Add desktop draft release pipeline

.github/release-drafter.yml

@@ -0,0 +1,28 @@
+name-template: '$RESOLVED_VERSION'
+tag-template: '$RESOLVED_VERSION'
+change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
+change-title-escapes: '\<*_&'
+no-changes-template: '- No merged pull requests in this release window.'
+categories:
+  - title: Features
+    labels:
+      - feature
+      - enhancement
+  - title: Fixes
+    labels:
+      - bug
+      - fix
+      - regression
+  - title: Maintenance
+    labels:
+      - chore
+      - dependencies
+      - maintenance
+template: |
+  ## Changes
+
+  $CHANGES
+
+  ## Contributors
+
+  $CONTRIBUTORS

.github/workflows/ci.yml

@@ -98,6 +98,8 @@ jobs:
     name: Tests
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    env:
+      SKIP_ELECTRON_REBUILD: '1'
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4

.github/workflows/release.yml

@@ -3,17 +3,18 @@ name: Desktop Release
 on:
   workflow_dispatch:
     inputs:
-      version:
-        description: Calendar version in YYYY.M.D format. Leave blank to use the UTC date.
+      release_date:
+        description: Release date in YYYY.M.D format. Leave blank to use the UTC date.
         required: false
         type: string
       release_notes:
         description: Markdown release notes prepended to GitHub-generated release notes.
-        required: true
+        required: false
         type: string
 
 permissions:
   contents: write
+  pull-requests: read
 
 concurrency:
   group: release-${{ github.workflow }}-${{ github.ref }}
@@ -27,11 +28,15 @@ jobs:
     name: Prepare release metadata
     runs-on: ubuntu-latest
     outputs:
-      version: ${{ steps.version.outputs.version }}
-      release_name: ${{ steps.version.outputs.release_name }}
+      app_version: ${{ steps.metadata.outputs.app_version }}
+      release_date: ${{ steps.metadata.outputs.release_date }}
+      release_name: ${{ steps.metadata.outputs.release_name }}
+      release_tag: ${{ steps.metadata.outputs.release_tag }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Require main branch
         if: github.ref_name != 'main'
@@ -44,17 +49,28 @@ jobs:
         with:
           node-version-file: .nvmrc
 
-      - name: Resolve version
-        id: version
+      - name: Resolve release metadata
+        id: metadata
         shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
-          VERSION="${{ inputs.version }}"
-          if [ -z "$VERSION" ]; then
-            VERSION="$(date -u '+%Y.%-m.%-d')"
+          RELEASE_DATE="${{ inputs.release_date }}"
+          if [ -z "$RELEASE_DATE" ]; then
+            RELEASE_DATE="$(date -u '+%Y.%-m.%-d')"
           fi
-          node scripts/set-desktop-version.mjs --validate-only "$VERSION"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "release_name=Memry $VERSION" >> "$GITHUB_OUTPUT"
+
+          git fetch --tags --force
+          {
+            git tag -l 'v*'
+            gh release list --limit 200 --json tagName --jq '.[].tagName'
+          } | sort -u > "$RUNNER_TEMP/desktop-release-tags.txt"
+
+          node scripts/desktop-release-metadata.mjs \
+            --resolve \
+            --date "$RELEASE_DATE" \
+            --existing-tags-file "$RUNNER_TEMP/desktop-release-tags.txt" \
+            --github-output "$GITHUB_OUTPUT"
 
   build:
     name: Build ${{ matrix.label }}
@@ -70,25 +86,25 @@ jobs:
             arch: x64
             os: macos-15-intel
             artifact_name: release-mac-x64
-            build_command: pnpm --filter @memry/desktop exec electron-builder --config config/electron-builder.yml --mac --x64 --publish never
+            build_command: node apps/desktop/scripts/build-packaged-app.js --mac --x64 --publish never
           - label: mac arm64
             platform: mac
             arch: arm64
             os: macos-15
             artifact_name: release-mac-arm64
-            build_command: pnpm --filter @memry/desktop exec electron-builder --config config/electron-builder.yml --mac --arm64 --publish never
+            build_command: node apps/desktop/scripts/build-packaged-app.js --mac --arm64 --publish never
           - label: win x64
             platform: win
             arch: x64
             os: windows-latest
             artifact_name: release-win
-            build_command: pnpm --filter @memry/desktop exec electron-builder --config config/electron-builder.yml --win --x64 --publish never
+            build_command: node apps/desktop/scripts/build-packaged-app.js --win --x64 --publish never
           - label: linux x64
             platform: linux
             arch: x64
             os: ubuntu-latest
             artifact_name: release-linux
-            build_command: pnpm --filter @memry/desktop exec electron-builder --config config/electron-builder.yml --linux AppImage deb --x64 --publish never
+            build_command: node apps/desktop/scripts/build-packaged-app.js --linux AppImage deb --x64 --publish never
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -102,7 +118,7 @@ jobs:
           cache: pnpm
 
