feat(release): add staged desktop builds

[reachjalil]

Summary

• add an isolated Stage Desktop App workflow for immutable vX.Y.Z-staging.N tags
• build public Electron artifacts for macOS, Linux, and Windows on arm64 and x64
• stamp the user-facing prerelease version while keeping macOS and Windows machine versions numeric
• publish only a GitHub prerelease behind the staging environment
• prevent staging tags from triggering the stable Release App workflow
• document environment setup, tag creation, promotion, recovery, and rollback

Why

OpenWork needs installable release candidates that exercise the desktop packaging boundary without publishing npm packages, sidecar releases, Daytona snapshots, AUR updates, stable updater pointers, or production latest metadata.

Scope

• public desktop distribution
• staging version resolver and tests
• GitHub Actions tag routing and prerelease publication
• operator documentation

Out of scope

• Cloud and enterprise desktop distributions
• npm, sidecar, Daytona, AUR, or Den deployment
• automatic staging-to-stable promotion
• creation of the upstream GitHub staging environment and its reviewer policy

Testing

Ran

• node --test scripts/release/staging-version.test.mjs
• actionlint 1.7.12 on .github/workflows/staging-desktop.yml
• YAML parse of staging-desktop.yml and release-macos-aarch64.yml
• TARGET=aarch64-apple-darwin pnpm --filter @openwork/desktop build:electron through the isolated Hub wrapper
• electron-builder macOS arm64 directory packaging with buildVersion 0.18.6

Result

• pass: 5 of 5 staging version tests
• pass: workflow syntax and expression lint
• pass: Electron renderer, server, sidecar, and bridge build
• pass: packaged arm64 Mach-O application
• pass: CFBundleShortVersionString=0.18.6-staging.1
• pass: CFBundleVersion=0.18.6

CI status

• pass: i18n-audit
• pass: openwork-tests on Linux
• pass: openwork-tests on macOS
• pass: Vercel openwork-landing and preview comments
• external authorization blocker: Vercel previews for openwork-app, openwork-den, openwork-den-worker-proxy, and openwork-diagnostics report Authorization required to deploy from the fork
• deferred until the first post-merge staging tag: signed and notarized staging matrix, release asset upload, updater manifest merge, and environment-gated prerelease publication

Manual verification

1. Agent inspected the locally packaged macOS arm64 bundle at revision b999ec5.
2. User confirmation is not yet recorded.
3. Before the first staging tag, create the staging environment and restrict it to v*-staging.* tags as documented.

Evidence

N/A: build and release automation change; no user-interface flow or video was requested.

Risk

• The full GitHub-hosted staging matrix and signing paths remain unproven until the first post-merge staging tag.
• Windows artifacts remain unsigned unless STAGING_SIGN_WINDOWS is enabled with valid SignPath configuration.
• A failed matrix leaves the GitHub release in draft for safe recovery.

Rollback

Revert this PR to remove the staging lane. If a candidate has already been cut, withdraw its prerelease while retaining the immutable tag as an audit record.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 27, 2026 1:41pm

[vercel]

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.