@omega.js/desktop 0.1.0

package/dist/test/suites/build/build-config.test.js

@@ -0,0 +1,457 @@
+// Build-layer tests for gulp/tasks/build-config.js — verify the object generation
+// from @omega.js/desktop defaults + consumer config + override merging.
+
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'build-config — generate electron-builder.yml from omega.json5',
+  tests: [
+    {
+      name: 'task module exports a function plus baseConfig + deepMerge',
+      run: (ctx) => {
+        const mod = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        ctx.expect(typeof mod).toBe('function');
+        ctx.expect(typeof mod.baseConfig).toBe('function');
+        ctx.expect(typeof mod.deepMerge).toBe('function');
+      },
+    },
+    {
+      name: 'shouldInjectLSUIElement: hidden mode OR hidden login launch → true; everything else → false',
+      run: (ctx) => {
+        const { shouldInjectLSUIElement } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+
+        // Hidden startup mode — the tray-only app case.
+        ctx.expect(shouldInjectLSUIElement({ startup: { mode: 'hidden' } })).toBe(true);
+
+        // Normal app whose LOGIN launch is hidden — without the plist key the
+        // login launch flashes the dock before applyEarly() can hide it.
+        ctx.expect(shouldInjectLSUIElement({ startup: { mode: 'normal', openAtLogin: { enabled: true, mode: 'hidden' } } })).toBe(true);
+
+        // Plain normal apps never get the key.
+        ctx.expect(shouldInjectLSUIElement({ startup: { mode: 'normal' } })).toBe(false);
+        ctx.expect(shouldInjectLSUIElement({ startup: { mode: 'normal', openAtLogin: { enabled: true, mode: 'normal' } } })).toBe(false);
+        ctx.expect(shouldInjectLSUIElement({})).toBe(false);
+        ctx.expect(shouldInjectLSUIElement(undefined)).toBe(false);
+      },
+    },
+    {
+      name: 'baseConfig: applies appId/productName/copyright from consumer config',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({
+          app: { appId: 'com.itwcreativeworks.somiibo', productName: 'Somiibo', copyright: '© Somiibo' },
+        });
+        ctx.expect(out.appId).toBe('com.itwcreativeworks.somiibo');
+        ctx.expect(out.productName).toBe('Somiibo');
+        ctx.expect(out.copyright).toBe('© Somiibo');
+      },
+    },
+    {
+      name: 'baseConfig: ships @omega.js/desktop defaults for mac/win/linux targets',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({});
+        // Mac: dmg + zip, universal arch (one binary that runs on both Intel + Apple Silicon).
+        ctx.expect(out.mac.target.find((t) => t.target === 'dmg')).toBeDefined();
+        ctx.expect(out.mac.target.find((t) => t.target === 'zip')).toBeDefined();
+        ctx.expect(out.mac.target[0].arch).toEqual(['universal']);
+        // Win: nsis x64 + ia32 (multi-arch single installer).
+        ctx.expect(out.win.target[0].target).toBe('nsis');
+        ctx.expect(out.win.target[0].arch).toEqual(['x64', 'ia32']);
+        // Linux: deb + AppImage, both x64. No i386.
+        const linuxTargets = out.linux.target.map((t) => t.target);
+        ctx.expect(linuxTargets).toContain('deb');
+        ctx.expect(linuxTargets).toContain('AppImage');
+        for (const t of out.linux.target) {
+          ctx.expect(t.arch).toEqual(['x64']);
+        }
+      },
+    },
+    {
+      name: 'baseConfig: artifact names carry NO version, from @omega.js/config\'s ONE rule (#620)',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const { desktopArtifactNames } = require('../../../vendor/config/index.js');
+        const out = baseConfig({ app: { productName: 'Deployment Playground' } });
+        const names = desktopArtifactNames('Deployment Playground');
+
+        // Versionless names are what makes
+        // github.com/<org>/<repo>/releases/latest/download/<asset> a stable
+        // direct-download URL — the site derives its buttons from THESE names,
+        // so a second spelling here is a dead download button.
