Merge 0b97cb3b2c into 3322257cfd

.github/workflows/pr_enforce_labels.yml

@@ -29,7 +29,7 @@ jobs:
           script: |
             // Extract labels from the payload directly to avoid extra API calls
             const latestLabels = context.payload.pull_request.labels.map(label => label.name);
-            const requiredLabels = ['bugfix', 'enhancement', 'automation', 'dependencies', 'repo', 'release', 'refactor'];
+            const requiredLabels = ['bugfix', 'enhancement', 'automation', 'dependencies', 'repo', 'release', 'refactor', 'desktop'];
             console.log('Labels from payload:', latestLabels);
             const hasRequiredLabel = latestLabels.some(label => requiredLabels.includes(label));
             if (!hasRequiredLabel) {

.github/workflows/release.yml

@@ -53,6 +53,16 @@ on:
         required: false
       INTERNAL_BUILDS_HOST_PAT:
         required: false
+      DISCORD_WEBHOOK_DESKTOP:
+        required: false
+      APPLE_SIGNING_IDENTITY:
+        required: false
+      APPLE_ID:
+        required: false
+      APPLE_APP_SPECIFIC_PASSWORD:
+        required: false
+      APPLE_TEAM_ID:
+        required: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ inputs.tag_name }}
@@ -284,7 +294,13 @@ jobs:
       - name: Package Native Distributions
         env:
           ORG_GRADLE_PROJECT_appVersionName: ${{ needs.prepare-build-info.outputs.APP_VERSION_NAME }}
+          VERSION_CODE: ${{ needs.prepare-build-info.outputs.APP_VERSION_CODE }}
           APPIMAGE_EXTRACT_AND_RUN: 1
+          SIGN_MACOS: ${{ runner.os == 'macOS' && 'true' || 'false' }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: ./gradlew :desktop:packageReleaseDistributionForCurrentOS -PaboutLibraries.release=true --no-daemon
 
       - name: List Desktop Binaries
@@ -306,10 +322,61 @@ jobs:
           retention-days: 1
           if-no-files-found: ignore
 
+      - name: Attest Desktop artifact provenance
+        if: success()
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: |
+            desktop/build/compose/binaries/main-release/*/*.dmg
+            desktop/build/compose/binaries/main-release/*/*.msi
+            desktop/build/compose/binaries/main-release/*/*.exe
+            desktop/build/compose/binaries/main-release/*/*.deb
+            desktop/build/compose/binaries/main-release/*/*.rpm
+            desktop/build/compose/binaries/main-release/*/*.AppImage
+
+  notify-desktop-release:
+    if: ${{ inputs.build_desktop && !cancelled() && !failure() }}
+    runs-on: ubuntu-24.04-arm
+    needs: [prepare-build-info, release-desktop]
+    env:
+      DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_DESKTOP }}
+      VERSION: ${{ inputs.tag_name }}
+    steps:
+      - name: Notify Discord
+        run: |
+          if [[ -z "$DISCORD_WEBHOOK" ]]; then
+            echo "No DISCORD_WEBHOOK_DESKTOP secret provided. Skipping notification."
+            exit 0
+          fi
+
+          PAYLOAD=$(cat <<EOF
+          {
+            "content": null,
+            "embeds": [
+              {
+                "title": "🖥️ New Desktop Release: $VERSION",
+                "description": "Desktop installers (macOS DMG, Windows MSI/EXE, Linux DEB/RPM/AppImage) are available.",
+                "color": 3447003,
+                "fields": [
+                  {
+                    "name": "Version",
+                    "value": "$VERSION",
+                    "inline": true
+                  }
+                ],
+                "url": "https://github.com/meshtastic/Meshtastic-Android/releases/tag/$VERSION"
+              }
+            ]
+          }
+          EOF
+          )
+
+          curl -H "Content-Type: application/json" -d "$PAYLOAD" "$DISCORD_WEBHOOK"
+
   github-release:
     if: ${{ !cancelled() && !failure() }}
     runs-on: ubuntu-24.04-arm
-    needs: [prepare-build-info, release-google, release-fdroid, release-desktop]
+    needs: [prepare-build-info, release-google, release-fdroid, release-desktop, notify-desktop-release]
     env:
       INTERNAL_BUILDS_HOST: ${{ secrets.INTERNAL_BUILDS_HOST }}
     permissions: