ci(desktop): sign fork PR macOS previews without exposing signing secrets - #11760

Merged

juliusmarminge merged 10 commits into

mainfrom

t3code/secure-fork-preview-builds

Sep 14, 2026

Commits on Sep 14, 2026

ci(desktop): sign fork PR macOS previews without exposing signing secrets

juliusmarminge
and
claude
committed
61888d6
ci(desktop): run preview eligibility check on a hosted runner

juliusmarminge
and
claude
committed
108f7ea
ci(desktop): refuse to publish a preview whose PR head moved

juliusmarminge
and
claude
committed
0ff4524
ci(desktop): read the preview base version from the built commit

juliusmarminge
and
claude
committed
53a01e1
ci(desktop): read preview public config from the built commit

juliusmarminge
and
claude
committed
bd62aac
ci(desktop): isolate preview publish concurrency and tighten PR resolution

juliusmarminge
and
claude
committed
210627f
ci(desktop): harden preview workflows per GitHub secure-use guidance

juliusmarminge
and
claude
committed
0678b59
fix(ci): fetch preview sources without persisting credentials
juliusmarminge
committed
c51c600
ci(desktop): consume the preview label per build

juliusmarminge
and
claude
committed
7388d22
docs(release): note the preview validator also accepts root directory entries

juliusmarminge
and
claude
committed
3063c1c