ci(electron): a Build / Electron run from main builds main's version tag

[JamieRuderman]

Why

"Use workflow from" on Build / Electron always opens on main, and GitHub has no setting to change that default. A release build has to run on the version tag, so every release meant switching to Tags and picking vN.N.N. Running it from main by mistake gave a compile-only build that published nothing.

What

• A run from main builds main's version tag. A new build_version_tag job reads the version from package.json and checks that v<version> has been pushed. It then runs gh workflow run build-electron.yml --ref v<version> with the same brand and skip_signing and ends; its summary links to the tag's runs. The tag run is an ordinary tag build, so the steps that check github.ref_type == 'tag' are unchanged. If the tag hasn't been pushed, the run fails and says so.
  • It uses package.json's version, not the newest tag by date. That's the tag npm version made for that code, and a tag from another release line can't be picked.
  • GITHUB_TOKEN can start a workflow_dispatch run (GitHub's one exception to its no-recursion rule), so the job only needs actions: write.
• build_main checkbox (off by default) builds main itself, compile-only, as a run from main did before. Runs on any other branch, and runs on a tag, are unchanged. "Refuse to sign a build that cannot publish" now names the checkbox in its message.
• A tag build refuses a version that is already published. prepare already looks up the release before creating the draft. It now fails when that release is live. electron-builder (default draft release type) would skip uploading anyway, but until now such a run built all three platforms, and signed them with signing on, before the Windows manifest step failed. This matters more now that the default run from main is a tag build.
• RELEASE.md section 2 describes the new flow.

Verified

• The workflow YAML parses; job conditions are exact complements (build_version_tag on main without build_main, prepare otherwise; release needs prepare).
• Ran the tag check against this repo: v3.50.0 is found, a missing tag fails git ls-remote --exit-code (exit 2).
• Ran the release check against real releases: v3.49.3 (published) is refused, v3.50.0 (draft) continues, an unknown version creates the draft.
• Not run end to end. The redirect only fires from main, so the first real check is the first run from main after merging. The tag run uses the workflow file at the tag, so for v3.50.0 (tagged before this change) the redirect works but the tag run has no published-release guard.

Signing default

skip_signing stays on by default (Jamie, 2026-10-13). A run from main with default inputs creates the version's draft with unsigned installers; a later signed run replaces them (electron-builder re-uploads on already_exists, and the manifest step uses --clobber).

[JamieRuderman]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T21:05:45.128833Z	68b7337	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 68b73374cf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[aws-amplify-us-west-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-1293.d20k671nqqv4kl.amplifyapp.com