fix(ci): skip desktop updater feed when signing key is unavailable

[A-x6]

Issue for this PR

Closes #40

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Release run 30585007660 (v2.0.0) failed at its final step: finalize-latest-json.ts signs desktop update artifacts via bunx @tauri-apps/cli signer sign, and the fork's TAURI_SIGNING_PRIVATE_KEY secret is not a valid minisign key (incorrect updater private key password: Missing comment in secret key). That killed the release after npm and Docker had already published, leaving the GitHub release stuck in draft with no version tag pushed.

This applies the same partial-release policy the workflow already uses for electron/signing legs: the updater feed skips itself with a workflow warning instead of failing the release.

const feed = await $`bun ./packages/desktop/scripts/finalize-latest-json.ts`.nothrow()
if (feed.exitCode !== 0) {
  console.warn(feed.stdout.toString())
  console.warn(feed.stderr.toString())
  console.warn(
    "::warning::skipping desktop updater feed: finalize-latest-json failed (missing or invalid TAURI_SIGNING_PRIVATE_KEY?)",
  )
}

finalize-latest-yml.ts keeps running unconditionally since electron-updater's latest.yml relies on embedded sha512 checksums, not the Tauri key. The consequence of a skip is only that the desktop app won't discover the version via auto-update; the proper long-term fix (generate a Bolt updater keypair and embed its public key in the desktop updater config) is tracked in #40.

How did you verify your code works?

bun build --no-bundle script/publish.ts parses clean and the failure output is preserved in the log via the captured stdout/stderr. The change is a .nothrow() guard around an existing invocation; behavior with a valid key is unchanged.

Screenshots / recordings

Not a UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
bolt-cli-app	Ready	Preview	Jul 30, 2026 10:28pm

[coderabbitai]

Warning

Review limit reached

@DevFlex-AI, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 2 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3fc2ee8b-8ade-45fc-8ce8-cdad8b842788

📥 Commits

Reviewing files that changed from the base of the PR and between e01dc93 and 56ec879.

📒 Files selected for processing (1)

• script/publish.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

The following comment was made by an LLM, it may be inaccurate: