fix(ci): retain the latest published desktop prereleases

Author: Sg312

.github/workflows/ci.yml

@@ -103,7 +103,7 @@ jobs:
             echo "ℹ️ No comparable base commit; skipping desktop prerelease"
             exit 0
           fi
-          if git diff --name-only "$BEFORE" HEAD | grep -qE '^(apps/desktop/|packages/desktop-bridge/|packages/browser-protocol/)'; then
+          if git diff --name-only "$BEFORE" HEAD | grep -qE '^(apps/desktop/|packages/desktop-bridge/|packages/browser-protocol/|\.github/workflows/(ci|desktop-release)\.yml$)'; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
             echo "✅ Desktop shell code changed"
           else
@@ -1140,24 +1140,30 @@ jobs:
     name: Prune Desktop Prereleases
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
-    needs: [publish-desktop-prerelease]
+    needs: [create-desktop-prerelease, publish-desktop-prerelease]
     permissions:
       contents: read
     env:
       GH_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
       GH_REPO: simstudioai/sim-desktop-releases
+      CURRENT_TAG: ${{ needs.create-desktop-prerelease.outputs.version }}
     steps:
       - name: Delete stale prereleases
         run: |
+          set -euo pipefail
+          : "${CURRENT_TAG:?Current publication tag is required before pruning}"
           if [ -z "$GH_TOKEN" ]; then
             echo "::error::DESKTOP_RELEASE_TOKEN is required to prune desktop prereleases."
             exit 1
           fi
           if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNELS='(dev|alpha)'; else CHANNELS='(staging|beta)'; fi
-          gh release list --limit 100 --json tagName,isPrerelease,isDraft,createdAt \
-            --jq "[.[] | select(.isPrerelease and (.isDraft | not) and (.tagName | test(\"-${CHANNELS}\\\\.\")))] | sort_by(.createdAt) | reverse | .[5:] | .[].tagName" |
+          # createdAt follows the tag's commit: published releases in the release-only
+          # repository can all share it. Retain by publication time, with deterministic ties.
+          gh release list --limit 100 --json tagName,isPrerelease,isDraft,publishedAt \
+            --jq "[.[] | select(.isPrerelease and (.isDraft | not) and (.tagName | test(\"-${CHANNELS}\\\\.\")))] | sort_by(.publishedAt, .tagName) | reverse | .[5:] | .[].tagName" |
           while read -r TAG; do
             [ -n "$TAG" ] || continue
+            [ "$TAG" != "$CURRENT_TAG" ] || continue
             echo "Deleting stale prerelease $TAG"
             gh release delete "$TAG" --cleanup-tag --yes
           done

