ci: smoke and attest packaged artifacts

Add packaged-artifact smoke checks, checksums, attestations, and release asset staging guardrails.

.github/workflows/build.yml

@@ -4,6 +4,12 @@ name: Build Electron App
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+  artifact-metadata: write
+
 jobs:
   build-windows:
     runs-on: windows-latest
@@ -35,17 +41,43 @@ jobs:
           npm run build:platform-native-helpers
           npx tsc
           npx vite build
-          npx electron-builder --win nsis --x64 --publish never
+          npx electron-builder --win dir nsis --x64 --publish never
+
+      - name: Smoke test packaged Windows paths
+        run: npm run smoke:packaged-binaries
+
+      - name: Generate Windows artifact checksums
+        run: npm run checksums:release -- SHA256SUMS-windows.txt
+
+      - name: Attest Windows artifacts
+        uses: actions/attest@v4
+        with:
+          subject-checksums: release/SHA256SUMS-windows.txt
 
       - name: Upload Windows build
         uses: actions/upload-artifact@v4
         with:
-          name: windows-installer
-          path: release/**/*.exe
+          name: windows-x64-release
+          path: |
+            release/*.exe
+            release/*.blockmap
+            release/latest*.yml
+            release/SHA256SUMS*.txt
+          if-no-files-found: error
           retention-days: 30
 
   build-macos:
-    runs-on: macos-latest
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x64
+            arch_tag: darwin-x64
+            runner: macos-15-intel
+          - arch: arm64
+            arch_tag: darwin-arm64
+            runner: macos-14
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -78,16 +110,32 @@ jobs:
           npm run build:platform-native-helpers
           npx tsc
           npx vite build
-          npx electron-builder --mac dmg zip --publish never
+          npx electron-builder --mac dir dmg zip --${{ matrix.arch }} --publish never
+
+      - name: Smoke test packaged macOS paths
+        env:
+          PACKAGED_SMOKE_ARCH_TAGS: ${{ matrix.arch_tag }}
+        run: npm run smoke:packaged-binaries
+
+      - name: Generate macOS artifact checksums
+        run: npm run checksums:release -- SHA256SUMS-macos-${{ matrix.arch }}.txt
+
+      - name: Attest macOS artifacts
+        uses: actions/attest@v4
+        with:
+          subject-checksums: release/SHA256SUMS-macos-${{ matrix.arch }}.txt
 
       - name: Upload macOS build
         uses: actions/upload-artifact@v4
         with:
-          name: macos-installer
+          name: macos-${{ matrix.arch }}-release
           path: |
             release/**/*.dmg
             release/**/*.zip
+            release/**/*.blockmap
             release/latest-mac.yml
+            release/SHA256SUMS*.txt
+          if-no-files-found: error
           retention-days: 30
 
   build-linux:
@@ -127,13 +175,27 @@ jobs:
           npm run build:platform-native-helpers
           npx tsc
           npx vite build
-          npx electron-builder --linux AppImage --x64 --publish never
+          npx electron-builder --linux dir AppImage --x64 --publish never
+
+      - name: Smoke test packaged Linux paths
+        run: npm run smoke:packaged-binaries
+
+      - name: Generate Linux artifact checksums
+        run: npm run checksums:release -- SHA256SUMS-linux.txt
+
+      - name: Attest Linux artifacts
+        uses: actions/attest@v4
+        with:
+          subject-checksums: release/SHA256SUMS-linux.txt
 
       - name: Upload Linux build
         uses: actions/upload-artifact@v4
         with:
-          name: linux-installer
+          name: linux-x64-release
           path: |
             release/**/*.AppImage
+            release/**/*.blockmap
             release/latest-linux.yml
+            release/SHA256SUMS*.txt
+          if-no-files-found: error
           retention-days: 30

.github/workflows/release.yml

@@ -13,6 +13,9 @@ on:
 permissions:
   contents: write
   actions: write
+  id-token: write
+  attestations: write
+  artifact-metadata: write
 
 concurrency:
   group: release-${{ github.event.release.tag_name || github.event.inputs.tag_name || github.run_id }}
@@ -146,7 +149,20 @@ jobs:
         run: |
           npx tsc
           npx vite build
-          npx electron-builder --mac dmg zip --x64 --publish never
+          npx electron-builder --mac dir dmg zip --x64 --publish never
+
+      - name: Smoke test packaged macOS x64 paths
+        env:
+          PACKAGED_SMOKE_ARCH_TAGS: darwin-x64
+        run: npm run smoke:packaged-binaries
+
+      - name: Generate macOS x64 artifact checksums
+        run: npm run checksums:release -- SHA256SUMS-macos-x64.txt
+
+      - name: Attest macOS x64 artifacts
+        uses: actions/attest@v4
+        with:
+          subject-checksums: release/SHA256SUMS-macos-x64.txt
 
