ci: gate release publication on smoke tests

.github/workflows/build-linux.yml

@@ -189,6 +189,30 @@ jobs:
         run: |
           ./scripts/ci/verify_linux_package.sh "./${{ env.FULL_INSTALLER_NAME }}.deb" "${{ matrix.arch }}"
 
+      - name: Upload Linux RPM candidate
+        uses: actions/upload-artifact@v4
+        with:
+          name: lantern-installer-rpm-${{ matrix.arch }}
+          path: ${{ env.FULL_INSTALLER_NAME }}.rpm
+          if-no-files-found: error
+          retention-days: 2
+
+      - name: Upload Linux DEB candidate
+        uses: actions/upload-artifact@v4
+        with:
+          name: lantern-installer-deb-${{ matrix.arch }}
+          path: ${{ env.FULL_INSTALLER_NAME }}.deb
+          if-no-files-found: error
+          retention-days: 2
+
+      - name: Upload Linux Arch candidate
+        uses: actions/upload-artifact@v4
+        with:
+          name: lantern-installer-pkg-${{ matrix.arch }}
+          path: ${{ env.FULL_INSTALLER_NAME }}.pkg.tar.zst
+          if-no-files-found: error
+          retention-days: 2
+
       - name: Install .deb and verify postinst started daemon
         shell: bash
         run: |
@@ -307,24 +331,3 @@ jobs:
           if [[ "$AUTH_SMOKE_EXIT" -ne 0 ]]; then
             exit "$AUTH_SMOKE_EXIT"
           fi
-
-      - name: Upload Linux build
-        uses: actions/upload-artifact@v4
-        with:
-          name: lantern-installer-rpm-${{ matrix.arch }}
-          path: ${{ env.FULL_INSTALLER_NAME }}.rpm
-          retention-days: 2
-
-      - name: Upload Linux build
-        uses: actions/upload-artifact@v4
-        with:
-          name: lantern-installer-deb-${{ matrix.arch }}
-          path: ${{ env.FULL_INSTALLER_NAME }}.deb
-          retention-days: 2
-
-      - name: Upload Linux build (Arch)
-        uses: actions/upload-artifact@v4
-        with:
-          name: lantern-installer-pkg-${{ matrix.arch }}
-          path: ${{ env.FULL_INSTALLER_NAME }}.pkg.tar.zst
-          retention-days: 2

.github/workflows/build-windows.yml

@@ -386,6 +386,36 @@ jobs:
 
           Move-Item "dist/$env:APP_VERSION/$env:APP_NAME-$env:APP_VERSION-windows-setup.exe" "$env:FULL_INSTALLER_NAME.exe"
 
+      - name: Sign installer
+        if: ${{ inputs.package_installer && !inputs.skip_signing }}
+        shell: pwsh
+        env:
+          SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
+          SIGNPATH_SIGNING_POLICY: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
+          SIGNPATH_ORG_ID: ${{ vars.SIGNPATH_ORG_ID }}
+          SIGNPATH_PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
+          VERSION: ${{ inputs.version }}
+          FULL_INSTALLER_NAME: ${{ inputs.installer_base_name }}${{ inputs.build_type != 'production' && format('-{0}', inputs.build_type) || '' }}
+        run: |
+          ./scripts/ci/sign-windows.ps1 `
+            -FilePath "$env:FULL_INSTALLER_NAME.exe" `
+            -SigningPolicy $env:SIGNPATH_SIGNING_POLICY `
+            -OrganizationId $env:SIGNPATH_ORG_ID `
+            -ProjectSlug $env:SIGNPATH_PROJECT_SLUG `
+            -ApiToken $env:SIGNPATH_API_TOKEN `
+            -Description "Installer - GitHub Actions build $env:VERSION"
+
+      - name: Sign Windows update
+        if: ${{ inputs.package_installer && !inputs.skip_signing && inputs.build_type != 'nightly' && inputs.sign_update_artifact }}
+        shell: pwsh
+        env:
+          SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
+          FULL_INSTALLER_NAME: ${{ inputs.installer_base_name }}${{ inputs.build_type != 'production' && format('-{0}', inputs.build_type) || '' }}
+        run: |
+          & ".\.github\scripts\sign_windows_update.ps1" `
+            -InstallerPath "$env:FULL_INSTALLER_NAME.exe" `
+            -SignaturePath "$env:RUNNER_TEMP\$env:FULL_INSTALLER_NAME.exe.sparkle-signature"
+
       - name: Windows installer smoke suite
         if: ${{ inputs.package_installer && inputs.run_installer_smoke }}
         shell: pwsh
@@ -420,38 +450,13 @@ jobs:
         run: |
           flutter test integration_test/auth/auth_smoke_test.dart -d windows --reporter=expanded --dart-define=DISABLE_SYSTEM_TRAY=true
 
-      - name: Sign installer
-        if: ${{ inputs.package_installer && !inputs.skip_signing }}
-        shell: pwsh
-        env:
-          SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
-          FULL_INSTALLER_NAME: ${{ inputs.installer_base_name }}${{ inputs.build_type != 'production' && format('-{0}', inputs.build_type) || '' }}
-        run: |
-          ./scripts/ci/sign-windows.ps1 `
-            -FilePath "$env:FULL_INSTALLER_NAME.exe" `
-            -SigningPolicy "${{ env.SIGNPATH_SIGNING_POLICY }}" `
-            -OrganizationId "${{ vars.SIGNPATH_ORG_ID }}" `
-            -ProjectSlug "${{ vars.SIGNPATH_PROJECT_SLUG }}" `
-            -ApiToken $env:SIGNPATH_API_TOKEN `
-            -Description "Installer - GitHub Actions build ${{ inputs.version }}"
-
-      - name: Sign Windows update
-        if: ${{ inputs.package_installer && !inputs.skip_signing && inputs.build_type != 'nightly' && inputs.sign_update_artifact }}
-        shell: pwsh
-        env:
-          SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
-          FULL_INSTALLER_NAME: ${{ inputs.installer_base_name }}${{ inputs.build_type != 'production' && format('-{0}', inputs.build_type) || '' }}
-        run: |
-          & ".\.github\scripts\sign_windows_update.ps1" `
-            -InstallerPath "$env:FULL_INSTALLER_NAME.exe" `
-            -SignaturePath "$env:RUNNER_TEMP\$env:FULL_INSTALLER_NAME.exe.sparkle-signature"
-
       - name: Upload Windows installer
-        if: ${{ inputs.package_installer }}
+        if: ${{ always() && inputs.package_installer }}
         uses: actions/upload-artifact@v4
         with:
           name: lantern-installer-exe
           path: ${{ inputs.installer_base_name }}${{ inputs.build_type != 'production' && format('-{0}', inputs.build_type) || '' }}.exe
+          if-no-files-found: error
           retention-days: 2
 
       - name: Upload Windows update signature

.github/workflows/go.yml

@@ -32,7 +32,7 @@ jobs:
         run: go version
 
       - name: Cache Go modules
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/Library/Caches/go-build