feat: add version bump workflow + release pipeline tests

- bump-electron.yml: auto bump both root + electron version on master
push, replacing the old sync-electron.yml version management
- release-pipeline.test.ts: validates full build chain (core → desktop →
esbuild → prepare-pack) and CI workflow file references

.github/workflows/bump-electron.yml

@@ -0,0 +1,83 @@
+name: Bump Electron version
+
+on:
+  push:
+    branches: [master]
+    paths-ignore:
+      - "packages/electron/package.json"
+      - "*.md"
+  workflow_dispatch:
+
+concurrency:
+  group: bump-electron
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check for new commits since last tag
+        id: check
+        run: |
+          LAST_TAG=$(git tag --sort=-v:refname | grep '^v' | head -1 || echo "")
+          if [ -z "$LAST_TAG" ]; then
+            echo "No previous tag, skipping"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Count non-merge, non-chore commits since last tag
+          NEW_COMMITS=$(git log "${LAST_TAG}..HEAD" --no-merges \
+            --pretty=format:"%s" | grep -cvE "^(chore|docs|ci)" || true)
+          if [ "$NEW_COMMITS" -eq 0 ]; then
+            echo "No meaningful commits since $LAST_TAG, skipping"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Found $NEW_COMMITS new commit(s) since $LAST_TAG"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          echo "last_tag=$LAST_TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Bump version + tag
+        if: steps.check.outputs.skip != 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          LAST_TAG="${{ steps.check.outputs.last_tag }}"
+          CURRENT="${LAST_TAG#v}"
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
+          NEW_PATCH=$((PATCH + 1))
+          NEW_VERSION="${MAJOR}.${MINOR}.${NEW_PATCH}"
+          NEW_TAG="v${NEW_VERSION}"
+
+          # Check tag doesn't already exist
+          if git rev-parse "$NEW_TAG" >/dev/null 2>&1; then
+            echo "Tag $NEW_TAG already exists, skipping"
+            exit 0
+          fi
+
+          # Bump both root and electron package versions
+          node -e "
+            const fs = require('fs');
+            for (const p of ['package.json', 'packages/electron/package.json']) {
+              const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
+              pkg.version = '${NEW_VERSION}';
+              fs.writeFileSync(p, JSON.stringify(pkg, null, 2) + '\n');
+            }
+          "
+
+          git add package.json packages/electron/package.json
+          git commit -m "chore: bump version to ${NEW_VERSION} [skip ci]"
+          git tag -a "$NEW_TAG" -m "Release ${NEW_TAG}"
+          git push origin master --follow-tags
+
+          echo "Bumped to $NEW_VERSION, tagged $NEW_TAG"

packages/electron/__tests__/release-pipeline.test.ts

@@ -0,0 +1,113 @@
+/**
+ * Release pipeline validation.
+ *
+ * Verifies the full build chain works end-to-end without actually
+ * running electron-builder (which downloads 100MB+ of Electron).
+ * Tests the sequence: core build → desktop build → esbuild → prepare-pack.
+ */
+
+import { describe, it, expect, afterAll } from "vitest";
+import { existsSync, rmSync, readFileSync, statSync } from "fs";
+import { resolve } from "path";
+import { execFileSync } from "child_process";
+
+const PKG_DIR = resolve(import.meta.dirname, "..");
+const ROOT_DIR = resolve(PKG_DIR, "..", "..");
+const DIST_ELECTRON = resolve(PKG_DIR, "dist-electron");
+
+describe("release pipeline", () => {
+  afterAll(() => {
+    // Clean up build artifacts
+    if (existsSync(DIST_ELECTRON)) rmSync(DIST_ELECTRON, { recursive: true });
+    // Clean up prepare-pack copies
+    try {
+      execFileSync("node", ["electron/prepare-pack.mjs", "--clean"], {
+        cwd: PKG_DIR,
+      });
+    } catch { /* ignore */ }
+  });
+
+  it("core build produces web assets", () => {
+    // Core should already be built (npm run build runs in CI before tests)
+    const publicDir = resolve(ROOT_DIR, "public");
+    const indexHtml = resolve(publicDir, "index.html");
+    expect(existsSync(publicDir)).toBe(true);
+    expect(existsSync(indexHtml)).toBe(true);
+  });
+
+  it("esbuild produces valid server bundle", () => {
+    execFileSync("node", ["electron/build.mjs"], {
+      cwd: PKG_DIR,
+      timeout: 30_000,
+    });
+
+    const serverMjs = resolve(DIST_ELECTRON, "server.mjs");
+    expect(existsSync(serverMjs)).toBe(true);
+    // Server bundle should be substantial (includes all deps)
+    expect(statSync(serverMjs).size).toBeGreaterThan(100_000);
+  });
+
+  it("esbuild produces valid main process bundle", () => {
+    const mainCjs = resolve(DIST_ELECTRON, "main.cjs");
+    expect(existsSync(mainCjs)).toBe(true);
+    // Main bundle is smaller (only Electron main process code)
+    expect(statSync(mainCjs).size).toBeGreaterThan(1000);
+  });
+
+  it("prepare-pack copies all required resources", () => {
+    execFileSync("node", ["electron/prepare-pack.mjs"], {
+      cwd: PKG_DIR,
+      timeout: 10_000,
+    });
+
+    // Verify all resources are in place for electron-builder
+    expect(existsSync(resolve(PKG_DIR, "config", "default.yaml"))).toBe(true);
+    expect(existsSync(resolve(PKG_DIR, "public", "index.html"))).toBe(true);
+    expect(existsSync(resolve(PKG_DIR, "bin"))).toBe(true);
+    expect(existsSync(resolve(PKG_DIR, "dist-electron", "main.cjs"))).toBe(true);
+    expect(existsSync(resolve(PKG_DIR, "dist-electron", "server.mjs"))).toBe(true);
+    expect(existsSync(resolve(PKG_DIR, "electron", "assets", "icon.png"))).toBe(true);
+    expect(existsSync(resolve(PKG_DIR, "package.json"))).toBe(true);
+  });
+
+  it("version is consistent between root and electron package", () => {
+    const rootPkg = JSON.parse(
+      readFileSync(resolve(ROOT_DIR, "package.json"), "utf-8"),
+    ) as { version: string };
+    const electronPkg = JSON.parse(
+      readFileSync(resolve(PKG_DIR, "package.json"), "utf-8"),
+    ) as { version: string };
+
+    // Versions may diverge (electron can be ahead), but both must be valid semver
+    expect(rootPkg.version).toMatch(/^\d+\.\d+\.\d+$/);
+    expect(electronPkg.version).toMatch(/^\d+\.\d+\.\d+$/);
+  });
+
+  it("release.yml references correct workflow steps", () => {
+    const releaseYml = readFileSync(
+      resolve(ROOT_DIR, ".github", "workflows", "release.yml"),
+      "utf-8",
+    );
+
+    // Must include workspace-aware build steps
+    expect(releaseYml).toContain("packages/electron");
+    expect(releaseYml).toContain("electron/build.mjs");
+    expect(releaseYml).toContain("prepare-pack.mjs");
+    expect(releaseYml).toContain("electron-builder");
+  });
+
+  it("bump-electron.yml workflow exists", () => {
+    const bumpYml = resolve(
+      ROOT_DIR,
+      ".github",
+      "workflows",
+      "bump-electron.yml",
+    );
+    expect(existsSync(bumpYml)).toBe(true);
+
+    const content = readFileSync(bumpYml, "utf-8");
+    // Must bump both root and electron package versions
+    expect(content).toContain("package.json");
+    expect(content).toContain("packages/electron/package.json");
+  });
+});