       - name: Upload macOS x64 artifacts
         uses: actions/upload-artifact@v4
@@ -157,6 +173,7 @@ jobs:
             release/*.zip
             release/*.blockmap
             release/latest-mac.yml
+            release/SHA256SUMS*.txt
           if-no-files-found: error
 
   build-macos-arm64:
@@ -233,7 +250,20 @@ jobs:
         run: |
           npx tsc
           npx vite build
-          npx electron-builder --mac dmg zip --arm64 --publish never
+          npx electron-builder --mac dir dmg zip --arm64 --publish never
+
+      - name: Smoke test packaged macOS arm64 paths
+        env:
+          PACKAGED_SMOKE_ARCH_TAGS: darwin-arm64
+        run: npm run smoke:packaged-binaries
+
+      - name: Generate macOS arm64 artifact checksums
+        run: npm run checksums:release -- SHA256SUMS-macos-arm64.txt
+
+      - name: Attest macOS arm64 artifacts
+        uses: actions/attest@v4
+        with:
+          subject-checksums: release/SHA256SUMS-macos-arm64.txt
 
       - name: Upload macOS arm64 artifacts
         uses: actions/upload-artifact@v4
@@ -244,6 +274,7 @@ jobs:
             release/*.zip
             release/*.blockmap
             release/latest-mac.yml
+            release/SHA256SUMS*.txt
           if-no-files-found: error
 
   merge-macos-update-metadata:
@@ -384,7 +415,18 @@ jobs:
           npm run build:platform-native-helpers
           npx tsc
           npx vite build
-          npx electron-builder --win nsis --x64 --publish never
+          npx electron-builder --win dir nsis --x64 --publish never
+
+      - name: Smoke test packaged Windows x64 paths
+        run: npm run smoke:packaged-binaries
+
+      - name: Generate Windows x64 artifact checksums
+        run: npm run checksums:release -- SHA256SUMS-windows-x64.txt
+
+      - name: Attest Windows x64 artifacts
+        uses: actions/attest@v4
+        with:
+          subject-checksums: release/SHA256SUMS-windows-x64.txt
 
       - name: Upload Windows x64 artifacts
         uses: actions/upload-artifact@v4
@@ -394,6 +436,7 @@ jobs:
             release/*.exe
             release/*.blockmap
             release/latest*.yml
+            release/SHA256SUMS*.txt
           if-no-files-found: error
 
   build-linux-x64:
@@ -446,7 +489,18 @@ jobs:
           npm run build:platform-native-helpers
           npx tsc
           npx vite build
-          npx electron-builder --linux AppImage --x64 --publish never
+          npx electron-builder --linux dir AppImage --x64 --publish never
+
+      - name: Smoke test packaged Linux x64 paths
+        run: npm run smoke:packaged-binaries
+
+      - name: Generate Linux x64 artifact checksums
+        run: npm run checksums:release -- SHA256SUMS-linux-x64.txt
+
+      - name: Attest Linux x64 artifacts
+        uses: actions/attest@v4
+        with:
+          subject-checksums: release/SHA256SUMS-linux-x64.txt
 
       - name: Upload Linux x64 artifacts
         uses: actions/upload-artifact@v4
@@ -456,6 +510,7 @@ jobs:
             release/*.AppImage
             release/*.blockmap
             release/latest-linux.yml
+            release/SHA256SUMS*.txt
           if-no-files-found: error
 
   publish-release-assets:
@@ -499,12 +554,13 @@ jobs:
           name: linux-x64-release
           path: release-assets/linux-x64
 
-      - name: Upload release assets to GitHub
+      - name: Stage release assets
         shell: bash
         run: |
           set -euo pipefail
           shopt -s nullglob
 
+          mkdir -p release-assets/upload
           assets=(
             release-assets/macos-x64/*.dmg
             release-assets/macos-x64/*.zip
@@ -521,6 +577,43 @@ jobs:
             release-assets/linux-x64/latest-linux.yml
           )
 
