ci: prioritize macOS desktop packaging

.github/workflows/desktop-build.yml

@@ -10,18 +10,8 @@ permissions:
 
 jobs:
   desktop:
-    name: ${{ matrix.name }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: macOS arm64
-            os: macos-14
-          - name: Windows x64
-            os: windows-2022
-          - name: Linux x64
-            os: ubuntu-24.04
+    name: macOS arm64
+    runs-on: macos-14
 
     steps:
       - name: Check out source
@@ -35,6 +25,64 @@ jobs:
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+
+      - name: Cache Rust dependencies and sidecar builds
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            crates/desktop-sidecar/target
+          key: ${{ runner.os }}-rust-${{ hashFiles('crates/desktop-sidecar/Cargo.lock', 'crates/desktop-sidecar/**/*.rs') }}
+          restore-keys: |
+            ${{ runner.os }}-rust-
+
+      - name: Cache Electron downloads
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/Library/Caches/electron
+            ~/Library/Caches/electron-builder
+          key: ${{ runner.os }}-electron-${{ hashFiles('bun.lock', 'apps/desktop/package.json') }}
+
+      - name: Prepare macOS signing keychain
+        env:
+          MAC_CERTIFICATE_BASE64: ${{ secrets.EDGEEVER_MAC_CERTIFICATE_BASE64 }}
+          MAC_CERTIFICATE_PASSWORD: ${{ secrets.EDGEEVER_MAC_CERTIFICATE_PASSWORD }}
+        run: |
+          if [[ -z "$MAC_CERTIFICATE_BASE64" || -z "$MAC_CERTIFICATE_PASSWORD" ]]; then
+            echo "::error::EDGEEVER_MAC_CERTIFICATE_BASE64 and EDGEEVER_MAC_CERTIFICATE_PASSWORD are required"
+            exit 1
+          fi
+
+          keychain_path="$RUNNER_TEMP/edgeever-build.keychain-db"
+          keychain_password="$(openssl rand -hex 32)"
+          certificate_path="$RUNNER_TEMP/edgeever-mac-signing.p12"
+
+          printf '%s' "$MAC_CERTIFICATE_BASE64" | base64 -D > "$certificate_path"
+          security create-keychain -p "$keychain_password" "$keychain_path"
+          security set-keychain-settings -lut 21600 "$keychain_path"
+          security unlock-keychain -p "$keychain_password" "$keychain_path"
+          security import "$certificate_path" \
+            -k "$keychain_path" \
+            -P "$MAC_CERTIFICATE_PASSWORD" \
+            -T /usr/bin/codesign \
+            -T /usr/bin/security
+          security set-key-partition-list \
+            -S apple-tool:,apple: \
+            -s \
+            -k "$keychain_password" \
+            "$keychain_path"
+          security list-keychains -d user -s "$keychain_path" "$HOME/Library/Keychains/login.keychain-db"
+
+          echo "CSC_KEYCHAIN=$keychain_path" >> "$GITHUB_ENV"
+          echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
@@ -65,29 +113,24 @@ jobs:
       - name: Package desktop installer
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CSC_IDENTITY_AUTO_DISCOVERY: ${{ secrets.EDGEEVER_MAC_CERTIFICATE_BASE64 != '' && 'true' || 'false' }}
-          CSC_LINK: ${{ secrets.EDGEEVER_MAC_CERTIFICATE_BASE64 }}
-          CSC_KEY_PASSWORD: ${{ secrets.EDGEEVER_MAC_CERTIFICATE_PASSWORD }}
           APPLE_ID: ${{ secrets.EDGEEVER_APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.EDGEEVER_APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.EDGEEVER_APPLE_TEAM_ID }}
-          WIN_CSC_LINK: ${{ secrets.EDGEEVER_WINDOWS_CERTIFICATE_BASE64 }}
-          WIN_CSC_KEY_PASSWORD: ${{ secrets.EDGEEVER_WINDOWS_CERTIFICATE_PASSWORD }}
         run: bun scripts/run-desktop-builder.mjs --publish ${{ github.event_name == 'release' && 'always' || 'never' }}
 
       - name: Verify desktop installer
+        env:
+          EDGE_EVER_VERIFY_TARGET: darwin
         run: bun scripts/verify-desktop-package.mjs
 
       - name: Upload desktop installer and metadata
         uses: actions/upload-artifact@v4
         with:
-          name: edgeever-desktop-${{ matrix.name }}
+          name: edgeever-desktop-macOS-arm64
           path: |
             release/desktop/**/*.dmg
-            release/desktop/**/*.exe
-            release/desktop/**/*.AppImage
+            release/desktop/**/*.zip
             release/desktop/**/*.blockmap
             release/desktop/**/*.yml
-            release/desktop/**/*.zip
           if-no-files-found: error
           retention-days: 14