ci(signpath): fix artifact-configuration slug to 'initial'

[rainxchzed]

Summary by CodeRabbit

• Chores
  • Consolidated Windows installer outputs into a single staged package uploaded as one artifact.
  • Updated Windows signing configuration to use the revised signing target name.
  • Expanded signing job permissions to allow write actions.
  • Automatically remove the unsigned installer artifact after signing so only signed installers remain.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: aed701ac-86af-4723-ba95-c238ca396f92

📥 Commits

Reviewing files that changed from the base of the PR and between 75017ac and d3eda73.

📒 Files selected for processing (1)

• .github/workflows/build-desktop-platforms.yml

---

Walkthrough

The workflow stages built Windows .exe and .msi into windows-staging/ and uploads that single path; the sign-windows job gains actions: write permission, the SignPath artifact-configuration-slug is changed to initial, and a step deletes the unsigned windows-installers artifact after signing.

Changes

Windows CI staging & signing

Layer / File(s)	Summary
Stage and upload Windows installers .github/workflows/build-desktop-platforms.yml	Copies built .exe and .msi into windows-staging/ and uploads windows-staging/* as the Windows artifact.
Sign-windows permissions, SignPath slug, and artifact cleanup .github/workflows/build-desktop-platforms.yml	Adds actions: write permission to the sign-windows job, updates SignPath submit-signing-request artifact-configuration-slug from initial-version to initial, and deletes the unsigned windows-installers artifact using the build job's windows-artifact-id after signing completes.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• OpenHub-Store/GitHub-Store#280: Modifies the same CI workflow to adjust Windows installer packaging/upload/signing steps.
• OpenHub-Store/GitHub-Store#477: Changes Windows installer artifact staging/upload behavior in the build-desktop-platforms workflow.
• OpenHub-Store/GitHub-Store#579: Alters the Windows CI signing flow and artifact handling related to the sign-windows job.

Poem

🐰 I hop through runners late at night,
Gathering EXEs and MSIs just right,
Into windows-staging they all nest,
Signed with "initial" for their best,
Unsigned crumbs removed — what a sight! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is partially related to the changeset. While it mentions a SignPath configuration fix ('initial' slug), the PR includes substantial Windows installer handling improvements beyond just the slug change, which is the main work.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch generate-installers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

• Flattens .exe and .msi outputs into a windows-staging/ directory before upload so SignPath's *.exe/*.msi globs match at the artifact zip root, fixing the "Expected path to match exactly 1 item, but found 0" SignPath error caused by upload-artifact@v4's multi-source path prefix preservation.
• Corrects the artifact-configuration-slug value from 'initial-version' to 'initial' to match the actual SignPath configuration name.
• Adds a post-signing step that deletes the unsigned windows-installers artifact via the GitHub API, requiring the new actions: write permission; the release job already reads only from windows-installers-signed, so this cleanup is safe.

Confidence Score: 5/5

Safe to merge — changes are targeted CI fixes with no application code impact.

All three changes (staging flatten, slug rename, unsigned artifact cleanup) are consistent and correct. The release job already exclusively reads from windows-installers-signed, so the unsigned artifact deletion is safe. actions: write is the appropriate permission for artifact deletion via the REST API. No logic errors or security concerns identified.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/build-desktop-platforms.yml	Three related fixes: flattens Windows installer staging into a single directory for SignPath glob compatibility, corrects the artifact-configuration-slug from 'initial-version' to 'initial', and adds a cleanup step to delete the unsigned artifact after signing completes (requiring the new actions: write permission).

Sequence Diagram

sequenceDiagram
    participant BW as build-windows
    participant UA as upload-artifact@v4
    participant SW as sign-windows
    participant SP as SignPath Action
    participant API as GitHub API
    participant R as release

    BW->>BW: packageExe / packageMsi
    BW->>BW: "Stage cp *.exe *.msi to windows-staging/"
    BW->>UA: "upload windows-staging/* as windows-installers"
    UA-->>BW: artifact-id (windows-artifact-id output)

    SW->>SP: submit signing request (artifact-configuration-slug: initial)
    SP-->>SW: signed-artifacts/
    SW->>UA: "upload signed-artifacts/* as windows-installers-signed"
    SW->>API: "DELETE /actions/artifacts/{windows-artifact-id}"
    API-->>SW: 204 (unsigned artifact removed)

    R->>UA: "download-artifact@v4 (all)"
    Note over R: Only windows-installers-signed present
    R->>R: Stage release-files/ from windows-installers-signed
    R->>R: gh release create / upload

Loading

_{Reviews (3): Last reviewed commit: "ci(signpath): delete unsigned windows ar..." | Re-trigger Greptile}