scripts/desktop-prune-workflow.test.ts

@@ -0,0 +1,190 @@
+import { spawnSync } from 'node:child_process'
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+const workflow = readFileSync(new URL('../.github/workflows/ci.yml', import.meta.url), 'utf8')
+const job = workflow.split('  prune-desktop-prereleases:')[1]
+const step = job?.match(/^ {8}run: \|\r?\n((?: {10}.*(?:\r?\n|$)|\r?\n)+)/m)?.[1]
+if (!step) throw new Error('Desktop pruning shell step is missing')
+const script = step.replace(/^ {10}/gm, '')
+const detector = workflow.split('      - name: Diff desktop paths')[1]?.split('\n  migrate:')[0]
+const detectorStep = detector?.match(/^ {8}run: \|\r?\n((?: {10}.*(?:\r?\n|$)|\r?\n)+)/m)?.[1]
+if (!detectorStep) throw new Error('Desktop change detection shell step is missing')
+const detectorScript = detectorStep.replace(/^ {10}/gm, '')
+
+function release(tagName: string, publishedAt: string, isDraft = false, isPrerelease = true) {
+  return {
+    tagName,
+    publishedAt,
+    createdAt: '2026-08-13T04:57:48Z',
+    isDraft,
+    isPrerelease,
+  }
+}
+
+function prune(
+  releases: ReturnType<typeof release>[],
+  currentTag = 'v1-dev.6',
+  ref = 'refs/heads/dev',
+  listExit = '0'
+) {
+  return spawnSync(
+    'bash',
+    [
+      '-e',
+      '-c',
+      `
+      gh() {
+        if [ "$1 $2" = 'release list' ]; then
+          [ "$LIST_EXIT" = 0 ] || return "$LIST_EXIT"
+          while [ "$1" != '--jq' ]; do shift; done
+          printf '%s' "$RELEASES" | jq -r "$2"
+        elif [ "$1 $2" = 'release delete' ]; then
+          printf 'DELETE %s\n' "$3"
+        else
+          return 99
+        fi
+      }
+      ${script}
+    `,
+    ],
+    {
+      encoding: 'utf8',
+      env: {
+        PATH: process.env.PATH,
+        GH_TOKEN: 'test-placeholder',
+        GITHUB_REF: ref,
+        CURRENT_TAG: currentTag,
+        RELEASES: JSON.stringify(releases),
+        LIST_EXIT: listExit,
+      },
+    }
+  )
+}
+
+const devReleases = Array.from({ length: 6 }, (_, index) =>
+  release(`v1-dev.${6 - index}`, `2026-09-${String(16 - index).padStart(2, '0')}T00:00:00Z`)
+)
+
+describe('desktop release retention shell', () => {
+  it('keeps the newest five publications when every tag points to the same commit', () => {
+    const result = prune(devReleases)
+    expect(result.status).toBe(0)
+    expect(result.stdout).toContain('DELETE v1-dev.1')
+    expect(result.stdout).not.toContain('DELETE v1-dev.6')
+    expect(result.stdout.match(/^DELETE /gm)).toHaveLength(1)
+  })
+
+  it('never deletes this run’s publication even when older than the five retained releases', () => {
+    const result = prune(devReleases, 'v1-dev.1')
+    expect(result.status).toBe(0)
+    expect(result.stdout).not.toContain('DELETE ')
+  })
+
+  it('retains all releases below the channel limit and ignores drafts and stable releases', () => {
+    const result = prune([
+      ...devReleases.slice(0, 5),
+      release('v1-dev.0', '2026-01-01T00:00:00Z', true),
+      release('v1-dev.stable', '2026-01-01T00:00:00Z', false, false),
+      release('v1-staging.0', '2026-01-01T00:00:00Z'),
+    ])
+    expect(result.status).toBe(0)
+    expect(result.stdout).not.toContain('DELETE ')
+  })
+
+  it('breaks equal publication timestamps deterministically regardless of API order', () => {
+    const tied = devReleases.map((entry) => ({ ...entry, publishedAt: '2026-09-15T00:00:00Z' }))
+    const first = prune(tied)
+    const reversed = prune([...tied].reverse())
+    expect(first.status).toBe(0)
+    expect(reversed.status).toBe(0)
+    expect(first.stdout).toBe(reversed.stdout)
+    expect(first.stdout).toContain('DELETE v1-dev.1')
+  })
+
+  it('counts legacy beta releases with staging without deleting dev releases', () => {
+    const result = prune(
+      [
+        ...devReleases.map((entry) => ({
+          ...entry,
+          tagName: entry.tagName.replace('dev', 'staging'),
+        })),
+        release('v1-beta.0', '2026-01-01T00:00:00Z'),
+        release('v1-dev.0', '2025-01-01T00:00:00Z'),
+      ],
+      'v1-staging.6',
+      'refs/heads/staging'
+    )
+    expect(result.status).toBe(0)
+    expect(result.stdout).toContain('DELETE v1-staging.1')
+    expect(result.stdout).toContain('DELETE v1-beta.0')
+    expect(result.stdout).not.toContain('DELETE v1-dev.0')
+  })
+
+  it('fails when listing fails instead of reporting successful cleanup', () => {
+    const result = prune(devReleases, 'v1-dev.6', 'refs/heads/dev', '42')
+    expect(result.status).toBe(42)
+    expect(result.stdout).not.toContain('DELETE ')
+  })
+
+  it('wires the publication tag from the creation job', () => {
+    expect(job).toContain('needs: [create-desktop-prerelease, publish-desktop-prerelease]')
+    expect(job).toContain(`CURRENT_TAG: \${{ needs.create-desktop-prerelease.outputs.version }}`)
+  })
+
+  it('refuses to prune without the current publication tag', () => {
+    const result = prune(devReleases, '')
+    expect(result.status).not.toBe(0)
+    expect(result.stdout).not.toContain('DELETE ')
+  })
+})
+
+describe('desktop release change detection shell', () => {
+  it.each([
+    ['.github/workflows/ci.yml', true],
+    ['.github/workflows/desktop-release.yml', true],
+    ['apps/desktop/src/main/index.ts', true],
+    ['packages/desktop-bridge/src/index.ts', true],
+    ['packages/browser-protocol/src/index.ts', true],
+    ['.github/workflows/migrations.yml', false],
+    ['.github/workflows/ci.yml.backup', false],
+    ['apps/sim/app/page.tsx', false],
+  ])('classifies %s as desktop change=%s', (path, changed) => {
+    const directory = mkdtempSync(join(tmpdir(), 'desktop-detect-'))
+    const output = join(directory, 'outputs')
+    try {
+      const result = spawnSync(
+        'bash',
+        [
+          '-e',
+          '-c',
+          `
+        git() {
+          case "$1" in
+            cat-file) return 0 ;;
+            diff) printf '%s\n' "$CHANGED_PATH" ;;
+            *) return 99 ;;
+          esac
+        }
+        ${detectorScript}
+      `,
+        ],
+        {
+          encoding: 'utf8',
+          env: {
+            PATH: process.env.PATH,
+            BEFORE: 'previous-commit',
+            GITHUB_OUTPUT: output,
+            CHANGED_PATH: path,
+          },
+        }
+      )
+      expect(result.status).toBe(0)
+      expect(readFileSync(output, 'utf8')).toBe(`changed=${changed}\n`)
+    } finally {
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+})