+        ctx.expect(out.mac.artifactName).toBe('Deployment-Playground-mac-universal.${ext}');
+        ctx.expect(out.nsis.artifactName).toBe('Deployment-Playground-windows-universal.${ext}');
+        ctx.expect(out.deb.artifactName).toBe(names.linux.debian);
+        ctx.expect(out.appImage.artifactName).toBe(names.linux.appimage);
+
+        // The mac fallback covers the dmg AND the auto-update zip, so the dmg
+        // needs no override of its own.
+        ctx.expect(out.mac.artifactName.replace('${ext}', 'dmg')).toBe(names.mac.universal);
+        ctx.expect(out.nsis.artifactName.replace('${ext}', 'exe')).toBe(names.windows.universal);
+        ctx.expect(out.dmg.artifactName).toBe(undefined);
+
+        // Nothing keeps a ${version} token — every name is stable across releases.
+        for (const template of [out.mac.artifactName, out.nsis.artifactName, out.deb.artifactName, out.appImage.artifactName, out.linux.artifactName]) {
+          ctx.expect(template.includes('${version}')).toBe(false);
+        }
+      },
+    },
+    {
+      name: 'baseConfig: an arch the versionless names cannot spell REFUSES the build (#620)',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const quiet = { log() {}, warn() {}, error() {} };
+        const build = { mode: { build: true }, logger: quiet };
+
+        // Two linux archs share ONE deb name and ONE AppImage name — the
+        // second arch's artifact overwrites the first's.
+        let onLinux = null;
+        try {
+          baseConfig({ platforms: { linux: { arch: ['x64', 'arm64'] } } }, build);
+        } catch (e) {
+          onLinux = e;
+        }
+        ctx.expect(onLinux === null).toBe(false);
+        ctx.expect(onLinux.message).toContain('platforms.linux.arch');
+
+        // A non-universal mac build would ship under the name `-mac-universal`.
+        let onMac = null;
+        try {
+          baseConfig({ platforms: { mac: { arch: ['arm64'] } } }, build);
+        } catch (e) {
+          onMac = e;
+        }
+        ctx.expect(onMac === null).toBe(false);
+        ctx.expect(onMac.message).toContain('platforms.mac.arch');
+
+        // A publish run is a build for this purpose.
+        let onPublish = null;
+        try {
+          baseConfig({ platforms: { mac: { arch: ['arm64'] } } }, { mode: { publish: true }, logger: quiet });
+        } catch (e) {
+          onPublish = e;
+        }
+        ctx.expect(onPublish === null).toBe(false);
+
+        // Development warns and keeps going — the collision only lands when a
+        // build actually publishes those files.
+        const said = [];
+        const loud = { log() {}, warn: (m) => said.push(m), error() {} };
+        const out = baseConfig({ platforms: { mac: { arch: ['arm64'] } } }, { mode: { build: false, publish: false }, logger: loud });
+        ctx.expect(out.mac.target[0].arch).toEqual(['arm64']);
+        ctx.expect(said.join('\n')).toContain('platforms.mac.arch');
+      },
+    },
+    {
+      name: 'baseConfig: the shippable arch sets pass — universal mac, single-arch linux, multi-arch windows',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const quiet = { log() {}, warn() {}, error() {} };
+        const build = { mode: { build: true }, logger: quiet };
+
+        // The defaults are what every brand ships: nothing to refuse.
+        const defaults = baseConfig({}, build);
+        ctx.expect(defaults.mac.target[0].arch).toEqual(['universal']);
+        ctx.expect(defaults.linux.target[0].arch).toEqual(['x64']);
+
+        // NSIS merges every arch into ONE installer, so windows is genuinely
+        // safe — its multi-arch default is never refused.
+        ctx.expect(baseConfig({ platforms: { win: { arch: ['x64', 'ia32', 'arm64'] } } }, build).win.target[0].arch)
+          .toEqual(['x64', 'ia32', 'arm64']);
+
+        // One linux arch names one deb: an arm64-only brand ships fine.
