[ENG-1071] Render PR comments in the checks panel

.eslintrc.json

@@ -1,28 +0,0 @@
-{
-  "extends": ["plugin:@typescript-eslint/recommended", "plugin:react-hooks/recommended"],
-  "parser": "@typescript-eslint/parser",
-  "plugins": ["@typescript-eslint", "react-hooks", "import"],
-  "rules": {
-    "@typescript-eslint/no-unused-vars": [
-      "warn",
-      {
-        "argsIgnorePattern": "^_",
-        "varsIgnorePattern": "^_"
-      }
-    ],
-    "@typescript-eslint/no-explicit-any": "warn",
-
-    "@typescript-eslint/explicit-function-return-type": "off",
-    "@typescript-eslint/explicit-module-boundary-types": "off",
-    "@typescript-eslint/no-empty-function": "off",
-    "prefer-const": "warn",
-    "react-hooks/set-state-in-effect": "warn"
-  },
-  "overrides": [],
-  "env": {
-    "browser": true,
-    "es2020": true,
-    "node": true
-  },
-  "ignorePatterns": ["**/_*/**"]
-}

.github/actions/setup-build/action.yml

@@ -0,0 +1,64 @@
+name: Setup build environment
+description: Install toolchain, deps, and write production env
+
+inputs:
+  posthog-key:
+    description: PostHog project API key
+    required: false
+    default: ''
+  posthog-host:
+    description: PostHog host
+    required: false
+    default: ''
+  build-variant:
+    description: Build variant to embed (canary | prod)
+    required: false
+    default: 'prod'
+  windows-native:
+    description: Set to true on Windows to pass MSVC/gyp flags to pnpm install
+    required: false
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@v4
+      with:
+        version: 10.28.2
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: '24'
+        cache: pnpm
+
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'
+
+    - name: Install Python build tools
+      shell: bash
+      run: python -m pip install --upgrade pip setuptools wheel
+
+    - name: Install dependencies (Windows)
+      if: inputs.windows-native == 'true'
+      shell: bash
+      env:
+        npm_config_msvs_version: '2022'
+        GYP_MSVS_VERSION: '2022'
+      run: pnpm install --frozen-lockfile
+
+    - name: Install dependencies
+      if: inputs.windows-native != 'true'
+      shell: bash
+      run: pnpm install --frozen-lockfile
+
+    - name: Write production env
+      shell: bash
+      env:
+        PH_KEY: ${{ inputs.posthog-key }}
+        PH_HOST: ${{ inputs.posthog-host }}
+        BUILD_VARIANT: ${{ inputs.build-variant }}
+      run: |
+        echo "VITE_POSTHOG_KEY=$PH_KEY" >> .env.production
+        echo "VITE_POSTHOG_HOST=$PH_HOST" >> .env.production
+        echo "VITE_BUILD=$BUILD_VARIANT" >> .env.production

.github/actions/upload-r2/action.yml

@@ -0,0 +1,40 @@
+name: Upload to R2
+description: Upload release artifacts to Cloudflare R2
+
+inputs:
+  r2-account-id:
+    required: true
+    description: Cloudflare R2 account ID
+  r2-access-key-id:
+    required: true
+    description: Cloudflare R2 access key ID
+  r2-secret-access-key:
+    required: true
+    description: Cloudflare R2 secret access key
+  r2-bucket:
+    required: true
+    description: Cloudflare R2 bucket
+  channel:
+    description: Override update channel for manifest discovery (default uses stable channel)
+    required: false
+    default: ''
+  prefix:
+    description: Override artifact prefix for installer discovery (default uses stable prefix)
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Upload to R2
+      shell: bash
+      env:
+        R2_ACCOUNT_ID: ${{ inputs.r2-account-id }}
+        R2_ACCESS_KEY_ID: ${{ inputs.r2-access-key-id }}
+        R2_SECRET_ACCESS_KEY: ${{ inputs.r2-secret-access-key }}
+        R2_BUCKET: ${{ inputs.r2-bucket }}
+      run: |
+        ARGS=""
+        if [ -n "${{ inputs.channel }}" ]; then ARGS="$ARGS --channel ${{ inputs.channel }}"; fi
+        if [ -n "${{ inputs.prefix }}" ]; then ARGS="$ARGS --prefix ${{ inputs.prefix }}"; fi
+        node --experimental-strip-types scripts/release/upload-r2.ts $ARGS

.github/workflows/code-consistency-check.yml

@@ -43,48 +43,8 @@ jobs:
       - name: Check formatting
         run: pnpm run format:check
 
-      # TODO: add this once fixed across all files
-      # - name: Check linting
-      #   run: pnpm run lint
-
       - name: Type check
         run: pnpm run typecheck
 
-  vitest:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10.28.2
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-          cache: 'pnpm'
-
-      - name: Install Linux native deps
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential libsecret-1-0 libsecret-1-dev
-
-      - name: Install dependencies
-        # Tests import Electron/keytar paths, so lifecycle scripts must run.
-        run: |
-          for attempt in 1 2 3; do
-            pnpm install --frozen-lockfile && break
-            if [ "$attempt" -eq 3 ]; then
-              echo "pnpm install failed after 3 attempts"
-              exit 1
-            fi
-            echo "Install failed (attempt $attempt). Retrying in 10s..."
-            sleep 10
-          done
-
-      - name: Run Vitest
-        run: pnpm exec vitest run
+      - name: Check linting
+        run: pnpm run lint

