@omega.js/desktop 0.50.0 → 0.51.0

package/dist/test/suites/build/notarize-artifacts.test.js

@@ -0,0 +1,135 @@
+// The DMG hook: artifactBuildCompleted notarizes, staples and PROVES each disk
+// image BEFORE electron-builder uploads it
+// ([#891](https://github.com/Omega-JS-Stack/omega/issues/891)).
+//
+// The ticket the afterSign hook staples to the .app rides INSIDE the image, so
+// a downloaded .dmg is assessed on its own and an unstapled one is refused on an
+// offline Mac. And the hook has to run per artifact: `afterAllArtifactBuild`
+// fires after every upload is queued, so run 34738410986 published a signed
+// and notarized image that carried no staple. Offline by construction here:
+// `xcrun` and `spctl` are a fake runner injected through the hook's own option,
+// never a global.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const notarizeArtifacts = require(path.join(__dirname, '..', '..', '..', 'hooks', 'notarize-artifacts.js'));
+
+const ACCEPTED = {
+  'notarytool submit': '  status: Accepted\n  message: Successfully received submission info',
+  'stapler staple': 'The staple and validate action worked!',
+  'stapler validate': 'The validate action worked!',
+  'spctl --assess': '/tmp/App.dmg: accepted\nsource=Notarized Developer ID',
+};
+
+function fakeTools(overrides = {}) {
+  const commands = [];
+  const answers = { ...ACCEPTED, ...overrides };
+
+  const run = async (command) => {
+    commands.push(command);
+    const key = Object.keys(answers).find((needle) => command.includes(needle));
+    const answer = key ? answers[key] : '';
+    if (answer instanceof Error) throw answer;
+    return answer;
+  };
+
+  return { run, commands };
+}
+
+// The credentials the hook needs, restored after each case.
+function withCredentials(body) {
+  const prior = {
+    APPLE_API_KEY: process.env.APPLE_API_KEY,
+    APPLE_API_KEY_ID: process.env.APPLE_API_KEY_ID,
+    APPLE_API_ISSUER: process.env.APPLE_API_ISSUER,
+  };
+  const keyFile = path.join(os.tmpdir(), 'AuthKey_ARTIFACTS_TEST.p8');
+  fs.writeFileSync(keyFile, 'fixture-key');
+  process.env.APPLE_API_KEY = keyFile;
+  process.env.APPLE_API_KEY_ID = 'TESTKEYID1';
+  process.env.APPLE_API_ISSUER = 'issuer-uuid';
+
+  const restore = () => {
+    fs.rmSync(keyFile, { force: true });
+    for (const [name, value] of Object.entries(prior)) {
+      if (value) process.env[name] = value;
+      else delete process.env[name];
+    }
+  };
+
+  return Promise.resolve(body(keyFile)).finally(restore);
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'notarize-artifacts: every DMG is notarized, stapled and proved before its upload (#891)',
+  tests: [
+    {
+      name: 'a .dmg artifact is submitted, stapled, validated and assessed; other artifacts are ignored',
+      run: (ctx) => withCredentials(async (keyFile) => {
+        const { run, commands } = fakeTools();
+
+        // electron-builder calls the hook once per artifact, with that
+        // artifact's `file`, before it queues the upload.
+        for (const file of ['/tmp/App-1.0.0.dmg', '/tmp/App-1.0.0-mac.zip', '/tmp/latest-mac.yml']) {
+          await notarizeArtifacts({ file }, { run });
+        }
+
+        ctx.expect(commands.length).toBe(4);
+        ctx.expect(commands[0]).toContain('xcrun notarytool submit "/tmp/App-1.0.0.dmg"');
+        ctx.expect(commands[0]).toContain(`--key "${keyFile}" --key-id "TESTKEYID1" --issuer "issuer-uuid" --wait`);
+        ctx.expect(commands[1]).toContain('xcrun stapler staple "/tmp/App-1.0.0.dmg"');
+        ctx.expect(commands[2]).toContain('xcrun stapler validate "/tmp/App-1.0.0.dmg"');
+        ctx.expect(commands[3]).toContain('spctl --assess --type open --context context:primary-signature -vv "/tmp/App-1.0.0.dmg"');
+        // The .zip and the update feed are never submitted
+        ctx.expect(commands.some((command) => command.includes('.zip') || command.includes('.yml'))).toBe(false);
+      }),
+    },
+    {
+      name: 'a non-DMG artifact is a no-op: the linux and windows legs never reach a tool',
+      run: async (ctx) => {
+        const { run, commands } = fakeTools();
+
+        await notarizeArtifacts({ file: '/tmp/App.AppImage' }, { run });
+        await notarizeArtifacts({ file: '/tmp/App.exe' }, { run });
+        ctx.expect(commands).toEqual([]);
+      },
+    },
+    {
+      name: 'a rejected submission throws, so the artifact is never uploaded',
+      run: (ctx) => withCredentials(async () => {
+        const invalid = fakeTools({ 'notarytool submit': '  status: Invalid\n  message: Package Invalid' });
+        await ctx.expect(() => notarizeArtifacts({ file: '/tmp/App.dmg' }, { run: invalid.run }))
+          .toThrow(/notarization of \/tmp\/App\.dmg was not accepted/);
+        // Nothing was stapled onto an artifact Apple refused
+        ctx.expect(invalid.commands.length).toBe(1);
+
+        const refused = fakeTools({ 'spctl --assess': new Error('/tmp/App.dmg: rejected') });
+        await ctx.expect(() => notarizeArtifacts({ file: '/tmp/App.dmg' }, { run: refused.run }))
+          .toThrow(/Gatekeeper refused/);
+      }),
+    },
+    {
+      name: 'a DMG with no APPLE_* credentials throws instead of shipping unnotarized',
+      run: async (ctx) => {
+        const prior = { key: process.env.APPLE_API_KEY, id: process.env.APPLE_API_KEY_ID, issuer: process.env.APPLE_API_ISSUER };
+        delete process.env.APPLE_API_KEY;
+        delete process.env.APPLE_API_KEY_ID;
+        delete process.env.APPLE_API_ISSUER;
+
+        try {
+          const { run } = fakeTools();
+          await ctx.expect(() => notarizeArtifacts({ file: '/tmp/App.dmg' }, { run })).toThrow(/APPLE_API_KEY/);
+        } finally {
+          if (prior.key) process.env.APPLE_API_KEY = prior.key;
+          if (prior.id) process.env.APPLE_API_KEY_ID = prior.id;
+          if (prior.issuer) process.env.APPLE_API_ISSUER = prior.issuer;
+        }
+      },
+    },
+  ],
+});

