chore(ci): enforce PR routing and desktop builds

.github/workflows/desktop-build.yml

@@ -1,19 +1,22 @@
 name: desktop-build
 
 # Internal-beta packaging: builds the desktop app for download as workflow artifacts.
-# Does NOT publish, version-bump, or create releases. Manual trigger only.
+# Does NOT publish, version-bump, or create releases.
 #
 # macOS signing/notarization is opt-in: if the APPLE_* / CSC_* secrets are present it
 # signs, otherwise it builds an UNSIGNED package (testers right-click → Open to launch).
 # Windows/Linux packages are unsigned here.
 
 on:
+  push:
+    branches:
+      - main
   workflow_dispatch:
     inputs:
       channel:
         description: "Build channel"
         required: false
-        default: "beta"
+        default: "prod"
         type: choice
         options:
           - beta
@@ -33,6 +36,10 @@ permissions:
   contents: read
   actions: write
 
+concurrency:
+  group: desktop-build-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   cleanup:
     runs-on: ubuntu-24.04
@@ -60,13 +67,12 @@ jobs:
         env:
           PLATFORMS: ${{ github.event.inputs.platforms || 'all' }}
         run: |
-          # macOS arm64 only — Apple Silicon covers current Macs. The Intel (macos-13)
+          # Keep one artifact per OS to stay under the repo's tight artifact quota.
+          # macOS arm64 only - Apple Silicon covers current Macs. The Intel (macos-13)
           # runner is queue-starved and the x64 cross-compile is unreliable, so it is dropped.
-          mac='{"host":"macos-14","target":"mac-arm64","platform_flag":"--mac dmg --arm64","group":"mac"}'
-          linux='{"host":"ubuntu-24.04","target":"linux-x64","platform_flag":"--linux deb rpm --x64","group":"linux"}'
-          # Windows arm64 builds natively on the GA windows-11-arm runner (no cross-compile);
-          # both native deps ship win32-arm64 prebuilds (@lydell/node-pty, @parcel/watcher).
-          win='{"host":"windows-2025","target":"win-x64","platform_flag":"--win nsis --x64","group":"win"},{"host":"windows-11-arm","target":"win-arm64","platform_flag":"--win nsis --arm64","group":"win"}'
+          mac='{"host":"macos-14","target":"darwin-arm64","platform_flag":"--mac dmg --arm64","group":"mac"}'
+          linux='{"host":"ubuntu-24.04","target":"linux-amd64","platform_flag":"--linux deb --x64","group":"linux"}'
+          win='{"host":"windows-2025","target":"win-x64","platform_flag":"--win nsis --x64","group":"win"}'
           case "$PLATFORMS" in
             mac)       items="$mac" ;;
             linux)     items="$linux" ;;
@@ -101,11 +107,6 @@ jobs:
         with:
           node-version: "24"
 
-      # rpm tooling for the Linux rpm target (deb needs no extra tools).
-      - name: Install rpm (linux)
-        if: matrix.group == 'linux'
-        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends rpm
-
       # Import the Developer ID cert only when the secret is configured; otherwise the
       # build proceeds unsigned (DEEPAGENT_CODE_ALLOW_UNSIGNED below).
       - name: Import Apple signing certificate
@@ -118,20 +119,20 @@ jobs:
       - name: Prebuild
         working-directory: packages/desktop
         env:
-          DEEPAGENT_CODE_CHANNEL: ${{ github.event.inputs.channel || 'beta' }}
+          DEEPAGENT_CODE_CHANNEL: ${{ github.event_name == 'push' && 'prod' || (github.event.inputs.channel || 'prod') }}
         run: bun run prebuild
 
       - name: Build renderer
         working-directory: packages/desktop
         env:
-          DEEPAGENT_CODE_CHANNEL: ${{ github.event.inputs.channel || 'beta' }}
+          DEEPAGENT_CODE_CHANNEL: ${{ github.event_name == 'push' && 'prod' || (github.event.inputs.channel || 'prod') }}
         run: bun run build
 
       - name: Package
         working-directory: packages/desktop
         timeout-minutes: 60
         env:
-          DEEPAGENT_CODE_CHANNEL: ${{ github.event.inputs.channel || 'beta' }}
+          DEEPAGENT_CODE_CHANNEL: ${{ github.event_name == 'push' && 'prod' || (github.event.inputs.channel || 'prod') }}
           # Sign + notarize on macOS only when BOTH the signing cert and the Apple ID
           # notarization secrets are present; otherwise build unsigned instead of failing.
           DEEPAGENT_CODE_ALLOW_UNSIGNED: ${{ (matrix.group == 'mac' && env.HAS_APPLE_CERT == 'true' && env.HAS_APPLE_NOTARY == 'true') && '0' || '1' }}
@@ -155,5 +156,4 @@ jobs:
           path: |
             packages/desktop/dist/*.dmg
             packages/desktop/dist/*.deb
-            packages/desktop/dist/*.rpm
             packages/desktop/dist/*.exe

.github/workflows/pr-routing.yml

@@ -0,0 +1,62 @@
+name: pr-routing
+
+on:
+  pull_request_target:
+    types: [opened, reopened, edited, synchronize, ready_for_review]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  enforce-target:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Enforce PR target branches
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const sameRepo = pr.head.repo.full_name === pr.base.repo.full_name;
+            const contributorToDev = pr.base.ref === 'dev';
+            const devToMain = pr.base.ref === 'main' && sameRepo && pr.head.ref === 'dev';
+
+            if (contributorToDev || devToMain) {
+              core.info(`Allowed PR route: ${pr.head.repo.full_name}:${pr.head.ref} -> ${pr.base.ref}`);
+              return;
+            }
+
+            const marker = '<!-- pr-routing:invalid-target -->';
+            const body = `${marker}
+            This repository only accepts contributor PRs targeting \`dev\`.
+
+            The only allowed PR route into \`main\` is a same-repository \`dev\` -> \`main\` PR opened by a maintainer after \`dev\` has passed validation.
+
+            Please reopen this change against \`dev\`.`;
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              per_page: 100,
+            });
+
+            const existing = comments.find((comment) => comment.body?.includes(marker));
+            if (!existing) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+                body,
+              });
+            }
+
+            await github.rest.pulls.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.number,
+              state: 'closed',
+            });
+
+            core.setFailed(`Invalid PR route: ${pr.head.repo.full_name}:${pr.head.ref} -> ${pr.base.ref}`);

.github/workflows/pr-standards.yml

@@ -17,6 +17,10 @@ jobs:
           script: |
             const pr = context.payload.pull_request;
             const login = pr.user.login;
+            if (pr.base.ref !== 'dev') {
+              console.log(`Skipping PR standards for base branch ${pr.base.ref}`);
+              return;
+            }
 
             // Skip PRs older than Feb 18, 2026 at 6PM EST (Feb 19, 2026 00:00 UTC)
             const cutoff = new Date('2026-02-19T00:00:00Z');
@@ -164,6 +168,10 @@ jobs:
           script: |
             const pr = context.payload.pull_request;
             const login = pr.user.login;
+            if (pr.base.ref !== 'dev') {
+              console.log(`Skipping PR compliance for base branch ${pr.base.ref}`);
+              return;
+            }
 
             // Skip PRs older than Feb 18, 2026 at 6PM EST (Feb 19, 2026 00:00 UTC)
             const cutoff = new Date('2026-02-19T00:00:00Z');