chore: consolidate and harden release workflows (#10447)

.github/workflows/canary.yml

@@ -15,12 +15,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# Permissions for SLSA attestation, AWS OIDC codesigning, and release creation
 permissions:
-  id-token: write      # Required for Sigstore OIDC signing and AWS OIDC codesigning
-  contents: write      # Required for creating releases and by actions/checkout
-  actions: read        # Required by bundle-desktop-windows.yml reusable workflow
-  attestations: write  # Required for SLSA build provenance attestations
+  contents: read
 
 jobs:
   # ------------------------------------
@@ -44,11 +40,11 @@ jobs:
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
   # ------------------------------------
-  # 2) Build CLI for multiple OS/Arch
+  # 2) Build CLI targets not produced by desktop workflows
   # ------------------------------------
-  build-cli:
+  build-cli-linux:
     needs: [prepare-version]
-    uses: ./.github/workflows/build-cli.yml
+    uses: ./.github/workflows/build-cli-linux.yml
     with:
       version: ${{ needs.prepare-version.outputs.version }}
 
@@ -58,7 +54,6 @@ jobs:
   install-script:
     name: Upload Install Script
     runs-on: ubuntu-latest
-    needs: [build-cli]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -67,29 +62,33 @@ jobs:
           path: download_cli.sh
 
   # ------------------------------------------------------------
-  # 4) Bundle Desktop App (macOS only)
+  # 4) Bundle CLI and Desktop (macOS ARM64)
   # ------------------------------------------------------------
-  bundle-desktop:
+  bundle-macos-arm64:
     needs: [prepare-version]
-    uses: ./.github/workflows/bundle-desktop.yml
+    uses: ./.github/workflows/bundle-macos.yml
     permissions:
-      id-token: write
       contents: read
     with:
       version: ${{ needs.prepare-version.outputs.version }}
+      target: aarch64-apple-darwin
+      package_cli: true
+      package_desktop: true
       signing: false
 
   # ------------------------------------------------------------
-  # 5) Bundle Desktop App (macOS Intel)
+  # 5) Bundle CLI and Desktop (macOS x64)
   # ------------------------------------------------------------
-  bundle-desktop-intel:
+  bundle-macos-x64:
     needs: [prepare-version]
-    uses: ./.github/workflows/bundle-desktop-intel.yml
+    uses: ./.github/workflows/bundle-macos.yml
     permissions:
-      id-token: write
       contents: read
     with:
       version: ${{ needs.prepare-version.outputs.version }}
+      target: x86_64-apple-darwin
+      package_cli: true
+      package_desktop: true
       signing: false
 
   # ------------------------------------------------------------
@@ -102,39 +101,44 @@ jobs:
       version: ${{ needs.prepare-version.outputs.version }}
 
   # ------------------------------------------------------------
-  # 6) Bundle Desktop App (Windows)
+  # 7) Bundle CLI and Desktop (Windows)
   # ------------------------------------------------------------
-  bundle-desktop-windows:
+  bundle-windows:
     needs: [prepare-version]
-    uses: ./.github/workflows/bundle-desktop-windows.yml
+    uses: ./.github/workflows/bundle-windows.yml
     with:
       version: ${{ needs.prepare-version.outputs.version }}
+      package_cli: true
+      package_desktop: true
       signing: false
 
-  bundle-desktop-windows-cuda:
+  bundle-windows-cuda:
     needs: [prepare-version]
-    uses: ./.github/workflows/bundle-desktop-windows.yml
+    uses: ./.github/workflows/bundle-windows.yml
     with:
       version: ${{ needs.prepare-version.outputs.version }}
+      package_cli: true
+      package_desktop: true
       signing: false
       windows_variant: cuda
 
   # ------------------------------------
-  # 7) Create/Update GitHub Release
+  # 8) Create/Update GitHub Release
   # ------------------------------------
   release:
     name: Release
     runs-on: ubuntu-latest
-    needs: [build-cli, install-script, bundle-desktop, bundle-desktop-intel, bundle-desktop-linux, bundle-desktop-windows, bundle-desktop-windows-cuda]
+    needs: [build-cli-linux, install-script, bundle-macos-arm64, bundle-macos-x64, bundle-desktop-linux, bundle-windows, bundle-windows-cuda]
     permissions:
       contents: write
       id-token: write      # Required for Sigstore OIDC signing
       attestations: write  # Required for SLSA build provenance attestations
 
     steps:
-      - name: Download all artifacts
+      - name: Download release artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
+          pattern: '!internal-*'
           merge-multiple: true
 
       - name: Attest build provenance