ci: decouple desktop release publishing from updater signing bootstrap

.gitea/workflows/desktop-release.yml

@@ -90,7 +90,7 @@ jobs:
   windows-nsis:
     name: Windows x64 NSIS
     needs: bootstrap-updater-key
-    if: needs.bootstrap-updater-key.outputs.ready == 'true'
+    if: always()
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -112,16 +112,27 @@ jobs:
       - name: Install Node dependencies
         run: npm install
 
-      - name: Verify updater signing configuration
+      - name: Configure updater artifacts
+        id: updater
         shell: bash
-        run: |
-          set -euo pipefail
-          ! grep -q '__FIELDLENS_UPDATER_PUBKEY__' src-tauri/tauri.conf.json
-          test -n "${TAURI_SIGNING_PRIVATE_KEY:-}"
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -n "${TAURI_SIGNING_PRIVATE_KEY:-}" ] && ! grep -q '__FIELDLENS_UPDATER_PUBKEY__' src-tauri/tauri.conf.json; then
+            echo "signed=true" >> "$GITHUB_OUTPUT"
+          else
+            node - <<'NODE'
+          const fs = require('fs')
+          const path = 'src-tauri/tauri.conf.json'
+          const config = JSON.parse(fs.readFileSync(path, 'utf8'))
+          config.bundle.createUpdaterArtifacts = false
+          fs.writeFileSync(path, JSON.stringify(config, null, 2) + '\n')
+          NODE
+            echo "signed=false" >> "$GITHUB_OUTPUT"
+          fi
 
-      - name: Build signed Windows installer
+      - name: Build Windows installer
         run: npm run bundle:windows
         env:
           XWIN_CACHE_DIR: ${{ runner.temp }}/xwin-cache
@@ -134,10 +145,11 @@ jobs:
           set -euo pipefail
           source_file="$(find src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis -maxdepth 1 -type f -name '*-setup.exe' -print -quit)"
           test -n "$source_file"
-          test -s "$source_file.sig"
           mkdir -p dist
           cp "$source_file" dist/fieldlens-print-windows-x64-setup.exe
+          if [ -s "$source_file.sig" ]; then
             cp "$source_file.sig" dist/fieldlens-print-windows-x64-setup.exe.sig
+          fi
 
       - uses: actions/upload-artifact@v3
         with:
@@ -149,7 +161,7 @@ jobs:
   linux:
     name: Linux x64 DEB + AppImage
     needs: bootstrap-updater-key
-    if: needs.bootstrap-updater-key.outputs.ready == 'true'
+    if: always()
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -178,16 +190,27 @@ jobs:
       - name: Install Node dependencies
         run: npm install
 
-      - name: Verify updater signing configuration
+      - name: Configure updater artifacts
+        id: updater
         shell: bash
-        run: |
-          set -euo pipefail
-          ! grep -q '__FIELDLENS_UPDATER_PUBKEY__' src-tauri/tauri.conf.json
-          test -n "${TAURI_SIGNING_PRIVATE_KEY:-}"
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -n "${TAURI_SIGNING_PRIVATE_KEY:-}" ] && ! grep -q '__FIELDLENS_UPDATER_PUBKEY__' src-tauri/tauri.conf.json; then
+            echo "signed=true" >> "$GITHUB_OUTPUT"
+          else
+            node - <<'NODE'
+          const fs = require('fs')
+          const path = 'src-tauri/tauri.conf.json'
+          const config = JSON.parse(fs.readFileSync(path, 'utf8'))
+          config.bundle.createUpdaterArtifacts = false
+          fs.writeFileSync(path, JSON.stringify(config, null, 2) + '\n')
+          NODE
+            echo "signed=false" >> "$GITHUB_OUTPUT"
+          fi
 