+          if [ ${#assets[@]} -eq 0 ]; then
+            echo "No release assets found to checksum."
+            exit 1
+          fi
+
+          for file in "${assets[@]}"; do
+            target="release-assets/upload/$(basename "$file")"
+            if [ -e "$target" ]; then
+              echo "Duplicate release asset name: $(basename "$file")"
+              exit 1
+            fi
+            cp "$file" "$target"
+          done
+
+      - name: Generate release asset checksums
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd release-assets/upload
+          sha256sum * | sort -k2,2 > SHA256SUMS.txt
+          sha256sum -c SHA256SUMS.txt
+
+      - name: Attest release assets
+        uses: actions/attest@v4
+        with:
+          subject-checksums: release-assets/upload/SHA256SUMS.txt
+
+      - name: Upload release assets to GitHub
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+
+          assets=(
+            release-assets/upload/*
+          )
+
           if [ ${#assets[@]} -eq 0 ]; then
             echo "No release assets found to upload."
             exit 1

package.json

@@ -33,6 +33,8 @@
 		"build:linux": "npm run build:platform-native-helpers && tsc && vite build --config vite.config.ts && electron-builder --linux",
 		"i18n:check": "node scripts/i18n-check.mjs",
 		"benchmark:export-queues": "node scripts/benchmark-export-queues.mjs",
+		"smoke:packaged-binaries": "node scripts/smoke-packaged-binaries.mjs",
+		"checksums:release": "node scripts/write-release-checksums.mjs",
 		"release:create": "node scripts/create-release.mjs",
 		"test": "vitest --run",
 		"test:watch": "vitest"