+        ctx.expect(baseConfig({ platforms: { linux: { arch: ['arm64'] } } }, build).linux.target[0].arch).toEqual(['arm64']);
+      },
+    },
+    {
+      name: 'baseConfig: notarize is false (notarization runs via afterSign hook)',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({});
+        ctx.expect(out.mac.notarize).toBe(false);
+        ctx.expect(out.mac.hardenedRuntime).toBe(true);
+      },
+    },
+    {
+      name: 'deepMerge: arrays in override REPLACE (not concat) defaults',
+      run: (ctx) => {
+        const { deepMerge } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = deepMerge(
+          { mac: { target: [{ target: 'dmg' }, { target: 'zip' }] } },
+          { mac: { target: [{ target: 'dmg', arch: ['x64'] }] } },
+        );
+        ctx.expect(out.mac.target.length).toBe(1);
+        ctx.expect(out.mac.target[0].arch).toEqual(['x64']);
+      },
+    },
+    {
+      name: 'deepMerge: nested objects merge per-key',
+      run: (ctx) => {
+        const { deepMerge } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = deepMerge(
+          { mac: { hardenedRuntime: true, gatekeeperAssess: false } },
+          { mac: { gatekeeperAssess: true } },
+        );
+        ctx.expect(out.mac.hardenedRuntime).toBe(true);
+        ctx.expect(out.mac.gatekeeperAssess).toBe(true);
+      },
+    },
+    {
+      name: 'deepMerge: top-level keys from override added to base',
+      run: (ctx) => {
+        const { deepMerge } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = deepMerge(
+          { appId: 'a', mac: {} },
+          { extraField: 'hello' },
+        );
+        ctx.expect(out.appId).toBe('a');
+        ctx.expect(out.extraField).toBe('hello');
+      },
+    },
+    {
+      name: 'baseConfig: falls back to safe defaults when consumer config is empty',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({});
+        ctx.expect(out.appId).toBeTruthy();
+        ctx.expect(out.productName).toBeTruthy();
+        ctx.expect(out.directories.output).toBe('release');
+      },
+    },
+    {
+      name: 'expandYear: substitutes {YEAR} with current year',
+      run: (ctx) => {
+        const { expandYear } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const year = new Date().getFullYear();
+        ctx.expect(expandYear('© {YEAR}, Somiibo')).toBe(`© ${year}, Somiibo`);
+        ctx.expect(expandYear('no token here')).toBe('no token here');
+        ctx.expect(expandYear(null)).toBe(null);
+      },
+    },
+    {
+      name: 'baseConfig: copyright derives from brand.name, never a hardcoded company (friction #18)',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const year = new Date().getFullYear();
+        ctx.expect(baseConfig({ brand: { name: 'Somiibo' } }).copyright).toBe(`© ${year}, Somiibo`);
+        ctx.expect(baseConfig({}).copyright).toBe(`© ${year}`);
+      },
+    },
+    {
+      name: 'baseConfig: copyright {YEAR} token expanded when consumer overrides',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const year = new Date().getFullYear();
+        const out = baseConfig({ app: { copyright: '© {YEAR}, MyCompany' } });
+        ctx.expect(out.copyright).toBe(`© ${year}, MyCompany`);
+      },
+    },
+    {
+      name: 'baseConfig: app.category maps to per-platform values',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({ app: { category: 'developer-tools' } });
+        ctx.expect(out.mac.category).toBe('public.app-category.developer-tools');
+        ctx.expect(out.linux.category).toBe('Development');
+      },
+    },
+    {
+      name: 'baseConfig: unknown app.category falls back to productivity',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({ app: { category: 'made-up-thing' } });
+        ctx.expect(out.mac.category).toBe('public.app-category.productivity');
+        ctx.expect(out.linux.category).toBe('Utility');
+      },
+    },
+    {
+      name: 'baseConfig: NSIS defaults to oneClick + shortcuts on',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({});
+        ctx.expect(out.nsis.oneClick).toBe(true);
+        ctx.expect(out.nsis.createDesktopShortcut).toBe('always');
+        ctx.expect(out.nsis.createStartMenuShortcut).toBe(true);
+        ctx.expect(out.nsis.runAfterFinish).toBe(true);
+        ctx.expect(out.nsis.perMachine).toBe(false);
+      },
+    },
+    {
+      name: 'baseConfig: platforms.win.oneClick: false produces wizard installer',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({ platforms: { win: { oneClick: false } } });
+        ctx.expect(out.nsis.oneClick).toBe(false);
+        ctx.expect(out.nsis.allowToChangeInstallationDirectory).toBe(true);
+      },
+    },
+    {
+      name: 'baseConfig: snap missing from config — no snap target (default OFF)',
+      run: (ctx) => {
+        // Behavior contract: callers who never set platforms.linux.snap.enabled should
+        // never get a snap target emitted. The scaffold ships `enabled: true` so new
+        // projects opt in by virtue of the scaffold; this case is for older projects
+        // or programmatic callers that don't supply the field.