package/dist/test/suites/build/notarize-tools.test.js

@@ -0,0 +1,38 @@
+// The notarization tools' command runner
+// ([#891](https://github.com/Omega-JS-Stack/omega/issues/891)).
+//
+// notarytool, stapler and spctl write their verdict to the console and exit
+// non-zero when they refuse, so the runner must hand back what they SAID no
+// matter how they exited. Run 34735658588's DMG assessment failed with only
+// `Command failed with exit code 3`: the verdict itself was lost.
+
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const { report, toolRunner } = require(path.join(__dirname, '..', '..', '..', 'hooks', 'lib', 'notarize-tools.js'));
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'notarize-tools: the runner reports a refusing tool\'s own words (#891)',
+  tests: [
+    {
+      name: 'a command that exits non-zero still reports its stdout and stderr',
+      run: async (ctx) => {
+        const output = await report(toolRunner(), 'echo "App.dmg: rejected"; echo "source=Insufficient Context" 1>&2; exit 3');
+
+        ctx.expect(output).toContain('App.dmg: rejected');
+        ctx.expect(output).toContain('source=Insufficient Context');
+      },
+    },
+    {
+      name: 'a command that exits zero reports its output the same way',
+      run: async (ctx) => {
+        const output = await report(toolRunner(), 'echo "App.dmg: accepted"; echo "source=Notarized Developer ID" 1>&2');
+
+        ctx.expect(output).toContain('App.dmg: accepted');
+        ctx.expect(output).toContain('source=Notarized Developer ID');
+      },
+    },
+  ],
+});

package/dist/test/suites/build/notarize.test.js

@@ -0,0 +1,207 @@
+// The notarize hook's Developer ID gate
+// ([#872](https://github.com/Omega-JS-Stack/omega/issues/872)).
+//
+// electron-builder SKIPS mac code signing when it finds no identity ("cannot find
+// valid Developer ID Application identity ... 0 identities found") and ships the
+// ad-hoc signature the linker left. The hook then notarized it anyway, because
+// APPLE_API_KEY was set, and notarytool rejected the submission: "Failed to
+// codesign your application with code: 1" ended the whole mac leg of a build that
+// had otherwise succeeded.
+//
+// The seam is codesign's OWN report: a pure predicate over its text, plus an
+// injectable exec for reading it. Both fixtures below are the verbatim output of
+// run 34584322778 and of a signed build.
+
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const notarizeHook = require(path.join(__dirname, '..', '..', '..', 'hooks', 'notarize.js'));
+const { isDeveloperIdSigned, readCodesign } = notarizeHook;
+const { stapleAndProve } = require(path.join(__dirname, '..', '..', '..', 'hooks', 'lib', 'notarize-tools.js'));
+
+// What the real tools print when they are happy. A fake `run` answers by
+// command, so the SEQUENCE and the refusal are both provable offline.
+const TOOL_OUTPUT = {
+  'stapler staple': 'Processing: /tmp/App.app\nThe staple and validate action worked!',
+  'stapler validate': 'Processing: /tmp/App.app\nThe validate action worked!',
+  'spctl --assess': '/tmp/App.app: accepted\nsource=Notarized Developer ID',
+  'notarytool submit': '  status: Accepted\n  message: Successfully received submission info',
+};
+
+function fakeTools(overrides = {}) {
+  const commands = [];
+  const answers = { ...TOOL_OUTPUT, ...overrides };
+
+  const run = async (command) => {
+    commands.push(command);
+    const key = Object.keys(answers).find((needle) => command.includes(needle));
+    const answer = key ? answers[key] : '';
+    if (answer instanceof Error) throw answer;
+    return answer;
+  };
+
+  return { run, commands };
+}
+
+// What the runner's own `codesign -dv --verbose=2` printed for the unsigned app.
+const ADHOC = `Executable=/Users/runner/work/playground-omega/targets/desktop/release/mac-universal/OMEGA Playground.app/Contents/MacOS/OMEGA Playground
+Identifier=Electron
+Format=app bundle with Mach-O universal (x86_64 arm64)
+CodeDirectory v=20400 size=392 flags=0x20002(adhoc,linker-signed) hashes=9+0 location=embedded
+Signature=adhoc
+Info.plist=not bound
+TeamIdentifier=not set
+Sealed Resources=none`;
+
+// The same report for a build that DID find the identity.
+const SIGNED = `Executable=/Users/runner/work/app/release/mac-universal/App.app/Contents/MacOS/App
+Identifier=dev.omegajs.app
+Format=app bundle with Mach-O universal (x86_64 arm64)
+CodeDirectory v=20500 size=1234 flags=0x10000(runtime) hashes=30+7 location=embedded
+Signature size=9000
+Authority=Developer ID Application: ITW Creative Works (ABCDE12345)
+Authority=Developer ID Certification Authority
+Authority=Apple Root CA
+TeamIdentifier=ABCDE12345
+Sealed Resources version=2 rules=13 files=40`;
+
+// An app with no signature at all: codesign exits NON-ZERO and says so.
+const UNSIGNED_ERROR = 'OMEGA Playground.app: code object is not signed at all';
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'notarize: only a Developer ID signed app is submitted (#872), and the staple is PROVED (#891)',
