Build unsigned desktop release artifacts

[johannesschiessl]

Summary

• Disable code-signing and notarization requirements in the desktop release workflow.
• Build and upload unsigned Windows, macOS, and Linux release artifacts.
• Retain release tag validation against the desktop app version.

Testing

• Not run (CI workflow and Electron Builder configuration changes only).

[cubic-dev-ai]

All reported issues were addressed across 2 files

Architecture diagram

sequenceDiagram
    participant GHA as GitHub Actions
    participant ES as Electron Builder
    participant Sign as macOS Notarization Service
    participant CS as Windows Code Signing
    participant Artifact as Build Artifact

    Note over GHA,Artifact: Desktop Release Build Flow

    GHA->>GHA: Checkout repo & install deps
    GHA->>GHA: Validate release tag matches app version
    GHA->>ES: pnpm --filter @showtime/desktop release:build

    alt Windows build
        ES->>ES: Build Windows installer (NSIS/portable)
        Note over ES,CS: CSC_IDENTITY_AUTO_DISCOVERY=false disables Windows signing
        ES-->>GHA: unsigned .exe/nupkg
    else macOS build
        ES->>ES: Build macOS app (dmg/zip)
        Note over ES,Sign: notarize: false in electron-builder config
        ES-->>GHA: unsigned .app bundle
    else Linux build
        ES->>ES: Build Linux AppImage/deb
        ES-->>GHA: unsigned AppImage
    end

    GHA->>Artifact: Upload unsigned artifact (upload-artifact@v4)

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>