Fail fast when desktop build resources are missing

[RhysSullivan]

Problem

The v1.6.1 desktop publish failed on both mac legs (x64 and arm64), twice, with:

⨯ Command failed: codesign ... --entitlements build/entitlements.mac.plist \
  ".../Electron Framework.framework/Versions/A/Resources/af.lproj/locale.pak"
build/entitlements.mac.plist: cannot read entitlement data

The named locale.pak is a red herring — it is just the first leaf codesign
reached. The real cause is that apps/desktop/build/entitlements.mac.plist
and build/icon.png were deleted by an unrelated PR, and the release tag was
cut from a commit that did not have them.

The runner image, Xcode, electron 41.2.1, electron-builder 26.8.1 and the
signing identity are byte-identical between the last good release and the
failing one, so none of those are involved.

build/ holds committed static inputs that no module imports. Deleting them
breaks no build, no type, and no test, so nothing caught it. The only signal
before the failure was a single line, default Electron icon is used, from
the missing icon — easy to miss, and it does not fail the build at all.

Fix

Give those files a reference so their absence is an error.

• apps/desktop/scripts/check-build-resources.ts reads the paths out of
  electron-builder.config.ts and reports any input that is missing, empty,
  or not a plist. It exits non-zero with the actual cause.
• apps/desktop/src/build-resources.test.ts asserts the same check passes.
  This runs in bun run test on every PR, which is the gate that would have
  blocked the deletion.
• publish-desktop.yml runs the check right after dependency install, so a
  tag missing these files fails in seconds instead of ~8 minutes later inside
  codesign with a misleading message.

No signing, packaging, or config behaviour changes.

Testing

• bun ./scripts/check-build-resources.ts passes on a good tree, and exits 1
  naming both files when they are removed.
• vitest run src/build-resources.test.ts passes, and fails with
  missing: build/entitlements.mac.plist when the file is removed.
• Full desktop unit suite: 10 files, 38 tests passing.
• typecheck, lint, and format are clean.

This PR does not by itself make v1.6.1 buildable — the tag still points at a
commit without the files. The assets are already restored on main (#1805), so
the release needs to be re-cut from a commit that includes them. Final proof
is the re-dispatched desktop build going green.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	0d4e1d4	Aug 28 2026, 07:00 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	0d4e1d4	Commit Preview URL Branch Preview URL	Aug 28 2026, 06:58 AM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1807

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1807

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1807

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1807

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1807

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1807

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1807

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1807

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1807

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1807

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1807

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1807

executor

npm i https://pkg.pr.new/executor@1807

commit: 0d4e1d4