+  tests: [
+    {
+      name: 'an ad-hoc signature is not a Developer ID signature',
+      run: (ctx) => {
+        ctx.expect(isDeveloperIdSigned(ADHOC)).toBe(false);
+        ctx.expect(isDeveloperIdSigned(UNSIGNED_ERROR)).toBe(false);
+        ctx.expect(isDeveloperIdSigned('')).toBe(false);
+        ctx.expect(isDeveloperIdSigned(undefined)).toBe(false);
+      },
+    },
+    {
+      name: 'a Developer ID Application authority is',
+      run: (ctx) => {
+        ctx.expect(isDeveloperIdSigned(SIGNED)).toBe(true);
+
+        // A signature from some OTHER authority cannot be notarized either.
+        ctx.expect(isDeveloperIdSigned(SIGNED.replace('Authority=Developer ID Application:', 'Authority=Apple Development:'))).toBe(false);
+      },
+    },
+    {
+      name: 'the report is read with stderr folded in, and a failing codesign is the answer',
+      run: async (ctx) => {
+        const commands = [];
+        const report = await readCodesign('/tmp/App.app', (cmd) => {
+          commands.push(cmd);
+          return Promise.resolve(SIGNED);
+        });
+
+        // codesign writes its report to STDERR and exits 0, so a plain stdout
+        // read comes back EMPTY and every app would look unsigned.
+        ctx.expect(commands[0]).toContain('2>&1');
+        ctx.expect(commands[0]).toContain('/tmp/App.app');
+        ctx.expect(isDeveloperIdSigned(report)).toBe(true);
+
+        // An unsigned app exits non-zero; the report rides in the rejection.
+        const failed = await readCodesign('/tmp/App.app', () => Promise.reject(new Error(UNSIGNED_ERROR)));
+        ctx.expect(failed).toContain('not signed at all');
+        ctx.expect(isDeveloperIdSigned(failed)).toBe(false);
+      },
+    },
+    // ── The staple and its PROOF (#891) ─────────────────────────────────────
+    // Proof run one published an app no other Mac would open. Notarizing is
+    // half the job: the ticket has to be stapled, and the staple has to be
+    // read back, or an offline Mac still refuses.
+    {
+      name: 'stapling runs staple → validate → spctl, in that order, on the .app',
+      run: async (ctx) => {
+        const { run, commands } = fakeTools();
+
+        await stapleAndProve({ filePath: '/tmp/App.app', kind: 'app', run });
+
+        ctx.expect(commands.length).toBe(3);
+        ctx.expect(commands[0]).toContain('xcrun stapler staple "/tmp/App.app"');
+        ctx.expect(commands[1]).toContain('xcrun stapler validate "/tmp/App.app"');
+        ctx.expect(commands[2]).toContain('spctl --assess --type execute -vv "/tmp/App.app"');
+        // The verdict these tools write to stderr is the RUNNER's to capture
+        // (notarize-tools.test.js), never a shell fold on the command.
+      },
+    },
+    {
+      name: 'a DMG is assessed as an OPENED image against its own signature',
+      run: async (ctx) => {
+        const { run, commands } = fakeTools({ 'spctl --assess': '/tmp/App.dmg: accepted\nsource=Notarized Developer ID' });
+
+        await stapleAndProve({ filePath: '/tmp/App.dmg', kind: 'dmg', run });
+
+        ctx.expect(commands[2]).toContain('spctl --assess --type open --context context:primary-signature -vv "/tmp/App.dmg"');
+      },
+    },
+    {
+      name: 'a REJECTED assessment throws: the release step never runs',
+      run: async (ctx) => {