.github/workflows/release-canary.yml

@@ -0,0 +1,168 @@
+name: Release (Canary)
+
+on:
+  workflow_dispatch:
+    inputs:
+      arch:
+        description: 'Architecture to build (arm64 | x64 | both)'
+        required: false
+        default: 'both'
+
+permissions:
+  contents: read
+
+jobs:
+  release-linux:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    environment: release
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install system build dependencies
+        run: sudo apt-get update && sudo apt-get install -y build-essential pkg-config libsecret-1-dev rpm
+      - uses: ./.github/actions/setup-build
+        with:
+          posthog-key: ${{ secrets.POSTHOG_PROJECT_API_KEY }}
+          posthog-host: ${{ secrets.POSTHOG_HOST }}
+          build-variant: canary
+
+      - run: pnpm run build
+
+      - run: echo "NODE_OPTIONS=${NODE_OPTIONS:-not set}" && node --version
+
+      - name: Build Linux packages
+        run: >
+          node --experimental-strip-types scripts/release/build.ts
+          --platform linux --arch x64
+          --config electron-builder.canary.config.ts
+
+      - uses: ./.github/actions/upload-r2
+        with:
+          r2-account-id: ${{ secrets.R2_ACCOUNT_ID }}
+          r2-access-key-id: ${{ secrets.R2_ACCESS_KEY_ID }}
+          r2-secret-access-key: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          r2-bucket: ${{ secrets.R2_BUCKET }}
+          channel: v1-canary
+          prefix: emdash-canary
+
+  release-win:
+    runs-on: windows-2022
+    permissions:
+      contents: read
+    environment: release
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-build
+        with:
+          posthog-key: ${{ secrets.POSTHOG_PROJECT_API_KEY }}
+          posthog-host: ${{ secrets.POSTHOG_HOST }}
+          build-variant: canary
+          windows-native: 'true'
+      - name: Export Python path for native modules
+        shell: bash
+        run: echo "python=$(which python)" >> "$GITHUB_ENV"
+
+      - name: Build app
+        shell: bash
+        run: pnpm run build
+
+      - shell: bash
+        run: echo "NODE_OPTIONS=${NODE_OPTIONS:-not set}" && node --version
+
+      - name: Check Azure Trusted Signing secrets
+        id: signing
+        shell: bash
+        env:
+          AZ_TENANT: ${{ secrets.AZURE_TENANT_ID }}
+          AZ_CLIENT: ${{ secrets.AZURE_CLIENT_ID }}
+          AZ_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+        run: |
+          if [ -n "$AZ_TENANT" ] && [ -n "$AZ_CLIENT" ] && [ -n "$AZ_SECRET" ]; then
+            echo "has_signing=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_signing=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::Azure Trusted Signing secrets not configured. Windows build will be unsigned."
+          fi
+
+      - name: Build Windows packages
+        shell: bash
+        env:
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+        run: >
+          node --experimental-strip-types scripts/release/build.ts
+          --platform win --arch x64
+          --config electron-builder.canary.config.ts
+
+      - name: Verify Windows code signature
+        if: ${{ steps.signing.outputs.has_signing == 'true' }}
+        shell: bash
+        run: node --experimental-strip-types scripts/release/verify-win.ts
+
+      - name: Upload to R2
+        uses: ./.github/actions/upload-r2
+        with:
+          r2-account-id: ${{ secrets.R2_ACCOUNT_ID }}
+          r2-access-key-id: ${{ secrets.R2_ACCESS_KEY_ID }}
+          r2-secret-access-key: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          r2-bucket: ${{ secrets.R2_BUCKET }}
+          channel: v1-canary
+          prefix: emdash-canary
+
+  release-mac:
+    runs-on: macos-latest
+    permissions:
+      contents: read
+    environment: release
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-build
+        with:
+          posthog-key: ${{ secrets.POSTHOG_PROJECT_API_KEY }}
+          posthog-host: ${{ secrets.POSTHOG_HOST }}
+          build-variant: canary
+
+      - name: Import Apple signing certificate
+        uses: apple-actions/import-codesign-certs@v2
+        with:
+          p12-file-base64: ${{ secrets.CERTIFICATE_P12 }}
+          p12-password: ${{ secrets.CERTIFICATE_PASSWORD }}
+
+      - run: pnpm run build
+
+      - run: echo "NODE_OPTIONS=${NODE_OPTIONS:-not set}" && node --version
+
+      - name: Build signed DMGs + ZIPs
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: 'true'
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+        run: >
+          node --experimental-strip-types scripts/release/build.ts
+          --platform mac --arch ${{ github.event.inputs.arch || 'both' }} --targets dmg,zip
+          --config electron-builder.canary.config.ts
+
+      - name: Verify macOS bundle
+        run: >
+          node --experimental-strip-types scripts/release/verify-mac.ts
+          --expected-team-id ${{ secrets.APPLE_TEAM_ID }}
+
+      - name: Notarize and staple
+        env:
+          APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: node --experimental-strip-types scripts/release/notarize-mac.ts --app-bundle "Emdash Canary.app"
+
+      - name: Upload to R2
+        uses: ./.github/actions/upload-r2
+        with:
+          r2-account-id: ${{ secrets.R2_ACCOUNT_ID }}
+          r2-access-key-id: ${{ secrets.R2_ACCESS_KEY_ID }}
+          r2-secret-access-key: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          r2-bucket: ${{ secrets.R2_BUCKET }}
+          channel: v1-canary
+          prefix: emdash-canary