Stop publishing the Windows executable - #22
Merged
Conversation
…xact text, not a broad -Force lookbehind
Gating on dist-electron-release/Loremaster.exe only caught that path shape; a downloaded Loremaster-Windows artifact staged elsewhere and referenced directly (e.g. package/loremaster-component/Loremaster.exe) slipped past untouched. Check the bare Loremaster.exe filename instead, exempting by exact text only the four build-and-verify lines inside the build-loremaster job.
…d still claimed publication
The UI-package assembly step copied the entire docs/ tree, including docs/superpowers/specs and docs/superpowers/plans -- this project's own internal design specs and implementation plans -- into SpinUI-UI.zip and, by extension, SpinUI-Manual.zip. Both are published and delivered to end users. Strip docs/superpowers from the staged package, and add a gate assertion (with a clear failure message) so a staged release package containing docs/superpowers fails release_quality_gate.py's --packages-only check. Also, smaller fixes surfaced by the same review: - LOREMASTER_MILESTONE_2.md still claimed Loremaster "is the portable desktop shipped with UI releases" three lines from the top -- ships inside SpinUI-Manual.zip itself, so a user reads a false publication claim on the first screen. Corrected to say the Linux AppImage ships and the Windows portable build is CI-tested but not published, and scoped the Settings Update Center description off "can update Loremaster" since the Windows updater has no published asset to find. - The package-linux-release comment still called SpinUI-Manual.zip "the Windows-specific manual install bundle"; it now holds skins, layouts, and docs, with its own INSTALL.md pointing Linux users at the AppImage. - package-windows-release's needs: build-loremaster is now the only thing making a broken Windows build block a release; commented it as a gating, not component, dependency so it doesn't look like dead weight. - The retired-artifact gate's bare-filename check now names the offending line(s) so resolving an upstream merge conflict is faster. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The planning documents in docs/superpowers are transient — they will plausibly be deleted from the repo once their work is complete. When that happens, the cleanup step must not fail or print errors under any ErrorActionPreference setting. Use Test-Path to gate the removal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Windows executable should not be downloadable from this fork. It leaked out of five places, not one — the standalone release asset, a copy inside
SpinUI-Manual.zip, theSHA256SUMS.txtlisting, the release notes, and therelease-event publish path. Removing only the standalone asset would still have shipped it inside the manual bundle.CI still builds, smoke-tests and artifact-stages the executable on every qualifying run, so a shared-code change that breaks the Windows build still fails. Only publishing changed. It can still be built from source.
The skins are unaffected:
spinui-updater.tsfetchesSpinUI-UI.zipandSpinUI-Update.jsonfrom this repo's releases, and that updater ships in the Linux build.SHA256SUMS.txtstill covers all three skin assets.The quality gate is inverted, not deleted
Instead of requiring the executable, the gate now fails if it returns to any publishing path. That is what stops the next upstream sync quietly undoing this. It checks the bare filename, exempting only the four sanctioned
build-loremasterlines by exact text, so a reintroduction under a different path or directory is still caught.Known limits, deliberately not chased: adversarial evasion (glob paths, string concatenation, a renamed intermediate, or pasting a sanctioned line into another job) can still slip past. The threat model is accidental restoration via merge, which reproduces natural code shapes — all of which are caught.
Also fixed: internal planning docs were shipping to users
The UI packaging step copied the entire
docs/tree intoSpinUI-UI.zip, which meantdocs/superpowers/— internal design specs and implementation plans — would have been delivered to everyone downloading the skins. Now excluded, with a gate assertion so it cannot silently regress, and aTest-Pathguard so deleting those transient docs later cannot break the build.Documentation
README.md,installer/INSTALL-MANUAL.md(which ships inside the manual bundle),docs/RELEASING.mdanddocs/LOREMASTER_MILESTONE_2.mdno longer tell anyone to download or run an executable this repo doesn't ship — while stating accurately that it is still built and tested, not abandoned.Known fallout, accepted:
portable-updater.tslooks for aLoremaster.exeasset and will throw when it finds none, so anyone already running the Windows build sees an update error rather than a clean end-of-life message. Deliberately out of scope.Quality gate ALL PASS.
Spec:
docs/superpowers/specs/2026-08-14-rc-identity-and-windows-exe-removal-design.md🤖 Generated with Claude Code