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const saved = process.env.SNAPCRAFT_STORE_CREDENTIALS;
+        process.env.SNAPCRAFT_STORE_CREDENTIALS = 'fake-creds-blob';   // creds present, but config doesn't enable
+        try {
+          const out = baseConfig({});
+          ctx.expect(out.linux.target.find((t) => t.target === 'snap')).toBeUndefined();
+          ctx.expect(out.snap).toBeUndefined();
+        } finally {
+          if (saved === undefined) delete process.env.SNAPCRAFT_STORE_CREDENTIALS;
+          else process.env.SNAPCRAFT_STORE_CREDENTIALS = saved;
+        }
+      },
+    },
+    {
+      name: 'baseConfig: snap enabled in config but no creds — auto-skipped',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const saved = process.env.SNAPCRAFT_STORE_CREDENTIALS;
+        delete process.env.SNAPCRAFT_STORE_CREDENTIALS;
+        try {
+          const out = baseConfig({ platforms: { linux: { snap: { enabled: true } } } });
+          ctx.expect(out.linux.target.find((t) => t.target === 'snap')).toBeUndefined();
+          ctx.expect(out.snap).toBeUndefined();
+        } finally {
+          if (saved !== undefined) process.env.SNAPCRAFT_STORE_CREDENTIALS = saved;
+        }
+      },
+    },
+    {
+      name: 'baseConfig: snap explicitly disabled — no snap target regardless of creds',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const saved = process.env.SNAPCRAFT_STORE_CREDENTIALS;
+        process.env.SNAPCRAFT_STORE_CREDENTIALS = 'fake-creds-blob';
+        try {
+          const out = baseConfig({ platforms: { linux: { snap: { enabled: false } } } });
+          ctx.expect(out.linux.target.find((t) => t.target === 'snap')).toBeUndefined();
+          ctx.expect(out.snap).toBeUndefined();
+        } finally {
+          if (saved === undefined) delete process.env.SNAPCRAFT_STORE_CREDENTIALS;
+          else process.env.SNAPCRAFT_STORE_CREDENTIALS = saved;
+        }
+      },
+    },
+    {
+      name: 'baseConfig: snap enabled + creds present emits snap target + snap publish block',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const saved = process.env.SNAPCRAFT_STORE_CREDENTIALS;
+        process.env.SNAPCRAFT_STORE_CREDENTIALS = 'fake-creds-blob';
+        try {
+          const out = baseConfig({ platforms: { linux: { snap: { enabled: true } } } });
+          ctx.expect(out.linux.target.find((t) => t.target === 'snap')).toBeDefined();
+          ctx.expect(out.snap).toBeDefined();
+          ctx.expect(out.snap.confinement).toBe('strict');
+          ctx.expect(out.snap.publish.provider).toBe('snapStore');
+          ctx.expect(out.snap.publish.channels).toEqual(['stable']);
+        } finally {
+          if (saved === undefined) delete process.env.SNAPCRAFT_STORE_CREDENTIALS;
+          else process.env.SNAPCRAFT_STORE_CREDENTIALS = saved;
+        }
+      },
+    },
+    {
+      name: 'baseConfig: platforms.<plat>.arch overrides apply per-platform',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({
+          platforms: {
+            mac:   { arch: ['arm64'] },
+            win:   { arch: ['x64'] },
+            linux: { arch: ['arm64'] },
+          },
+        });
+        ctx.expect(out.mac.target[0].arch).toEqual(['arm64']);
+        ctx.expect(out.win.target[0].arch).toEqual(['x64']);
+        ctx.expect(out.linux.target[0].arch).toEqual(['arm64']);
+      },
+    },
+    {
+      name: 'baseConfig: app.languages applied as mac.electronLanguages',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({ app: { languages: ['en', 'es', 'fr'] } });
