fix(release): isolate macOS dmg arch per matrix entry

[skevetter]

Summary

v1.10.0-beta.30 shipped both Devsy_mac_arm64.dmg and Devsy_mac_x64.dmg with the same x86_64 binary embedded — same code, different codesigns. Verified by file + sha256sum against the published assets.

Two distinct bugs combined to produce this:

1. electron-builder's YAML arch list is additive, not filtered by CLI

desktop/electron-builder.yml listed arch: [x64, arm64] under each mac target. Verified against electron-builder source (targetFactory.ts):

• --mac --arm64 puts {Arch.arm64: []} in the CLI-derived raw map (empty target names array).
• The early-exit at computeArchToTargetNamesMap (re: issue #1355) only fires when CLI specifies a target type (e.g. --mac dmg); empty arrays don't trigger it.
• The function then iterates platformOptions.target (the YAML) and addValues every (target, arch) pair from the YAML's arch: list to the result.

Net: --arm64 plus arch: [x64, arm64] builds both arches. Verified by the failure log from v1.10.0-beta.30's release run, which shows the macos-arm64 job building both release/Devsy_mac_arm64.dmg and release/Devsy_mac_x64.dmg. Both macos-arm64 and macos-x64 matrix entries did this in parallel and uploaded with overwrite_files: true. Whichever job uploaded last won the race — both its dmgs carried that job's resources/bin/devsy regardless of the dmg's name.

2. The post-package verifier picked the wrong .app bundle

The verifier did find desktop/release -maxdepth 2 -type d -name 'Devsy.app' | head -n1 to locate the bundle. electron-builder produces:

• release/mac-arm64/Devsy.app (arm64)
• release/mac/Devsy.app (x64)

find … | head -n1 returns mac/ first alphabetically, so the macos-arm64 job verified the x64 bundle. Because that bundle had been populated earlier in the same job with arm64 bytes (before electron-builder's second build pass overwrote them), the verify step got a green light against arm64 inside the bundle whose name says x64.

Fix

Two changes:

• desktop/electron-builder.yml: drop arch: lists under each mac target. With no arch: configured, electron-builder falls back to defaultArchs = Array.from(raw.keys()) — i.e. exactly what the CLI flag specified. Each matrix entry produces one dmg + zip pair for its arch.
• .github/workflows/release.yml post-package verifier: replace find | head with explicit case on MATRIX_GO_ARCH mapping arm64 → release/mac-arm64/Devsy.app, amd64 → release/mac/Devsy.app. Reads the right bundle deterministically.

Validation

End-to-end validation requires a real release run. Local checks:

• Both YAML files parse.
• All pre-commit hooks (yaml lint, actionlint, secret scan) pass.
• The release_artifacts verify Go tool itself is unchanged.

The next pre-release tag should produce dmgs where each arch's dmg embeds the matching binary, and the post-package verify step will fail loudly if not.

Summary by CodeRabbit

• Chores
  • Enhanced macOS app verification process with deterministic bundle detection and explicit error messages for better build reliability.
  • Streamlined macOS build configuration to improve consistency and maintainability across different system architectures.

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	5eb5f81
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a38779df1062900082ab2a0

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6dd4dfae-43cf-46b9-82ce-1d860c19d92c

📥 Commits

Reviewing files that changed from the base of the PR and between 103b01c and 5eb5f81.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• desktop/electron-builder.yml

---

📝 Walkthrough

Walkthrough

The desktop/electron-builder.yml macOS target configuration is simplified from a per-arch matrix to a plain dmg/zip list. The release workflow's macOS verification step replaces find-based Devsy.app discovery with an explicit case on MATRIX_GO_ARCH, mapping arm64 and amd64 to their respective output paths with early-exit error handling.

Changes

macOS per-arch build path fix

Layer / File(s)	Summary
electron-builder mac target simplification desktop/electron-builder.yml	Replaces the per-arch dmg/zip target matrix with a single target list (dmg, zip) and adds comments stating that CLI flags in the release workflow control per-matrix architecture selection.
Workflow bundle path selection by MATRIX_GO_ARCH .github/workflows/release.yml	Updates the verification comment and replaces find-based Devsy.app discovery with a case statement on MATRIX_GO_ARCH mapping arm64 → mac-arm64/Devsy.app and amd64 → mac/Devsy.app, with early-exit errors for unsupported architectures or missing bundle directories.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Possibly related PRs

• devsy-org/devsy#390: Directly related — introduced the macOS arm64/x64 matrix split that necessitates the deterministic per-arch Devsy.app path now being codified in both electron-builder.yml and release.yml.
• devsy-org/devsy#513: Directly related — introduced the Devsy.app bundle verification step (locating the app and asserting the embedded binary's architecture) that this PR's case-based path selection replaces and hardens.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	5eb5f81
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a38779d1dd2a900086fc490