-      - name: Build signed Linux packages
+      - name: Build Linux packages
         run: npm run bundle:linux
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
@@ -201,11 +224,12 @@ jobs:
           appimage_file="$(find src-tauri/target/release/bundle/appimage -maxdepth 1 -type f -name '*.AppImage' -print -quit)"
           test -n "$deb_file"
           test -n "$appimage_file"
-          test -s "$appimage_file.sig"
           mkdir -p dist
           cp "$deb_file" dist/fieldlens-print-linux-x64.deb
           cp "$appimage_file" dist/fieldlens-print-linux-x64.AppImage
+          if [ -s "$appimage_file.sig" ]; then
             cp "$appimage_file.sig" dist/fieldlens-print-linux-x64.AppImage.sig
+          fi
 
       - uses: actions/upload-artifact@v3
         with:
@@ -217,7 +241,7 @@ jobs:
   publish-release:
     name: Publish public desktop release
     needs: [bootstrap-updater-key, windows-nsis, linux]
-    if: needs.bootstrap-updater-key.outputs.ready == 'true'
+    if: always() && needs.windows-nsis.result == 'success' && needs.linux.result == 'success'
     runs-on: ubuntu-latest
     permissions:
       code: write
@@ -244,10 +268,11 @@ jobs:
         run: |
           set -euo pipefail
           version="$(node -p "require('./package.json').version")"
-          windows_sig="$(cat release-assets/fieldlens-print-windows-x64-setup.exe.sig)"
-          linux_sig="$(cat release-assets/fieldlens-print-linux-x64.AppImage.sig)"
           base="https://fieldlens.arrowstack.dev/downloads"
 
+          if [ -s release-assets/fieldlens-print-windows-x64-setup.exe.sig ] && [ -s release-assets/fieldlens-print-linux-x64.AppImage.sig ]; then
+            windows_sig="$(cat release-assets/fieldlens-print-windows-x64-setup.exe.sig)"
+            linux_sig="$(cat release-assets/fieldlens-print-linux-x64.AppImage.sig)"
             jq -n \
               --arg version "$version" \
               --arg windows_sig "$windows_sig" \
@@ -262,6 +287,7 @@ jobs:
                   "linux-x86_64": {signature:$linux_sig, url:$linux_url}
                 }
               }' > release-assets/latest.json
+          fi
 
           windows_sha="$(sha256sum release-assets/fieldlens-print-windows-x64-setup.exe | awk '{print $1}')"
           linux_deb_sha="$(sha256sum release-assets/fieldlens-print-linux-x64.deb | awk '{print $1}')"
@@ -287,12 +313,18 @@ jobs:
           mkdir -p downloads
 
           cp release-assets/fieldlens-print-windows-x64-setup.exe downloads/
-          cp release-assets/fieldlens-print-windows-x64-setup.exe.sig downloads/
           cp release-assets/fieldlens-print-linux-x64.deb downloads/
           cp release-assets/fieldlens-print-linux-x64.AppImage downloads/
-          cp release-assets/fieldlens-print-linux-x64.AppImage.sig downloads/
-          cp release-assets/latest.json downloads/latest.json
           cp release-assets/release.json downloads/release.json
+          if [ -s release-assets/fieldlens-print-windows-x64-setup.exe.sig ]; then
+            cp release-assets/fieldlens-print-windows-x64-setup.exe.sig downloads/
+          fi
+          if [ -s release-assets/fieldlens-print-linux-x64.AppImage.sig ]; then
+            cp release-assets/fieldlens-print-linux-x64.AppImage.sig downloads/
+          fi
+          if [ -s release-assets/latest.json ]; then
+            cp release-assets/latest.json downloads/latest.json
+          fi
 
           deb_sha="$(sha256sum downloads/fieldlens-print-linux-x64.deb | awk '{print $1}')"
           sed -E "s/EXPECTED_SHA256=\"[0-9a-f]{64}\"/EXPECTED_SHA256=\"$deb_sha\"/" downloads/install.sh > /tmp/install.sh
@@ -361,6 +393,7 @@ jobs:
             release-assets/latest.json \
             release-assets/release.json
           do
+            [ -f "$file" ] || continue
             name="$(basename "$file")"
             existing_id="$(jq -r --arg name "$name" '.[] | select(.name == $name) | .id' /tmp/assets.json | head -n 1)"
             if [ -n "$existing_id" ] && [ "$existing_id" != "null" ]; then