.github/workflows/ci.ymlrunsbun run lint,bun run typecheck, andbun run teston pull requests and pushes tomain..github/workflows/release.ymlbuilds macOS (arm64andx64), Linux (x64), and Windows (x64) desktop artifacts from a singlev*.*.*tag and publishes one GitHub release.- The release workflow auto-enables signing only when platform credentials are present. macOS passkey builds additionally require
APPLE_TEAM_IDand theMACOS_PROVISIONING_PROFILEsecret; Windows uses Azure Trusted Signing. Without the core signing credentials, it still releases unsigned artifacts. - See Release Checklist for the full release/signing setup checklist.