+        // spctl exits non-zero and says so on stderr
+        const rejected = fakeTools({ 'spctl --assess': new Error('/tmp/App.app: rejected\nsource=no usable signature') });
+        await ctx.expect(() => stapleAndProve({ filePath: '/tmp/App.app', kind: 'app', run: rejected.run })).toThrow(/Gatekeeper refused/);
+
+        // ...and so does a staple that never took, or a ticket that does not read back
+        const unstapled = fakeTools({ 'stapler staple': new Error('The staple and validate action failed! Error 65.') });
+        await ctx.expect(() => stapleAndProve({ filePath: '/tmp/App.app', kind: 'app', run: unstapled.run })).toThrow(/could not staple/);
+
+        const unreadable = fakeTools({ 'stapler validate': new Error('The validate action failed! Error 65.') });
+        await ctx.expect(() => stapleAndProve({ filePath: '/tmp/App.app', kind: 'app', run: unreadable.run })).toThrow(/carries no valid notarization ticket/);
+      },
+    },
+    // ── The hook's own refusals (#891) ──────────────────────────────────────
+    // Both of these used to be `logger.warn` + `return`, and BOTH of them were
+    // hit on the run that shipped an unsigned app.
+    {
+      name: 'a mac build with no APPLE_* credentials THROWS instead of skipping',
+      run: async (ctx) => {
+        const prior = { key: process.env.APPLE_API_KEY, id: process.env.APPLE_API_KEY_ID, issuer: process.env.APPLE_API_ISSUER };
+        delete process.env.APPLE_API_KEY;
+        delete process.env.APPLE_API_KEY_ID;
+        delete process.env.APPLE_API_ISSUER;
+
+        try {
+          await ctx.expect(() => notarizeHook({ electronPlatformName: 'darwin', appOutDir: '/tmp' })).toThrow(/APPLE_API_KEY/);
+          // A non-mac leg is still the ONE legitimate skip
+          ctx.expect(await notarizeHook({ electronPlatformName: 'win32', appOutDir: '/tmp' })).toBe(undefined);
+        } finally {
+          if (prior.key) process.env.APPLE_API_KEY = prior.key;
+          if (prior.id) process.env.APPLE_API_KEY_ID = prior.id;
+          if (prior.issuer) process.env.APPLE_API_ISSUER = prior.issuer;
+        }
+      },
+    },
+    {
+      name: 'an ad-hoc signed .app THROWS instead of publishing unnotarized',
+      run: async (ctx) => {
+        const prior = { key: process.env.APPLE_API_KEY, id: process.env.APPLE_API_KEY_ID, issuer: process.env.APPLE_API_ISSUER };
+        const keyFile = path.join(require('os').tmpdir(), `AuthKey_NOTARIZE_TEST.p8`);
+        require('fs').writeFileSync(keyFile, 'fixture-key');
+        process.env.APPLE_API_KEY = keyFile;
+        process.env.APPLE_API_KEY_ID = 'TESTKEYID1';
+        process.env.APPLE_API_ISSUER = 'issuer-uuid';
+
+        try {
+          const { run } = fakeTools({ 'codesign -dv': ADHOC });
+          await ctx.expect(() => notarizeHook(
+            { electronPlatformName: 'darwin', appOutDir: '/tmp', packager: { appInfo: { productFilename: 'App' } } },
+            { run },
+          )).toThrow(/is NOT Developer ID signed/);
+        } finally {
+          require('fs').rmSync(keyFile, { force: true });
+          for (const [name, value] of [['APPLE_API_KEY', prior.key], ['APPLE_API_KEY_ID', prior.id], ['APPLE_API_ISSUER', prior.issuer]]) {
+            if (value) process.env[name] = value;
+            else delete process.env[name];
+          }
+        }
+      },
+    },
+  ],
+});