scripts/smoke-packaged-binaries.mjs

@@ -0,0 +1,269 @@
+import { execFileSync } from "node:child_process";
+import { accessSync, constants, existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+
+const projectRoot = process.cwd();
+const releaseRoot = path.join(projectRoot, "release");
+const packageJson = JSON.parse(readFileSync(path.join(projectRoot, "package.json"), "utf8"));
+const productName = packageJson.productName ?? packageJson.name ?? "Recordly";
+const packageName = packageJson.name ?? "recordly";
+
+function relativePath(filePath) {
+	return path.relative(projectRoot, filePath).replaceAll("\\", "/");
+}
+
+function fail(message) {
+	throw new Error(`[packaged-smoke] ${message}`);
+}
+
+function assertFile(filePath, label, { executable = false } = {}) {
+	if (!existsSync(filePath)) {
+		fail(`${label} is missing at ${relativePath(filePath)}`);
+	}
+
+	if (!statSync(filePath).isFile()) {
+		fail(`${label} is not a file at ${relativePath(filePath)}`);
+	}
+
+	if (executable && process.platform !== "win32") {
+		try {
+			accessSync(filePath, constants.X_OK);
+		} catch {
+			fail(`${label} is not executable at ${relativePath(filePath)}`);
+		}
+	}
+
+	console.log(`[packaged-smoke] ${label}: ${relativePath(filePath)}`);
+}
+
+function findDirectoriesByName(rootDir, directoryName, maxDepth = 8) {
+	if (!existsSync(rootDir)) {
+		return [];
+	}
+
+	const matches = [];
+	const queue = [{ dir: rootDir, depth: 0 }];
+
+	while (queue.length > 0) {
+		const current = queue.shift();
+		if (!current || current.depth > maxDepth) {
+			continue;
+		}
+
+		for (const entry of readdirSync(current.dir, { withFileTypes: true })) {
+			if (!entry.isDirectory()) {
+				continue;
+			}
+
+			const childDir = path.join(current.dir, entry.name);
+			if (entry.name === directoryName) {
+				matches.push(childDir);
+				continue;
+			}
+
+			queue.push({ dir: childDir, depth: current.depth + 1 });
+		}
+	}
+
+	return matches;
+}
+
+function findAppBundleDir(startDir) {
+	let current = startDir;
+	while (current !== path.dirname(current)) {
+		if (current.endsWith(".app")) {
+			return current;
+		}
+		current = path.dirname(current);
+	}
+
+	return null;
+}
+
+function findFirstExistingFile(candidates) {
+	return candidates.find((candidate) => existsSync(candidate) && statSync(candidate).isFile());
+}
+
+function assertPackagedAppExecutable(unpackedRoot) {
+	const resourcesDir = path.dirname(unpackedRoot);
+
+	if (process.platform === "darwin") {
+		const appBundleDir = findAppBundleDir(resourcesDir);
+		if (!appBundleDir) {
+			fail(`macOS app bundle not found for ${relativePath(unpackedRoot)}`);
+		}
+
+		const executablePath = findFirstExistingFile([
+			path.join(appBundleDir, "Contents", "MacOS", productName),
+			path.join(appBundleDir, "Contents", "MacOS", packageName),
+		]);
+		assertFile(
+			executablePath ?? path.join(appBundleDir, "Contents", "MacOS", productName),
+			"packaged app executable",
+			{ executable: true },
+		);
+		return;
+	}
+
+	const appDir = path.dirname(resourcesDir);
+	const executableCandidates =
+		process.platform === "win32"
+			? [
+					path.join(appDir, `${productName}.exe`),
+					path.join(appDir, `${packageName}.exe`),
+					path.join(appDir, "Recordly.exe"),
+				]
+			: [
+					path.join(appDir, packageName),
+					path.join(appDir, productName),
+					path.join(appDir, productName.toLowerCase()),
+				];
+
+	const executablePath = findFirstExistingFile(executableCandidates);
+	assertFile(executablePath ?? executableCandidates[0], "packaged app executable", {
+		executable: true,
+	});
+}
+
+function getNativeArchTag(platform = process.platform, arch = process.arch) {
+	if (platform === "darwin") {
+		return arch === "arm64" ? "darwin-arm64" : "darwin-x64";
+	}
+
+	if (platform === "win32") {
+		return arch === "arm64" ? "win32-arm64" : "win32-x64";
+	}
+
+	if (platform === "linux") {
+		return arch === "arm64" ? "linux-arm64" : "linux-x64";
+	}
+
+	return `${platform}-${arch}`;
+}
+
+function getRequiredArchTags() {
+	const configured = process.env.PACKAGED_SMOKE_ARCH_TAGS?.trim();
+	if (!configured) {
+		return [getNativeArchTag()];
+	}
+
+	return [
+		...new Set(
+			configured
+				.split(",")
+				.map((entry) => entry.trim())
+				.filter(Boolean),
+		),
+	];
+}
+
+function getExpectedNativeHelperFiles(archTag) {
+	if (archTag.startsWith("win32-")) {
+		return [
+			{ name: "wgc-capture.exe", label: "Windows capture helper", executable: true },
+			{
+				name: "cursor-monitor.exe",
+				label: "Windows cursor monitor helper",
+				executable: true,
+			},
+			{ name: "helpers-manifest.json", label: "Windows helper manifest" },
+			{ name: "whisper-cli.exe", label: "Whisper CLI runtime", executable: true },
+			{ name: "whisper-runtime.json", label: "Whisper runtime manifest" },
+		];
+	}
+
+	if (archTag.startsWith("darwin-")) {
+		return [
+			{
+				name: "recordly-screencapturekit-helper",
+				label: "ScreenCaptureKit helper",
+				executable: true,
+			},
+			{ name: "recordly-window-list", label: "Window list helper", executable: true },
+			{ name: "recordly-system-cursors", label: "System cursor helper", executable: true },
+			{
+				name: "recordly-native-cursor-monitor",
+				label: "Native cursor monitor helper",
+				executable: true,
+			},
+			{ name: "whisper-cli", label: "Whisper CLI runtime", executable: true },
+			{ name: "whisper-runtime.json", label: "Whisper runtime manifest" },
+		];
+	}
+
+	if (archTag.startsWith("linux-")) {
+		return [
+			{ name: "whisper-cli", label: "Whisper CLI runtime", executable: true },
+			{ name: "whisper-runtime.json", label: "Whisper runtime manifest" },
+		];
+	}
+
+	return [];
+}
+
+function verifyFfmpeg(unpackedRoot) {
+	const binaryName = process.platform === "win32" ? "ffmpeg.exe" : "ffmpeg";
+	const ffmpegPath = path.join(unpackedRoot, "node_modules", "ffmpeg-static", binaryName);
+
+	assertFile(ffmpegPath, "packaged FFmpeg binary", { executable: true });
+
+	const output = execFileSync(ffmpegPath, ["-version"], {
+		encoding: "utf8",
+		timeout: 15000,
+		windowsHide: true,
+	});
+
+	if (!output.startsWith("ffmpeg version")) {
+		fail(`FFmpeg version smoke returned unexpected output from ${relativePath(ffmpegPath)}`);
+	}
+
+	console.log(output.split(/\r?\n/, 1)[0]);
+}
+
+function verifyNativeHelpers(unpackedRoot) {
+	const nativeBinRoot = path.join(unpackedRoot, "electron", "native", "bin");
+	if (!existsSync(nativeBinRoot)) {
+		fail(`native helper bin directory is missing at ${relativePath(nativeBinRoot)}`);
+	}
+
+	for (const archTag of getRequiredArchTags()) {
+		const archDir = path.join(nativeBinRoot, archTag);
+		if (!existsSync(archDir)) {
+			fail(`native helper arch directory is missing at ${relativePath(archDir)}`);
+		}
+
+		const expectedFiles = getExpectedNativeHelperFiles(archTag);
+		if (expectedFiles.length === 0) {
+			fail(`no packaged helper expectations are defined for ${archTag}`);
+		}
+
+		for (const expectedFile of expectedFiles) {
+			assertFile(
+				path.join(archDir, expectedFile.name),
+				`${expectedFile.label} (${archTag})`,
+				{
+					executable: expectedFile.executable,
+				},
+			);
+		}
+	}
+}
+
+const unpackedRoots = findDirectoriesByName(releaseRoot, "app.asar.unpacked");
+
+if (unpackedRoots.length === 0) {
+	fail("no packaged app.asar.unpacked directory found under release/");
+}
+
+console.log(
+	`[packaged-smoke] verifying ${unpackedRoots.length} packaged app root(s) for ${process.platform}/${process.arch}`,
+);
+
+for (const unpackedRoot of unpackedRoots) {
+	console.log(`[packaged-smoke] root: ${relativePath(unpackedRoot)}`);
+	assertPackagedAppExecutable(unpackedRoot);
+	verifyFfmpeg(unpackedRoot);
+	verifyNativeHelpers(unpackedRoot);
+}
+
+console.log("[packaged-smoke] packaged binary path smoke passed");

