T3/factory deploy names shown build

.dw/config.yml

@@ -0,0 +1,9 @@
+# softfac (the Rust factory) reads this block from the default branch on every pass.
+# Design and plan: factory/docs/design.md once issue #1 lands; issues #1 to #21.
+factory:
+  instructors: [tomkaczocha, rawphp]
+  base: main
+  provision: [vp i]
+  gate: [factory/scripts/check.sh]
+  limits: { gate_retries: 2 }
+  autonomy: pr

.github/workflows/factory-ci.yml

@@ -0,0 +1,72 @@
+name: Factory CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: factory-ci-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+# This is the fork's own workflow. Upstream's workflows are disabled on this repo.
+jobs:
+  check:
+    name: Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Install
+        run: vp i
+
+      - name: Check
+        run: factory/scripts/check.sh
+
+  # Runs the command upstream's ci.yml Lint job runs. check.sh and the factory gate do not run it.
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Install
+        run: vp i
+
+      - name: Lint
+        run: vp check

.github/workflows/factory-desktop-preflight.yml

@@ -0,0 +1,38 @@
+name: Factory desktop preflight
+
+# Checks the macOS signing secrets in the desktop-release environment without
+# printing them. Run it by hand after adding or rotating any of them. The checks
+# live in factory/scripts/desktop-preflight.sh, which factory-desktop.yml also
+# runs before every build.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  preflight:
+    name: Signing secrets
+    runs-on: macos-15
+    timeout-minutes: 10
+    # The secrets live in this environment, which only main may deploy from,
+    # so a factory pull request from a branch in this repo never receives them.
+    environment: desktop-release
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /factory/scripts/
+          sparse-checkout-cone-mode: false
+
+      - name: Check signing secrets
+        env:
+          APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          MACOS_PROVISIONING_PROFILE: ${{ secrets.MACOS_PROVISIONING_PROFILE }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: factory/scripts/desktop-preflight.sh