+        ctx.expect(out.mac.electronLanguages).toEqual(['en', 'es', 'fr']);
+      },
+    },
+    {
+      name: 'baseConfig: app.darkModeSupport defaults to true; can be disabled',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        ctx.expect(baseConfig({}).mac.darkModeSupport).toBe(true);
+        ctx.expect(baseConfig({ app: { darkModeSupport: false } }).mac.darkModeSupport).toBe(false);
+      },
+    },
+    {
+      name: 'baseConfig: fileAssociations + protocols passthrough when set',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({
+          fileAssociations: [{ name: 'Foo', ext: 'foo' }],
+          protocols:        [{ name: 'CustomScheme', schemes: ['custom'] }],
+        });
+        ctx.expect(out.fileAssociations).toEqual([{ name: 'Foo', ext: 'foo' }]);
+        ctx.expect(out.protocols).toEqual([{ name: 'CustomScheme', schemes: ['custom'] }]);
+      },
+    },
+    {
+      name: 'publishConfig: the auto-update feed is the config\'s releases repo, never the git remote (#799)',
+      run: (ctx) => {
+        const { publishConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+
+        // A brand nested in another repo (the playground inside this monorepo)
+        // resolves to its OWN releases repo: the git remote here is the
+        // framework monorepo, and a feed baked from it would 404 forever.
+        ctx.expect(publishConfig({
+          brand: { id: 'omega-playground' },
+          repo: { providers: { github: { org: 'Omega-JS-Stack' } } },
+          releases: {},
+        })).toEqual({
+          provider:    'github',
+          owner:       'Omega-JS-Stack',
+          repo:        'omega-playground-releases',
+          releaseType: 'release',
+        });
+
+        // An explicit block still names its own repo.
+        ctx.expect(publishConfig({
+          brand: { id: 'acme' },
+          repo: { providers: { github: { org: 'Acme-Org' } } },
+          releases: { owner: 'Acme-Binaries', repo: 'acme-bins' },
+        }).repo).toBe('acme-bins');
+      },
+    },
+    {
+      name: 'publishConfig: releases.enabled false publishes nowhere, and an unaddressable repo emits no block',
+      run: (ctx) => {
+        const { publishConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+
+        ctx.expect(publishConfig({
+          brand: { id: 'acme' },
+          repo: { providers: { github: { org: 'Acme-Org' } } },
+          releases: { enabled: false },
+        })).toBe(null);
+
+        // No owner anywhere: half an address addresses nothing.
+        ctx.expect(publishConfig({ brand: { id: 'acme' }, releases: {} })).toBe(null);
+      },
+    },
+    {
+      name: 'baseConfig: empty fileAssociations + protocols arrays NOT emitted',
+      run: (ctx) => {
+        const { baseConfig } = require(path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'build-config.js'));
+        const out = baseConfig({});
+        ctx.expect(out.fileAssociations).toBeUndefined();
+        ctx.expect(out.protocols).toBeUndefined();
+      },
+    },
+  ],
+});

package/dist/test/suites/build/build-verbs.test.js

@@ -0,0 +1,156 @@
+// Build-layer tests for the canonical build verbs (build / package / publish).
+// The synced projectScripts are thin `omega <verb>` aliases, so each verb must
+// run the pipeline ITSELF — clean, certs, gulp task — and never shell back to
+// `npm run build` / `npm run publish` (that would recurse forever).
+//
+// There is no `setup` step (#675): the local scaffold runs inside the gulp
+// `defaults` task. `certs` delivers the Apple signing artifacts (#678).