package/dist/test/suites/build/release-pipeline.test.js

@@ -8,7 +8,7 @@ const os      = require('os');
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
 
 // Helper: stage a consumer dir with config/omega.json5 containing the given
-// platforms.win.signing.strategy (under targets.desktop in the raw file). Returns the
+// platforms.windows.signing.strategy (under targets.desktop in the raw file). Returns the
 // abs path to the temp dir; caller is responsible for chdir'ing into it and cleaning up.
 function stageStrategyConfig({ strategy, cloudProvider }) {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-sign-'));
@@ -17,7 +17,7 @@ function stageStrategyConfig({ strategy, cloudProvider }) {
   if (cloudProvider) signing.cloud = { provider: cloudProvider };
   fs.writeFileSync(
     path.join(tmp, 'config', 'omega.json5'),
-    JSON.stringify({ targets: { desktop: { platforms: { win: { signing } } } } }),
+    JSON.stringify({ targets: { desktop: { type: 'desktop', platforms: { windows: { signing } } } } }),
   );
   return tmp;
 }
@@ -39,74 +39,51 @@ module.exports = defineCases({
   layer: 'build',
   description: 'release pipeline — package / release / sign-windows / notarize hook',
   tests: [
-    {
-      name: 'release: the dispatch address is the CONFIG\'s brand repo and the COMPOSED workflow name (#799)',
-      run: (ctx) => {
-        const { dispatchTarget } = require(path.join(__dirname, '..', '..', '..', 'commands', 'release.js'));
-        const { brandRoot, targetDir } = stageBrand({ brand: { id: 'acme' }, repo: { providers: { github: { org: 'Acme-Org' } } } });
 
-        try {
-          // A target nested in a brand (and the brand nested in another repo, as
-          // the playground is here) dispatches on the repo its CONFIG names: the
-          // enclosing git remote is somebody else's repo entirely.
-          // The name is the derived `<brand.id>-omega` default (#809): the config
-          // declares an org and no repo of its own.
-          ctx.expect(dispatchTarget({
-            projectRoot: targetDir,
-            config: { brand: { id: 'acme' }, repo: { providers: { github: { org: 'Acme-Org' } } } },
-          })).toEqual({ owner: 'Acme-Org', repo: 'acme-omega', workflow: 'desktop-build.yml' });
-        } finally {
-          fs.rmSync(brandRoot, { recursive: true, force: true });
-        }
-      },
-    },
     {
-      name: 'release: a STANDALONE target dispatches the plain build.yml, and an unaddressable repo throws',
-      run: (ctx) => {
-        const { dispatchTarget } = require(path.join(__dirname, '..', '..', '..', 'commands', 'release.js'));
-        const standalone = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-standalone-'));
+      name: 'deploy-precheck: provisions <org>/<brand.id>-releases PUBLIC through the devkit ensureRepo (#799, #883)',
+      run: async (ctx) => {
+        const { provisionReleaseRepos } = require(path.join(__dirname, '..', '..', '..', 'commands', 'lib', 'deploy-precheck.js'));
+        const calls = [];
+        const lines = [];
 
-        try {
-          const config = { brand: { id: 'acme' }, repo: { providers: { github: { org: 'Acme-Org', repo: 'itw-creative-works/acme-app' } } } };
-          ctx.expect(dispatchTarget({ projectRoot: standalone, config })).toEqual({
-            owner: 'itw-creative-works', repo: 'acme-app', workflow: 'build.yml',
-          });
+        await provisionReleaseRepos({
+          log: (line) => lines.push(line),
+          warn: (line) => lines.push(line),
+          config: { brand: { id: 'omega-playground' }, repo: { provider: 'github', org: 'Omega-JS-Stack' }, releases: {} },
+          // The ONE github boundary (#883): `gh` with an argv array, so the
+          // create is readable here exactly as it runs.
+          execFn: (file, args) => {
+            calls.push({ file, args });
+            if (args[0] === 'api') throw new Error('gh api failed: 404 Not Found');
+            return '';
+          },
+        });
 
-          // Half an address addresses nothing: fail loudly instead of POSTing to
-          // `undefined/acme`.
-          ctx.expect(() => dispatchTarget({ projectRoot: standalone, config: { brand: { id: 'acme' } } }))
-            .toThrow(/brand repo/);
-        } finally {
-          fs.rmSync(standalone, { recursive: true, force: true });
-        }
+        const create = calls.find((call) => call.args[0] === 'repo');
+        ctx.expect(create.file).toBe('gh');
+        ctx.expect(create.args.slice(0, 4)).toEqual(['repo', 'create', 'Omega-JS-Stack/omega-playground-releases', '--public']);
+        // A release needs a tag and a tag needs a commit: this is the one repo
+        // that is created WITH one.
+        ctx.expect(create.args).toContain('--add-readme');
+        ctx.expect(lines.join('\n')).toContain('Omega-JS-Stack/omega-playground-releases');
       },
     },
+
     {
-      name: 'deploy-precheck: provisions <owner>/<brand.id>-releases from config, never a discovered owner (#799)',
+      name: 'deploy-precheck: a config that names no org warns and creates nothing (#883)',
       run: async (ctx) => {
         const { provisionReleaseRepos } = require(path.join(__dirname, '..', '..', '..', 'commands', 'lib', 'deploy-precheck.js'));
-        const created = [];
-        const octokit = {
-          rest: {
-            repos: {
-              get: async () => { const error = new Error('Not Found'); error.status = 404; throw error; },
-              createInOrg: async (args) => created.push(`${args.org}/${args.name}`),
-              createForAuthenticatedUser: async (args) => created.push(`me/${args.name}`),
-            },
-            users: { getAuthenticated: async () => ({ data: { login: 'somebody-else' } }) },
-          },
-        };
         const lines = [];
 
         await provisionReleaseRepos({
           log: (line) => lines.push(line),
           warn: (line) => lines.push(line),
-          octokit,
-          config: { brand: { id: 'omega-playground' }, repo: { providers: { github: { org: 'Omega-JS-Stack' } } }, releases: {} },
+          config: { brand: { id: 'acme' }, releases: {} },
+          execFn: () => { throw new Error('gh must not run'); },
         });
 
-        ctx.expect(created).toEqual(['Omega-JS-Stack/omega-playground-releases']);
-        ctx.expect(lines.join('\n')).toContain('Omega-JS-Stack/omega-playground-releases');
+        ctx.expect(lines.join('\n')).toContain('repo.org');
       },
     },
     {
@@ -115,8 +92,8 @@ module.exports = defineCases({
         const finalizeRelease = require(path.join(__dirname, '..', '..', '..', 'commands', 'finalize-release.js'));
         const { brandRoot, targetDir } = stageBrand({
           brand: { id: 'acme' },
-          repo: { providers: { github: { org: 'Acme-Org' } } },
-          targets: { desktop: { releases: {} } },
+          repo: { provider: 'github', org: 'Acme-Org' },
+          targets: { desktop: { type: 'desktop', releases: {} } },
         });
         fs.writeFileSync(path.join(targetDir, 'package.json'), JSON.stringify({ name: 'acme-desktop', version: '1.2.3' }));
 
@@ -333,7 +310,9 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'notarize hook: warns + returns when API key env vars are missing',
+      // Flipped by #891: a mac build that reaches this hook is one this
+      // framework ships, so credentials it cannot find stop the build.
+      name: 'notarize hook: THROWS when the API key env vars are missing',
       run: async (ctx) => {
         const notarize = require(path.join(__dirname, '..', '..', '..', 'hooks', 'notarize.js'));
         // Snapshot + clear env.
@@ -347,12 +326,11 @@ module.exports = defineCases({
         delete process.env.APPLE_API_ISSUER;
 
         try {
-          const result = await notarize({
+          await ctx.expect(() => notarize({
             electronPlatformName: 'darwin',
             appOutDir: '/tmp',
             packager: { appInfo: { productFilename: 'test' } },
-          });
-          ctx.expect(result).toBeUndefined();
+          })).toThrow(/APPLE_API_KEY, APPLE_API_KEY_ID and APPLE_API_ISSUER are required/);
         } finally {
           for (const [k, v] of Object.entries(snapshot)) {
             if (v !== undefined) process.env[k] = v;

