fix(release): check Azure login before compiling Windows

[SunkenInTime]

The first signed release dry run built Windows successfully but then failed Azure OIDC login with AADSTS700213. Authenticate immediately after the main-branch guard so configuration failures stop before SDK installation and compilation.

Verified workflow YAML parsing and the ordering of the branch guard, Azure login, build, signing, packaging, verification, and publication. The initial failure is recorded at https://github.com/SunkenInTime/icarus/actions/runs/35532835202. This change does not repair Azure's federated credential; that must be corrected in Azure before signing can succeed.

Summary by CodeRabbit

• Chores
  • Updated the desktop release process to authenticate with Azure earlier in the workflow.
  • Windows binary signing remains unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 3bbb4f38-dab5-4ce7-a392-072c34e1b31c

📥 Commits

Reviewing files that changed from the base of the PR and between 0a2760b and e6c38f2.

📒 Files selected for processing (1)

• .github/workflows/release-desktop.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The desktop release workflow now performs Azure OIDC authentication immediately after the main-branch check. Dart and Flutter setup and later release steps run after authentication. Windows binary signing remains unchanged.

Changes

Desktop release authentication

Layer / File(s)	Summary
Authenticate before setup and build .github/workflows/release-desktop.yml	Moves Azure OIDC login before Dart and Flutter setup. The later login step is removed. Windows binary signing is unchanged.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: moving Azure login before Windows compilation in the release workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 4/5

The workflow reordering preserves the main-branch gate and signing credential path while moving authentication ahead of costly build work.

What we checked:

• Non-main release authentication: The main-branch guard throws before Azure login for every ref other than refs/heads/main. The executed non-main evaluation confirmed that Azure login and both signing actions are unreachable on that path.
• Late Azure configuration failure: Azure OIDC login is before Dart setup, FVM installation, Flutter installation, and the Windows build. The executed ordering comparison confirmed that a failed login blocks those later default-condition steps.
• Signing credential availability: Both signing actions remain after azure/login and explicitly retain the Azure CLI credential provider. The executed historical/current assertions confirmed the move did not alter either signer's credential selection.
• Validated the release workflow branch gate, confirming the non-main path terminates before Azure OIDC and signing while the main path remains operational.
• Compared parent and current release workflows to confirm the Azure login is placed before Dart, FVM, Flutter, and Windows builds, so a failed login stops later steps.
• Captured the OIDC login and both signing configurations after the move and verified the YAML parse passed.
• Identified the exact relevant lines in the workflow and confirmed the guard logic distinguishes the non-main and main branches, with no source changes to the workflow file.

Summary

Azure OIDC authentication now runs before desktop SDK setup and Windows compilation, so invalid Azure configuration stops a release sooner. The workflow passed targeted branch-gating, ordering, credential-selection, YAML, and workflow-lint checks. No release-workflow defect was found.

_{Reviews (1) · Last reviewed commit: "fix(release): check Azure login before c..."}