[waleedlatif1]

Summary

• Signed build job restores no caches, so nothing it signs can come from a cache another run wrote
• Manual dispatch must run from the tag it builds (GITHUB_REF = refs/tags/$VERSION) instead of checking out a tag named in an input, so a default-branch run never executes another ref's code and a dispatch's caches stay scoped to its tag
• All jobs check out github.sha, which removes the commit output
• Removes the fallbacks for older tags running a newer workflow (smoke partitioning, hashFiles guard, test:e2e branch), since a dispatch now always runs the tag's own workflow
• Updates the desktop README and Electron upgrade checklist for the new dispatch flow

Tags cut before this merges still run their own older workflow when dispatched from the tag, including its Electron cache restore.

Type of Change

• Bug fix

Testing

• actionlint on the workflow
• Real dispatch from a temporary tag and a refused dispatch from a branch; run links in a comment below
• desktop-e2e and CI on this PR

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Building	Preview	Nov 5, 2026 3:30am UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

The PR keeps signed desktop builds off shared caches and requires manual builds to run from the requested tag.

• Manual desktop builds use their tag, and signed builds skip caches.
• Release smoke checks always run in four shards.

waleedlatif1 explicitly notes that tags created before this change still run their older workflows, including their cache restores.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Trigger[CI push or manual tag dispatch] --> Source[Check release source]
  Source --> Smoke[Four smoke jobs with caches]
  Source --> Build[Build without shared cache restores]
  Build --> Sign[Package and sign when requested]
  Smoke --> Publish[Publish when enabled]
  Sign --> Publish

Loading

_{Reviews (1) · Last reviewed commit: "fix(desktop): keep signed release builds..." · Reviewed by Greptile}

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

Dispatch results, unsigned and unpublished, from a temporary tag that has since been deleted:

• From the tag: passed. Its cache was saved under the tag's own scope, and the default-branch desktop cache entries did not change.
• From a branch: refused with the "Run this workflow from the tag" error, before any repo code ran.

That run showed setup-bun still restoring the Bun binary from cache in the signed build job. #9703 fixes that.