.github/workflows/factory-desktop.yml

@@ -0,0 +1,196 @@
+name: Factory desktop
+
+# Builds the fork's macOS desktop app (arm64) on every push to main, signs and
+# notarizes it with the Developer ID in the desktop-release environment, and
+# publishes it as a prerelease on this repo. Installed apps follow those
+# prereleases through their nightly update feed. Upstream's release workflows
+# stay disabled; the mac build steps here are copied from release-desktop.yml.
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+# Only the newest commit on main is worth publishing. A re-run gets a group of
+# its own, so re-running an old run never cancels the build of a newer commit.
+concurrency:
+  group: factory-desktop${{ github.run_attempt > 1 && format('-rerun-{0}', github.run_id) || '' }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build, sign and publish (mac arm64)
+    runs-on: macos-15
+    timeout-minutes: 60
+    # The secrets live in this environment, which only main may deploy from.
+    environment: desktop-release
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      # Only the publish step needs the write token, and it uses gh, not git, so
+      # drop checkout's credentials before dependency install and build scripts
+      # run. persist-credentials: false would do this, but checkout then strips
+      # them with `git submodule foreach`, which fails hard on the gitlinks under
+      # .repos/alchemy-effect that have no .gitmodules entry.
+      - name: Drop checkout credentials
+        run: |
+          git config --local --name-only --get-regexp '^includeIf\.gitdir:' | while read -r key; do
+            git config --local --unset-all "$key"
+          done
+          rm -f "$RUNNER_TEMP"/git-credentials-*.config
+
+      - name: Retry stapler on dropped connections
+        run: echo "$GITHUB_WORKSPACE/factory/scripts/xcrun-retry" >> "$GITHUB_PATH"
+
+      - name: Check signing secrets
+        env:
+          APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          MACOS_PROVISIONING_PROFILE: ${{ secrets.MACOS_PROVISIONING_PROFILE }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: factory/scripts/desktop-preflight.sh
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: false
+
+      - name: Install
+        run: vp i
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+        with:
+          targets: aarch64-apple-darwin
+
+      - id: version
+        name: Resolve version
+        run: |
+          version="$(factory/scripts/desktop-version.sh "$GITHUB_RUN_NUMBER")"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Building $version"
+
+      - name: Align package versions to the build version
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: node scripts/update-release-package-versions.ts "$VERSION"
+
+      - name: Build signed desktop artifact
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          T3CODE_DESKTOP_UPDATE_REPOSITORY: original-solutions/t3code-factory
+          T3CODE_CLERK_PASSKEY_RP_DOMAINS: ${{ vars.CLERK_PASSKEY_RP_DOMAINS }}
+          APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          MACOS_PROVISIONING_PROFILE: ${{ secrets.MACOS_PROVISIONING_PROFILE }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: |
+          set -euo pipefail
+          # electron-builder notarizes with APPLE_API_KEY as a path to the .p8.
+          key_path="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
+          printf '%s' "$APPLE_API_KEY" > "$key_path"
+          export APPLE_API_KEY="$key_path"
+
+          profile_path="$RUNNER_TEMP/t3code-factory.provisionprofile"
+          printf '%s' "$MACOS_PROVISIONING_PROFILE" | base64 -D > "$profile_path"
+          export T3CODE_APPLE_TEAM_ID="$APPLE_TEAM_ID"
+          export T3CODE_MACOS_PROVISIONING_PROFILE="$profile_path"
+
+          node scripts/build-desktop-artifact.ts \
+            --platform mac \
+            --target dmg \
+            --arch arm64 \
+            --build-version "$VERSION" \
+            --signed \
+            --verbose
+
+      - id: assets
+        name: Find build artifacts
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          dmgs=(release/*.dmg)
+          zips=(release/*.zip)
+          if [[ ${#dmgs[@]} -ne 1 || ${#zips[@]} -ne 1 || ! -f release/nightly-mac.yml ||
+                ! -f "${zips[0]}.blockmap" ]]; then
+            echo "::error::Expected one dmg, one zip with its blockmap and nightly-mac.yml in release/."
+            ls -la release
+            exit 1
+          fi
+          # Upstream's build script names assets T3-Code-<version>-<arch>. Renaming
+          # keeps the bytes, so only the manifest's urls change.
+          rename() {
+            local from=$1 to
+            to="release/T3-Code-Factory-${from#release/T3-Code-}"
+            mv "$from" "$to"
+            if [[ -f "$from.blockmap" ]]; then mv "$from.blockmap" "$to.blockmap"; fi
+            sed -i '' "s|^\( *- url: \)${from#release/}\$|\1${to#release/}|" release/nightly-mac.yml
+            grep -q "url: ${to#release/}\$" release/nightly-mac.yml ||
+              { echo "::error::nightly-mac.yml has no url for ${from#release/}." >&2; exit 1; }
+            echo "$to"
+          }
+          dmg=$(rename "${dmgs[0]}")
+          zip=$(rename "${zips[0]}")
+          echo "dmg=$dmg" >> "$GITHUB_OUTPUT"
+          echo "zip=$zip" >> "$GITHUB_OUTPUT"
+
+      - name: Notarize and staple the dmg
+        env:
+          DMG: ${{ steps.assets.outputs.dmg }}
+          APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: factory/scripts/desktop-notarize-dmg.sh "$DMG" release/nightly-mac.yml
+
+      - name: Verify signature, Gatekeeper and notarization
+        env:
+          DMG: ${{ steps.assets.outputs.dmg }}
+          ZIP: ${{ steps.assets.outputs.zip }}
+        run: factory/scripts/desktop-verify.sh "$DMG" "$ZIP"
+
+      # Created as a draft and published only once every asset is uploaded, so a
+      # failed upload never leaves a release an updater could follow.
+      - name: Publish prerelease
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.version.outputs.version }}
+          DMG: ${{ steps.assets.outputs.dmg }}
+          ZIP: ${{ steps.assets.outputs.zip }}
+        run: |
+          set -euo pipefail
+          # A re-run of an older run would otherwise publish stale code as the
+          # newest release, and installed apps would update back to it.
+          head="$(gh api "repos/$GITHUB_REPOSITORY/commits/main" --jq .sha)"
+          if [[ "$head" != "$GITHUB_SHA" ]]; then
+            echo "::warning::main is at $head now, not $GITHUB_SHA; not publishing."
+            exit 0
+          fi
+          tag="v$VERSION"
+          gh release create "$tag" \
+            --draft \
+            --prerelease \
+            --target "$GITHUB_SHA" \
+            --title "T3 Code Factory $VERSION" \
+            --notes "Nightly macOS (Apple Silicon) build of $GITHUB_SHA." \
+            "$DMG" "$DMG.blockmap" "$ZIP" "$ZIP.blockmap" release/nightly-mac.yml
+          gh release edit "$tag" --draft=false

.github/workflows/factory-docs.yml

@@ -0,0 +1,75 @@
+name: Factory docs
+
+# Builds the docs site in factory/site on pull requests, and deploys it to GitHub Pages from main.
+on:
+  pull_request:
+    paths:
+      - factory/site/**
+      - .github/workflows/factory-docs.yml
+  push:
+    branches:
+      - main
+    paths:
+      - factory/site/**
+      - .github/workflows/factory-docs.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: factory-docs-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: factory/site
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: factory/site
+
+      - name: Setup Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: factory/site/package-lock.json
+
+      - name: Install
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Upload Pages artifact
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: factory/site/.vitepress/dist
+
+  deploy:
+    name: Deploy
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+    steps:
+      - name: Configure Pages
+        uses: actions/configure-pages@v6
+
+      - name: Deploy
+        id: deploy
+        uses: actions/deploy-pages@v5