From dc5ab1e4921178f0df7c531124e634c14edc694f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=A8=8B=E5=BA=8F=E5=91=98=E9=98=BF=E6=B1=9F=28Relakkes?=
 =?UTF-8?q?=29?= <relakkes@gmail.com>
Date: Wed, 3 Jun 2026 21:23:35 +0800
Subject: [PATCH] fix(release): exclude unpacked app from dev artifacts

Keep development desktop artifacts limited to distributable archives and update
metadata so macOS workflow downloads do not duplicate the packaged app bundle.
The package smoke step still validates the unpacked app before upload.

Tested: bun test scripts/pr/release-workflow.test.ts
Tested: bun run check:policy
Confidence: high
Scope-risk: narrow
---
 .github/workflows/build-desktop-dev.yml |  8 ++++----
 scripts/pr/release-workflow.test.ts     | 13 +++++++++++++
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-desktop-dev.yml b/.github/workflows/build-desktop-dev.yml
index 33c7dcdc..8eea4fd3 100644
--- a/.github/workflows/build-desktop-dev.yml
+++ b/.github/workflows/build-desktop-dev.yml
@@ -121,10 +121,10 @@ jobs:
         run: |
           STAGING="desktop/build-artifacts/ci-Claude-Code-Haha-v${{ steps.version.outputs.version }}-${{ matrix.artifact_name }}"
           mkdir -p "$STAGING"
-          find desktop/build-artifacts/electron -maxdepth 2 \
-            \( -type f \( -name "*.dmg" -o -name "*.exe" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.zip" -o -name "*.blockmap" -o -name "*.yml" \) \) -o \
-            \( -type d -name "*.app" \) | while read -r artifact; do
-              cp -R "$artifact" "$STAGING/"
+          find desktop/build-artifacts/electron -maxdepth 1 -type f \
+            \( -name "*.dmg" -o -name "*.exe" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.zip" -o -name "*.blockmap" -o -name "*.yml" \) \
+            | while read -r artifact; do
+              cp -f "$artifact" "$STAGING/"
             done
           echo "staging_dir=$STAGING" >> "$GITHUB_OUTPUT"
           ls -lh "$STAGING/" 2>/dev/null || true
diff --git a/scripts/pr/release-workflow.test.ts b/scripts/pr/release-workflow.test.ts
index 4f1da454..ddf17247 100644
--- a/scripts/pr/release-workflow.test.ts
+++ b/scripts/pr/release-workflow.test.ts
@@ -47,6 +47,19 @@ describe('release desktop workflow', () => {
     }
   })
 
+  test('development desktop artifacts exclude unpacked macOS app bundles', () => {
+    const workflow = readFileSync('.github/workflows/build-desktop-dev.yml', 'utf8')
+    const collectStep = workflow.match(
+      /- name: Collect artifacts[\s\S]*?(?:\n\s{6}- name:|$)/,
+    )?.[0]
+
+    expect(collectStep).toContain('*.dmg')
+    expect(collectStep).toContain('*.zip')
+    expect(collectStep).toContain('*.blockmap')
+    expect(collectStep).toContain('*.yml')
+    expect(collectStep).not.toContain('-type d -name "*.app"')
+  })
+
   test('desktop package includes Linux deb metadata required by electron-builder', () => {
     const desktopPackage = JSON.parse(readFileSync('desktop/package.json', 'utf8')) as {
       description?: string