From a9930c30d0c431d061154390a83c01fa206ea3a3 Mon Sep 17 00:00:00 2001 From: Theo Browne Date: Fri, 6 Nov 2026 02:31:24 -0800 Subject: [PATCH 1/2] ci(release): JS bundle jobs skip the unused Linux browser secret helper Co-Authored-By: Claude Opus 5.5 --- .github/workflows/desktop-macos-preview.yml | 10 +++------- .github/workflows/release.yml | 15 +++++---------- apps/desktop/vite.config.ts | 6 ++++++ package.json | 1 + 4 files changed, 15 insertions(+), 17 deletions(-) diff --git a/.github/workflows/desktop-macos-preview.yml b/.github/workflows/desktop-macos-preview.yml index 6dcdd702c2da1..040841177f33d 100644 --- a/.github/workflows/desktop-macos-preview.yml +++ b/.github/workflows/desktop-macos-preview.yml @@ -73,16 +73,12 @@ jobs: # Public T3 Connect identifiers (Clerk publishable key, relay URL). cp .env.example .env - - uses: ./.github/actions/setup-apt-mirrors - - - name: Install browser secret helper build libraries - run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config - - # desktop-macos-preview-publish.yml packages this bundle as the preview channel. + # desktop-macos-preview-publish.yml packages this bundle as the preview + # channel. The Linux browser secret helper is not part of a macOS app. - name: Build JS bundle env: T3CODE_TELEMETRY_CHANNEL: ${{ github.repository == 'pingdotgg/t3code' && 'preview' || 'dev' }} - run: vp run build:desktop + run: vp run build:desktop:bundle # Same layout as release.yml's js-bundle so release-desktop.yml can # package it unchanged. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 82f39f8034cc4..30d4a23a5a123 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -565,22 +565,17 @@ jobs: - name: Align package versions to release version run: node scripts/update-release-package-versions.ts "${{ needs.preflight.outputs.version }}" - - uses: ./.github/actions/setup-apt-mirrors - - # @t3tools/desktop#build compiles the Linux browser secret helper on a - # Linux host before packing, and that needs libsecret headers. - - name: Install browser secret helper build libraries - run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config - # Runs t3#build (which depends on @t3tools/web#build) and - # @t3tools/desktop#build, so apps/server/dist holds the server bundle - # plus the web client and apps/desktop/dist-electron the Electron main. + # @t3tools/desktop#build:bundle, so apps/server/dist holds the server + # bundle plus the web client and apps/desktop/dist-electron the Electron + # main. It skips the Linux browser secret helper, which this artifact + # does not carry; each Linux package job compiles its own per arch. # The release channel is already stable, nightly, or preview. Builds in # other repositories report "dev" telemetry. - name: Build JS bundle env: T3CODE_TELEMETRY_CHANNEL: ${{ github.repository == 'pingdotgg/t3code' && needs.preflight.outputs.release_channel || 'dev' }} - run: vp run build:desktop + run: vp run build:desktop:bundle # Two paths under apps/ so the artifact root is apps/; consumers download # into `apps` to restore both at their original locations. diff --git a/apps/desktop/vite.config.ts b/apps/desktop/vite.config.ts index d06efd4d9d7bb..ba37576815097 100644 --- a/apps/desktop/vite.config.ts +++ b/apps/desktop/vite.config.ts @@ -25,6 +25,12 @@ export default defineConfig({ dependsOn: ["t3#build"], cache: false, }, + // CI bundle jobs skip the Linux browser secret helper; packaging stages one per arch. + "build:bundle": { + command: "node scripts/build-preview-annotation-css.mjs && vp pack", + dependsOn: ["t3#build"], + cache: false, + }, dev: { command: "node scripts/build-browser-secret.mjs && node scripts/build-preview-annotation-css.mjs && cross-env T3CODE_DESKTOP_DEV=1 vp pack --watch", diff --git a/package.json b/package.json index f6731683bbc37..0664806c3ad61 100644 --- a/package.json +++ b/package.json @@ -24,6 +24,7 @@ "build": "vp run --filter './apps/*' build", "build:marketing": "vp run --filter @t3tools/marketing build", "build:desktop": "vp run --filter @t3tools/desktop --filter t3 build", + "build:desktop:bundle": "vp run --filter @t3tools/desktop build:bundle", "build:resource-monitor": "cargo build --locked --release --manifest-path native/resource-monitor/Cargo.toml", "typecheck": "vp run -r --cache --concurrency-limit 4 typecheck", "tc": "vp run -r --cache --concurrency-limit 4 typecheck", From f72fd8c67cc34a50d68033bb264a93d13b317990 Mon Sep 17 00:00:00 2001 From: Theo Browne Date: Fri, 6 Nov 2026 02:47:30 -0800 Subject: [PATCH 2/2] ci(release): older refs keep the full desktop build Release and macOS preview bundle jobs can check out a ref from before build:desktop:bundle existed. Those refs now install libsecret and run build:desktop as before. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/desktop-macos-preview.yml | 17 ++++++++++++- .github/workflows/release.yml | 27 ++++++++++++++++----- 2 files changed, 37 insertions(+), 7 deletions(-) diff --git a/.github/workflows/desktop-macos-preview.yml b/.github/workflows/desktop-macos-preview.yml index 040841177f33d..0213f3fce6a99 100644 --- a/.github/workflows/desktop-macos-preview.yml +++ b/.github/workflows/desktop-macos-preview.yml @@ -73,12 +73,27 @@ jobs: # Public T3 Connect identifiers (Clerk publishable key, relay URL). cp .env.example .env + # PR heads from before build:desktop:bundle use the full build, which + # compiles the Linux browser secret helper and needs libsecret. + - name: Check bundle-only build support + id: bundle_build + run: | + script="$(node -p "require('./package.json').scripts['build:desktop:bundle'] ? 'build:desktop:bundle' : 'build:desktop'")" + echo "script=$script" >> "$GITHUB_OUTPUT" + + - if: steps.bundle_build.outputs.script == 'build:desktop' + uses: ./.github/actions/setup-apt-mirrors + + - name: Install browser secret helper build libraries + if: steps.bundle_build.outputs.script == 'build:desktop' + run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config + # desktop-macos-preview-publish.yml packages this bundle as the preview # channel. The Linux browser secret helper is not part of a macOS app. - name: Build JS bundle env: T3CODE_TELEMETRY_CHANNEL: ${{ github.repository == 'pingdotgg/t3code' && 'preview' || 'dev' }} - run: vp run build:desktop:bundle + run: vp run ${{ steps.bundle_build.outputs.script }} # Same layout as release.yml's js-bundle so release-desktop.yml can # package it unchanged. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 30d4a23a5a123..9c3c594972327 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -565,17 +565,32 @@ jobs: - name: Align package versions to release version run: node scripts/update-release-package-versions.ts "${{ needs.preflight.outputs.version }}" - # Runs t3#build (which depends on @t3tools/web#build) and - # @t3tools/desktop#build:bundle, so apps/server/dist holds the server - # bundle plus the web client and apps/desktop/dist-electron the Electron - # main. It skips the Linux browser secret helper, which this artifact - # does not carry; each Linux package job compiles its own per arch. + # Older release refs lack build:desktop:bundle and use the full build, + # which compiles the Linux browser secret helper and needs libsecret. + - name: Check bundle-only build support + id: bundle_build + run: | + script="$(node -p "require('./package.json').scripts['build:desktop:bundle'] ? 'build:desktop:bundle' : 'build:desktop'")" + echo "script=$script" >> "$GITHUB_OUTPUT" + + - if: steps.bundle_build.outputs.script == 'build:desktop' + uses: ./.github/actions/setup-apt-mirrors + + - name: Install browser secret helper build libraries + if: steps.bundle_build.outputs.script == 'build:desktop' + run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config + + # Runs t3#build (which depends on @t3tools/web#build) and the desktop + # bundle, so apps/server/dist holds the server bundle plus the web client + # and apps/desktop/dist-electron the Electron main. build:desktop:bundle + # skips the Linux browser secret helper, which this artifact does not + # carry; each Linux package job compiles its own per arch. # The release channel is already stable, nightly, or preview. Builds in # other repositories report "dev" telemetry. - name: Build JS bundle env: T3CODE_TELEMETRY_CHANNEL: ${{ github.repository == 'pingdotgg/t3code' && needs.preflight.outputs.release_channel || 'dev' }} - run: vp run build:desktop:bundle + run: vp run ${{ steps.bundle_build.outputs.script }} # Two paths under apps/ so the artifact root is apps/; consumers download # into `apps` to restore both at their original locations.