Harden Windows desktop launch and CI

.github/workflows/linux-bundle.yml

@@ -44,7 +44,7 @@ jobs:
 
           The AppImage and deb in `Stellr-Linux-x86_64-packages-UNSIGNED-NOT-FOR-RELEASE` are intentionally unsigned development artifacts and must not be published as an official release.
           SUMMARY
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: Stellr-Linux-x86_64-packages-UNSIGNED-NOT-FOR-RELEASE
           path: artifacts/linux-x86_64/*
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: Stellr-Linux-x86_64-packages-UNSIGNED-NOT-FOR-RELEASE
           path: artifacts/linux-x86_64
@@ -82,7 +82,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: Stellr-Linux-x86_64-packages-UNSIGNED-NOT-FOR-RELEASE
           path: artifacts/linux-x86_64

.github/workflows/macos-bundle.yml

@@ -34,7 +34,7 @@ jobs:
 
           `Stellr-macOS-universal-DMG-UNSIGNED-NOT-FOR-RELEASE` has no trusted Developer ID identity and must not be published as an official release.
           SUMMARY
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: Stellr-macOS-universal-DMG-UNSIGNED-NOT-FOR-RELEASE
           path: artifacts/macos-universal/*UNSIGNED-NOT-FOR-RELEASE*

.github/workflows/release.yml

@@ -74,17 +74,22 @@ jobs:
       - name: Build signed Windows NSIS package
         shell: powershell
         run: .\scripts\build-windows-nsis.ps1 -Channel Release -CertificateThumbprint $env:WINDOWS_CERTIFICATE_THUMBPRINT
+      - name: Prove the companion CLI from PowerShell and cmd.exe
+        shell: powershell
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: .\scripts\smoke-windows-cli.ps1 -ExecutablePath target\release\stellr.exe
       - name: Prove the real application-process boundary
         shell: powershell
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        run: .\scripts\smoke-windows-application-process.ps1 -ExecutablePath target\release\stellr.exe
+        run: .\scripts\smoke-windows-application-process.ps1 -ExecutablePath target\release\stellr-desktop.exe
       - name: Smoke signed install, WebView2 launch, and uninstall
         shell: powershell
         run: |
           $installer = Get-ChildItem artifacts\windows-x64\*.exe -File | Select-Object -ExpandProperty FullName -First 1
           .\scripts\smoke-windows-nsis.ps1 -InstallerPath $installer
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-windows
           path: artifacts/windows-x64/*
@@ -135,7 +140,7 @@ jobs:
         run: bash scripts/build-macos-universal.sh Release
       - name: Verify signature, slices, and signed launch
         run: bash scripts/inspect-macos-dmg.sh artifacts/macos-universal/*.dmg Release
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-macos
           path: artifacts/macos-universal/*
@@ -164,7 +169,7 @@ jobs:
       - run: npm --prefix web ci
       - name: Build Linux release packages
         run: bash scripts/build-linux-packages.sh Release
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-linux
           path: artifacts/linux-x86_64/*
@@ -175,7 +180,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: release-linux
           path: artifacts/linux-x86_64
@@ -200,7 +205,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: release-linux
           path: artifacts/linux-x86_64
@@ -214,7 +219,7 @@ jobs:
       contents: write
       issues: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: release-*
           merge-multiple: true

.github/workflows/windows-bundle.yml

@@ -27,11 +27,16 @@ jobs:
       - name: Build unsigned Windows x64 NSIS installer
         shell: powershell
         run: .\scripts\build-windows-nsis.ps1 -Channel Development
+      - name: Prove the companion CLI from PowerShell and cmd.exe
+        shell: powershell
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: .\scripts\smoke-windows-cli.ps1 -ExecutablePath target\release\stellr.exe
       - name: Prove the real desktop application-process boundary
         shell: powershell
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        run: .\scripts\smoke-windows-application-process.ps1 -ExecutablePath target\release\stellr.exe
+        run: .\scripts\smoke-windows-application-process.ps1 -ExecutablePath target\release\stellr-desktop.exe
       - name: Smoke install, WebView2 launch, and uninstall
         shell: powershell
         run: |
@@ -45,7 +50,7 @@ jobs:
 
           `Stellr-Windows-x64-NSIS-UNSIGNED-NOT-FOR-RELEASE` is intentionally unsigned and must not be published as an official release.
           "@ | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: Stellr-Windows-x64-NSIS-UNSIGNED-NOT-FOR-RELEASE
           path: artifacts/windows-x64/*UNSIGNED-NOT-FOR-RELEASE*

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+- Upgraded all bundle artifact uploads to `actions/upload-artifact@v7` and
+  downloads to `actions/download-artifact@v8`, removing the obsolete
+  action-runtime warnings without suppressing them.
+- Hardened Windows application startup smokes with a measured 90-second cold
+  start budget and captured native startup-stage diagnostics on failure.
+- Split the Windows desktop and CLI entry points so installed shortcuts and
+  protocol launches open without a terminal while `stellr serve` retains
+  native PowerShell and Command Prompt behavior.
 - Fixed installed desktop startup so a no-argument launch opens the existing
   empty repository-selection shell instead of treating the installation
   directory as a Git repository.

crates/app/Cargo.toml

@@ -1,6 +1,7 @@
 [package]
 name = "stellr-app"
 version = "0.1.0"
+default-run = "stellr-desktop"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
@@ -9,6 +10,10 @@ repository.workspace = true
 name = "stellr"
 path = "src/main.rs"
 
+[[bin]]
+name = "stellr-desktop"
+path = "src/desktop_main.rs"
+
 [dependencies]
 async-trait.workspace = true
 axum = "0.8"

crates/app/src/cli.rs

@@ -5,14 +5,26 @@ use std::path::PathBuf;
 use clap::{Args, Parser, Subcommand};
 
 #[derive(Parser)]
-#[command(name = "stellr")]
+#[command(name = "stellr", version)]
 pub struct Cli {
     #[command(subcommand)]
     pub command: Option<Command>,
-    #[arg(value_name = "STELLR_LINK", hide = true)]
+    #[arg(
+        value_name = "STELLR_LINK",
+        hide = true,
+        value_parser = parse_protocol_target
+    )]
     pub protocol_target: Option<String>,
 }
 
+fn parse_protocol_target(value: &str) -> Result<String, String> {
+    if value.starts_with("stellr://") {
+        Ok(value.to_owned())
+    } else {
+        Err("expected a Stellr subcommand or stellr:// link".to_owned())
+    }
+}
+
 #[derive(Subcommand)]
 pub enum Command {
     #[cfg(debug_assertions)]

crates/app/src/desktop_main.rs

@@ -0,0 +1,17 @@
+#![cfg_attr(
+    all(target_os = "windows", not(debug_assertions)),
+    windows_subsystem = "windows"
+)]
+
+fn main() {
+    #[cfg(not(all(target_os = "windows", not(debug_assertions))))]
+    let result = stellr_app::entrypoints::run_cli();
+    #[cfg(all(target_os = "windows", not(debug_assertions)))]
+    let result = stellr_app::entrypoints::run_desktop();
+
+    if let Err(_error) = result {
+        #[cfg(debug_assertions)]
+        eprintln!("{_error}");
+        std::process::exit(1);
+    }
+}