+
+const path = require('path');
+const fs   = require('fs');
+
+const commandsDir = path.join(__dirname, '..', '..', '..', 'commands');
+const pipeline    = require(path.join(__dirname, '..', '..', '..', 'utils', 'build-pipeline.js'));
+
+const build   = require(path.join(commandsDir, 'build.js'));
+const pkg     = require(path.join(commandsDir, 'package.js'));
+const publish = require(path.join(commandsDir, 'publish.js'));
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+// Record the steps a plan runs, in order, without executing anything real.
+// The step implementations (clean/setup/validate-certs/gulp) are the seam the
+// pipeline already takes as an argument — nothing is faked, we just hand it a
+// recorder instead of the real runners (a real gulp package build has no place
+// in a unit test).
+function recorder(log) {
+  const record = (type) => (options, step) => { log.push(step.task ? `${type}:${step.task}` : type); };
+  return {
+    clean: record('clean'),
+    certs: record('certs'),
+    'validate-certs': record('validate-certs'),
+    gulp: record('gulp'),
+  };
+}
+
+async function withEnv(run) {
+  const keys = ['OMEGA_BUILD_MODE', 'OMEGA_IS_PUBLISH'];
+  const previous = keys.map((key) => [key, process.env[key]]);
+  keys.forEach((key) => delete process.env[key]);
+  try {
+    return await run();
+  } finally {
+    previous.forEach(([key, value]) => {
+      if (value === undefined) delete process.env[key]; else process.env[key] = value;
+    });
+  }
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'build verbs — the CLI owns the pipeline and its env flags',
+  tests: [
+    {
+      name: 'build: OMEGA_BUILD_MODE + clean → certs → gulp build',
+      run: (ctx) => {
+        const plan = build.plan({});
+        ctx.expect(plan.env.OMEGA_BUILD_MODE).toBe('true');
+        ctx.expect(plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type)))
+          .toEqual(['clean', 'certs', 'gulp:build']);
+      },
+    },
+    {
+      name: 'package: OMEGA_BUILD_MODE + clean → certs → gulp packageBuild',
+      run: (ctx) => {
+        const plan = pkg.plan({});
+        ctx.expect(plan.env.OMEGA_BUILD_MODE).toBe('true');
+        ctx.expect(plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type)))
+          .toEqual(['clean', 'certs', 'gulp:packageBuild']);
+      },
+    },
+    {
+      name: 'package --quick: same steps, gulp packageQuick',
+      run: (ctx) => {
+        const plan = pkg.plan({ quick: true });
+        ctx.expect(plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type)))
+          .toEqual(['clean', 'certs', 'gulp:packageQuick']);
+        ctx.expect(pkg.plan({ q: true }).steps[2].task).toBe('packageQuick');
+      },
+    },
+    {
+      name: 'publish: both flags + certs → validate-certs → gulp publish (no clean)',
+      run: (ctx) => {
+        const plan = publish.plan({});
+        ctx.expect(plan.env.OMEGA_BUILD_MODE).toBe('true');
+        ctx.expect(plan.env.OMEGA_IS_PUBLISH).toBe('true');
+        ctx.expect(plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type)))
+          .toEqual(['certs', 'validate-certs', 'gulp:publish']);
+      },
+    },
+    {
+      name: 'publish --local: clean → certs → validate-certs → gulp publish',
+      run: (ctx) => {
+        const plan = publish.plan({ local: true });
+        ctx.expect(plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type)))
+          .toEqual(['clean', 'certs', 'validate-certs', 'gulp:publish']);
+      },
+    },
+    {
+      name: 'runPipeline sets the env flags and runs the steps in order',
+      run: async (ctx) => {
+        const log = [];
+        await withEnv(async () => {
+          await pipeline.runPipeline(publish.plan({ local: true }), {}, recorder(log));
+          ctx.expect(process.env.OMEGA_BUILD_MODE).toBe('true');
+          ctx.expect(process.env.OMEGA_IS_PUBLISH).toBe('true');
+        });
+        ctx.expect(log).toEqual(['clean', 'certs', 'validate-certs', 'gulp:publish']);
+      },
+    },
+    {
+      name: 'gulp steps shell `npm run gulp -- <task>` (the one script with no alias to recurse through)',
+      run: (ctx) => {
+        ctx.expect(pipeline.gulpCommand('packageQuick')).toBe('npm run gulp -- packageQuick');
+      },
+    },
+    {
+      name: 'no verb shells back to `npm run build` / `npm run package` / `npm run publish`',
+      run: (ctx) => {
+        const files = [
+          path.join(commandsDir, 'build.js'),
+          path.join(commandsDir, 'package.js'),
+          path.join(commandsDir, 'publish.js'),
+          // The pipeline owns the one execute() call — a recursive shell-out
+          // reintroduced HERE would pass a commands-only scan.