       - name: Set release version
-        run: node scripts/set-desktop-version.mjs "${{ needs.prepare.outputs.version }}"
+        run: node scripts/set-desktop-version.mjs "${{ needs.prepare.outputs.app_version }}"
 
       - name: Install Linux system dependencies
         if: matrix.platform == 'linux'
@@ -124,6 +140,10 @@ jobs:
           APPLE_APP_SPECIFIC_PASSWORD: ${{ matrix.platform == 'mac' && secrets.APPLE_APP_SPECIFIC_PASSWORD || '' }}
           APPLE_TEAM_ID: ${{ matrix.platform == 'mac' && secrets.APPLE_TEAM_ID || '' }}
 
+      - name: Check packaged runtime
+        if: matrix.platform == 'mac'
+        run: pnpm --filter @memry/desktop check:packaged-runtime
+
       - name: Upload build artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -132,7 +152,7 @@ jobs:
           if-no-files-found: error
 
   publish:
-    name: Publish GitHub Release
+    name: Create draft GitHub Release
     runs-on: ubuntu-latest
     needs:
       - prepare
@@ -183,13 +203,49 @@ jobs:
           File.write(root.join('latest-mac.yml'), YAML.dump(base))
           RUBY
 
-      - name: Create GitHub release
-        uses: softprops/action-gh-release@v2
+      - name: Collect release assets
+        shell: bash
+        run: |
+          mkdir -p release-assets
+          find artifacts -type f \
+            \( \
+              -name '*.AppImage' \
+              -o -name '*.blockmap' \
+              -o -name '*.deb' \
+              -o -name '*.dmg' \
+              -o -name '*.exe' \
+              -o -name '*.yml' \
+              -o -name '*.zip' \
+            \) \
+            -print0 | while IFS= read -r -d '' file; do
+              cp "$file" "release-assets/$(basename "$file")"
+            done
+
+          asset_count="$(find release-assets -maxdepth 1 -type f | wc -l | tr -d ' ')"
+          if [ "$asset_count" -eq 0 ]; then
+            echo "No release assets collected"
+            exit 1
+          fi
+
+          find release-assets -maxdepth 1 -type f -print | sort
+
+      - name: Draft GitHub release
+        id: release_drafter
+        uses: release-drafter/release-drafter@v7
         with:
-          tag_name: ${{ needs.prepare.outputs.version }}
+          tag: ${{ needs.prepare.outputs.release_tag }}
           name: ${{ needs.prepare.outputs.release_name }}
-          target_commitish: ${{ github.sha }}
-          files: artifacts/**/*
-          body: ${{ inputs.release_notes }}
-          generate_release_notes: true
-          fail_on_unmatched_files: false
+          version: ${{ needs.prepare.outputs.app_version }}
+          publish: false
+          latest: false
+          commitish: ${{ github.sha }}
+          header: ${{ inputs.release_notes }}
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Upload release assets
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload "${{ steps.release_drafter.outputs.tag_name }}" release-assets/* --clobber

apps/desktop/README.md

@@ -1,14 +1,15 @@
-# ⚠️ FROZEN — Electron desktop app (being migrated to Tauri)
+# Electron desktop app
 
-**Status:** Frozen as of 2026-04-24. No new commits to `apps/desktop/**` until deletion.
+**Status:** Active. New desktop work targets this Electron app.
 
