entry in electron-builder's `files` is a negation, so
+          # app-builder prepends `**/*` and packs anything left in the workspace
+          # root into app.asar. Stage the bundle outside the checkout instead.
+          find out/main -name '*.js.map' -print | sort | zip -q -X "$RUNNER_TEMP/orca-sourcemaps-$TAG.zip" -@
+          ls -l "$RUNNER_TEMP/orca-sourcemaps-$TAG.zip"
+
+      - name: Publish main-process source maps
+        if: matrix.platform == 'linux-x64'
+        uses: nick-fields/retry@v4
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          retry_wait_seconds: 30
+          command: gh release upload "${{ needs.cut.outputs.tag }}" "${{ runner.temp }}/orca-sourcemaps-${{ needs.cut.outputs.tag }}.zip" --clobber --repo "${{ github.repository }}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Publish release artifacts (Linux)
        if: matrix.platform == 'linux-x64' || matrix.platform == 'linux-arm64'
        uses: nick-fields/retry@v4
@@ -0,0 +1,58 @@
+import { readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+
+const projectDir = resolve(import.meta.dirname, '../..')
+const buildSteps = parse(
+  readFileSync(join(projectDir, '.github/workflows/release-cut.yml'), 'utf8')
+).jobs.build.steps
+
+function stepIndex(name) {
+  const index = buildSteps.findIndex((step) => step.name === name)
+  expect(index, `missing build step: ${name}`).toBeGreaterThanOrEqual(0)
+  return index
+}
+
+describe('release-cut source map publication', () => {
+  it('bundles and uploads main source maps from exactly one platform leg', () => {
+    const bundle = buildSteps[stepIndex('Bundle main-process source maps')]
+    const publish = buildSteps[stepIndex('Publish main-process source maps')]
+
+    // Why: the main bundle is platform-independent, so duplicating the ~8MB
+    // artifact across legs would only race the uploads against each other.
+    for (const step of [bundle, publish]) {
+      expect(step.if).toContain('linux-x64')
+    }
+
+    expect(bundle.run).toContain("find out/main -name '*.js.map'")
+    expect(publish.with.command).toContain('gh release upload')
+    expect(publish.with.command).toContain('orca-sourcemaps-')
+  })
+
+  it('stages the bundle outside the checkout so packaging cannot absorb it', () => {
+    // Why: electron-builder's `files` is all negations, so app-builder prepends
+    // `**/*` and packs any stray workspace-root file into app.asar.
+    const bundle = buildSteps[stepIndex('Bundle main-process source maps')]
+    const publish = buildSteps[stepIndex('Publish main-process source maps')]
+
+    expect(bundle.run).toContain('"$RUNNER_TEMP/orca-sourcemaps-$TAG.zip"')
+    expect(bundle.run).not.toMatch(/zip[^\n]*\s"orca-sourcemaps-/)
+    expect(publish.with.command).toContain('runner.temp')
+  })
+
+  it('fails the release when no source maps were emitted', () => {
+    // Why: a silent regression of build.sourcemap would ship an undecodable
+    // release rather than an obviously broken one.
+    const bundle = buildSteps[stepIndex('Bundle main-process source maps')]
+    expect(bundle.run).toContain('::error::')
+    expect(bundle.run).toContain('exit 1')
+  })
+
+  it('bundles maps after the build and before packaging strips them', () => {
+    const bundle = stepIndex('Bundle main-process source maps')
+    expect(bundle).toBeGreaterThan(stepIndex('Build app'))
+    expect(stepIndex('Publish main-process source maps')).toBeGreaterThan(bundle)
+    expect(bundle).toBeLessThan(stepIndex('Publish release artifacts (Linux)'))
+  })
+})