+          path.join(__dirname, '..', '..', '..', 'utils', 'build-pipeline.js'),
+        ];
+        for (const file of files) {
+          // Comments may NAME the forbidden commands (the pipeline header
+          // documents the recursion rule) — the guard polices code only.
+          const source = fs.readFileSync(file, 'utf8')
+            .replace(/\/\/[^\n]*/g, '')
+            .replace(/\/\*[\s\S]*?\*\//g, '');
+          ctx.expect(/npm run (build|package|publish)/.test(source)).toBe(false);
+        }
+      },
+    },
+    {
+      name: 'every plan step type has a runner in the RUNNERS table',
+      run: (ctx) => {
+        const plans = [
+          build.plan({}),
+          pkg.plan({}),
+          pkg.plan({ quick: true }),
+          publish.plan({}),
+          publish.plan({ local: true }),
+        ];
+        const known = Object.keys(pipeline.RUNNERS);
+        for (const plan of plans) {
+          for (const step of plan.steps) {
+            ctx.expect(known.includes(step.type)).toBe(true);
+          }
+        }
+      },
+    },
+  ],
+});

package/dist/test/suites/build/build-workflow-jobs.test.js

@@ -0,0 +1,55 @@
+// The release workflow's job graph
+// ([#802](https://github.com/Omega-JS-Stack/omega/issues/802)).
+//
+// The workflow runs NO tests. Ian's ruling (2026-09-07): tests run on the
+// developer's machine and the commit gate runs the battery at ship, so CI is
+// dispatch-only and BUILDS, which is what web's and the extension's release
+// workflows already do. Desktop's Test job was the leftover (first ahead of
+// Build, then beside it); it is gone, and so is every `needs` on it.
+//
+// The scaffolded copy is what a consumer's CI executes, so the graph is read
+// off a real `copyDefaults` render rather than off the template's tokens.
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const jetpack = require('fs-jetpack');
+const yaml = require('js-yaml');
+
+const { copyDefaults } = require('../../../commands/lib/ensure-target.js');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+// GitHub takes `needs` as a string or as a list; the graph question is the same.
+const needsOf = (job) => [].concat(job.needs || []);
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'release workflow job graph (#802): a build-only workflow, no test job',
+  tests: [
+    {
+      name: 'there is no Test job, and nothing waits on one',
+      run: async (ctx) => {
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-workflow-jobs-'));
+        await copyDefaults(tmp);
+        const { jobs } = yaml.load(jetpack.read(path.join(tmp, '.github', 'workflows', 'build.yml')));
+
+        ctx.expect(Object.keys(jobs)).not.toContain('test');
+        for (const job of Object.values(jobs)) {
+          ctx.expect(needsOf(job)).not.toContain('test');
+        }
+
+        ctx.expect(needsOf(jobs.build)).toEqual(['setup']);
+        ctx.expect(needsOf(jobs.finalize)).toEqual(['setup', 'build', 'windows-sign']);
+        // finalize runs under `always()`, so a job that FAILED or was skipped
+        // still reaches its `if`: the gate has to name the result it wants.
+        ctx.expect(jobs.finalize.if).not.toContain('needs.test.result');
+        ctx.expect(jobs.finalize.if).toContain("needs.build.result == 'success'");
+
+        // Signing still hangs off the artifact Build uploads, nothing else.
+        ctx.expect(needsOf(jobs['windows-sign'])).toContain('build');
+        ctx.expect(needsOf(jobs['windows-strategy'])).toContain('build');
+      },
+    },
+  ],
+});