scripts/write-release-checksums.mjs

@@ -0,0 +1,64 @@
+import { createHash } from "node:crypto";
+import { createReadStream, existsSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+
+const projectRoot = process.cwd();
+const releaseRoot = path.join(projectRoot, "release");
+const outputFileName = process.argv[2] ?? "SHA256SUMS.txt";
+const outputPath = path.join(releaseRoot, outputFileName);
+const releaseArtifactExtensions = new Set([".AppImage", ".blockmap", ".dmg", ".exe", ".zip"]);
+
+function relativePath(filePath) {
+	return path.relative(projectRoot, filePath).replaceAll("\\", "/");
+}
+
+function artifactSubjectName(filePath) {
+	return path.basename(filePath);
+}
+
+function isReleaseArtifact(fileName) {
+	if (fileName.startsWith("SHA256SUMS")) {
+		return false;
+	}
+
+	if (fileName.startsWith("latest") && fileName.endsWith(".yml")) {
+		return true;
+	}
+
+	return releaseArtifactExtensions.has(path.extname(fileName));
+}
+
+function sha256(filePath) {
+	return new Promise((resolve, reject) => {
+		const hash = createHash("sha256");
+		createReadStream(filePath)
+			.on("error", reject)
+			.on("data", (chunk) => hash.update(chunk))
+			.on("end", () => resolve(hash.digest("hex")));
+	});
+}
+
+if (!existsSync(releaseRoot)) {
+	throw new Error("[release-checksums] release directory is missing");
+}
+
+const releaseArtifacts = readdirSync(releaseRoot)
+	.map((entry) => path.join(releaseRoot, entry))
+	.filter((filePath) => statSync(filePath).isFile())
+	.filter((filePath) => isReleaseArtifact(path.basename(filePath)))
+	.sort((left, right) => relativePath(left).localeCompare(relativePath(right)));
+
+if (releaseArtifacts.length === 0) {
+	throw new Error("[release-checksums] no release artifacts found");
+}
+
+const checksums = [];
+for (const filePath of releaseArtifacts) {
+	checksums.push(`${await sha256(filePath)}  ${artifactSubjectName(filePath)}`);
+}
+
+writeFileSync(outputPath, `${checksums.join("\n")}\n`);
+console.log(`[release-checksums] wrote ${relativePath(outputPath)}`);
+for (const artifact of releaseArtifacts) {
+	console.log(`[release-checksums] ${relativePath(artifact)}`);
+}