ci: add desktop Electron builds to GitHub Actions with unified production gate

[dylanjeffers]

What

Desktop (Electron) builds were never migrated when web CI moved from CircleCI to GitHub Actions (~#13560). This adds them back, and consolidates the release approval.

Single approval gate. A new production-gate job holds environment: production and runs after web-build + web-check-ssr-bundlesize. Approving it releases web and all three desktop platforms. The old CircleCI pipeline had four separate approval gates (web, mac, win, linux) — now it's one.

• production-gate — new, holds the production environment
• web-deploy — now needs: [production-gate], environment: block removed (the gate owns it)
• desktop-build-mac — macos-latest
• desktop-build-win — ubuntu-latest in electronuserland/builder:18-wine
• desktop-build-linux — ubuntu-latest in electronuserland/builder
• web-deploy-release-candidate — unchanged, still auto-deploys to release with no approval

Each desktop job downloads the existing builds artifact, runs the per-platform publish script, and posts the same Slack deploy message the CircleCI jobs did.

⚠️ Secrets to verify/add before merging

These were in CircleCI's "Audius Client" context and need to exist in Settings → Secrets and variables → Actions:

Secret	Purpose
APPLE_ID	Mac notarization
APPLE_ID_PASSWORD	Mac notarization (app-specific password)
ASC_PROVIDER	Mac notarization (also used as teamId)
CSC_LINK	Mac code signing — P12 cert, base64 encoded
CSC_KEY_PASSWORD	Mac code signing — P12 password

AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (S3 publish) and SLACK_DAILY_DEPLOY_WEBHOOK are already used by existing jobs.

Notes on deviations from the original plan

Three things came out of reading packages/web/scripts/dist.js and the deleted CircleCI config:

1. Per-platform npm scripts. Used dist:mac-publish-production / dist:win-publish-production / dist:linux-publish-production rather than dist-publish-production -- --mac. dist-publish-production already expands to --mac --win --linux, so appending --mac would not narrow it — every job would try to build all three platforms.

2. No mv build-production build. dist.js reads build-production directly (PRODUCTION_BUILD_DIR), so the artifact is downloaded in place. The old CircleCI web-distribute command had no move step either. Renaming would break the Electron packaging.

3. setup-node inside the containers. The repo's .npmrc sets engine-strict=true with node >=24.10.0; electronuserland/builder:18-wine ships Node 18, so npm ci would hard-fail without it.

Also carried over from CircleCI's mac job: Python 3.11 (node-gyp needs distutils, removed in 3.12+) and the dmg-license install required to produce the .dmg.

Test plan

The desktop jobs are if: github.ref == 'refs/heads/main', so they don't run on this PR — first real exercise is the next production release after merge. Verified locally: YAML parses and every needs: reference resolves.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: a395068

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.