-**Migration target:** `apps/desktop-tauri/`
+## Development
 
-**Why frozen:** Memry is migrating from Electron to Tauri 2.x as a complete
-greenfield rewrite. This directory is preserved only so the Tauri build can
-reference the Electron renderer for source parity during M1 (see migration
-spec: `docs/superpowers/specs/2026-04-24-electron-to-tauri-full-migration-design.md`).
+```bash
+pnpm --filter @memry/desktop dev
+pnpm --filter @memry/desktop build
+```
 
-**For emergency bug fixes to Electron:** contact Kaan. Do not push directly.
+## Release Builds
 
-**Scheduled deletion:** At M10 of the Tauri migration.
+Release packaging is handled through the desktop release workflow and
+`apps/desktop/scripts/build-packaged-app.js`.

apps/desktop/config/electron-builder.staged-local-mac.yml

@@ -0,0 +1,22 @@
+extends: file:config/electron-builder.local-mac.yml
+beforeBuild: ./scripts/before-build-external-node-modules.cjs
+npmRebuild: true
+dmg:
+  size: 3g
+extraResources:
+  - from: .env.staging
+    to: .env
+  - from: node_modules
+    to: node_modules
+    filter:
+      - '**/*'
+      - '.pnpm'
+      - '.pnpm/**/*'
+      - '.modules.yaml'
+      - '!**/*.map'
+      - '!**/{coverage,doc,docs,example,examples,test,tests,__tests__}/**'
+      - '!**/re2/vendor/**'
+      - '!electron'
+      - '!electron/**/*'
+      - '!**/node_modules/electron'
+      - '!**/node_modules/electron/**/*'

apps/desktop/config/electron-builder.staged.yml

@@ -0,0 +1,20 @@
+extends: file:config/electron-builder.yml
+beforeBuild: ./scripts/before-build-external-node-modules.cjs
+npmRebuild: true
+dmg:
+  size: 3g
+extraResources:
+  - from: node_modules
+    to: node_modules
+    filter:
+      - '**/*'
+      - '.pnpm'
+      - '.pnpm/**/*'
+      - '.modules.yaml'
+      - '!**/*.map'
+      - '!**/{coverage,doc,docs,example,examples,test,tests,__tests__}/**'
+      - '!**/re2/vendor/**'
+      - '!electron'
+      - '!electron/**/*'
+      - '!**/node_modules/electron'
+      - '!**/node_modules/electron/**/*'

apps/desktop/config/electron-builder.yml

@@ -12,6 +12,7 @@ files:
   - '!src/*'
   - '!config/*'
   - '!electron.vite.config.{js,ts,mjs,cjs}'
+  - '!electron-builder.env'
   - '!{.eslintcache,eslint.config.mjs,.prettierignore,.prettierrc.yaml,CHANGELOG.md,README.md}'
   - '!{.env,.env.*,.npmrc,pnpm-lock.yaml}'
   - '!{tsconfig.json,tsconfig.node.json,tsconfig.web.json}'

apps/desktop/package.json

@@ -62,11 +62,12 @@
     "db:seed:inbox": "bash scripts/ensure-native.sh node && npx tsx scripts/seed-inbox.ts",
     "db:seed:calendar": "bash scripts/ensure-native.sh node && npx tsx scripts/seed-calendar.ts",
     "seed:notes": "node --experimental-strip-types --experimental-transform-types scripts/seed-notes.ts",
-    "build:unpack": "pnpm build && electron-builder --config config/electron-builder.yml --dir",
+    "build:unpack": "pnpm build && node scripts/build-packaged-app.js --dir",
     "build:win": "pnpm build && electron-builder --config config/electron-builder.yml --win",
-    "build:mac": "pnpm build && electron-builder --config config/electron-builder.yml --mac",
+    "build:mac": "pnpm build && node scripts/build-packaged-app.js --mac",
     "build:mac:signed:local": "node scripts/build-mac-signed-local.mjs",
     "build:linux": "pnpm build && electron-builder --config config/electron-builder.yml --linux",
+    "check:packaged-runtime": "node scripts/check-packaged-runtime-deps.js",
     "test": "pnpm exec vitest run --config config/vitest.config.ts",
     "test:watch": "pnpm exec vitest watch --config config/vitest.config.ts",
     "test:ui": "pnpm exec vitest --ui --config config/vitest.config.ts",
@@ -126,6 +127,7 @@
     "pako": "^2.1.0",
     "react": "^19.2.3",
     "react-dom": "^19.2.3",
+    "safe-buffer": "^5.2.1",
     "sharp": "0.34.5",
     "sqlite-vec": "0.1.7-alpha.2",
     "ws": "^8.19.0",

apps/desktop/scripts/before-build-external-node-modules.cjs

@@ -0,0 +1,3 @@
+module.exports = async function beforeBuildExternalNodeModules() {
+  return false
+}