package/dist/test/suites/build/release-skipped-upload.test.js

@@ -0,0 +1,107 @@
+// The release task's verdict on a build that uploaded NOTHING
+// ([#891](https://github.com/Omega-JS-Stack/omega/issues/891)).
+//
+// electron-builder's `build()` promise resolves with the LOCAL artifact paths
+// whether or not a byte reached the publish provider, so every leg of run
+// 34729947722 printed `Released 4 artifact(s)` while electron-publish had
+// logged `skipped publishing` for each of them
+// (`reason=existing release published more than 2 hours ago tag=v0.0.1`). A
+// release that uploaded nothing is a failed release, and the only report of the
+// skip is electron-builder's own logger, so the task reads it there.
+
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const RELEASE_TASK = path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'release.js');
+
+// The fields electron-publish's gitHubPublisher carries on both warnings.
+const PUBLISH_FIELDS = { tag: 'v0.0.1', reason: 'existing release published more than 2 hours ago' };
+
+// A stand-in for builder-util's `log`: a Logger whose `warn(fields, message)`
+// takes the two shapes the real one does, recording what it was handed.
+function fakeBuilderLog() {
+  const seen = [];
+  return {
+    seen,
+    warn(messageOrFields, message) {
+      seen.push(message === undefined ? messageOrFields : message);
+    },
+  };
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'release task (#891): a skipped upload is a failed release, never a "Released N artifact(s)" line',
+  tests: [
+    {
+      name: 'every skipped publish is recorded off the build logger, with its reason and tag',
+      run: async (ctx) => {
+        const { recordSkippedPublishes } = require(RELEASE_TASK);
+        const log = fakeBuilderLog();
+        const original = log.warn;
+
+        const { result, skips } = await recordSkippedPublishes(log, async () => {
+          log.warn(PUBLISH_FIELDS, 'GitHub release not created');
+          log.warn({ file: 'App-0.0.1.dmg', ...PUBLISH_FIELDS }, 'skipped publishing');
+          log.warn({ file: 'App-0.0.1-mac.zip', ...PUBLISH_FIELDS }, 'skipped publishing');
+          log.warn('cannot compute hash of the pending file');
+          return ['/tmp/release/App-0.0.1.dmg', '/tmp/release/App-0.0.1-mac.zip'];
+        });
+
+        ctx.expect(result.length).toBe(2);
+        ctx.expect(skips.length).toBe(3);
+        ctx.expect(skips.map((skip) => skip.file).filter(Boolean)).toEqual(['App-0.0.1.dmg', 'App-0.0.1-mac.zip']);
+        ctx.expect(skips[0].reason).toBe(PUBLISH_FIELDS.reason);
+        ctx.expect(skips[0].tag).toBe('v0.0.1');
+
+        // The build's own logging still reaches the logger, and the wrapper is
+        // gone the moment the build settles.
+        ctx.expect(log.seen.length).toBe(4);
+        ctx.expect(log.warn).toBe(original);
+      },
+    },
+    {
+      name: 'the wrapper restores the logger even when the build throws',
+      run: async (ctx) => {
+        const { recordSkippedPublishes } = require(RELEASE_TASK);
+        const log = fakeBuilderLog();
+        const original = log.warn;
+
+        let thrown = null;
+        try {
+          await recordSkippedPublishes(log, async () => { throw new Error('electron-builder exploded'); });
+        } catch (error) {
+          thrown = error;
+        }
+
+        ctx.expect(thrown.message).toBe('electron-builder exploded');
+        ctx.expect(log.warn).toBe(original);
+      },
+    },
+    {
+      name: 'a recorded skip fails the release naming the reason, the tag and the fix',
+      run: (ctx) => {
+        const { skippedUploadError } = require(RELEASE_TASK);
+        const skips = [
+          { message: 'GitHub release not created', ...PUBLISH_FIELDS },
+          { message: 'skipped publishing', file: 'App-0.0.1.dmg', ...PUBLISH_FIELDS },
+        ];
+
+        const error = skippedUploadError(skips);
+        ctx.expect(error instanceof Error).toBe(true);
+        ctx.expect(error.message).toContain('existing release published more than 2 hours ago');
+        ctx.expect(error.message).toContain('v0.0.1');
+        ctx.expect(error.message).toContain('App-0.0.1.dmg');
+        ctx.expect(error.message).toContain('Bump the version in package.json');
+      },
+    },
+    {
+      name: 'a build that skipped nothing is the release it always was',
+      run: (ctx) => {
+        const { skippedUploadError } = require(RELEASE_TASK);
+        ctx.expect(skippedUploadError([])).toBeNull();
+      },
+    },
+  ],
+});