feat(desktop): add time-based staged rollout for stable updates

Linear ramp from 0% at publish to 100% at releaseDate + rolloutHours
(default 24h, configurable per release). Beta channel and rolloutHours=0
short-circuit to admit everyone. Per-machine bucket derives from a
persistent UUID at <userData>/.updaterId and feeds electron-updater's
isUserWithinRollout hook.

Adds desktop-rollout.yml workflow for in-place rolloutHours edits on
already-published releases (hotfix to 0 or extend the ramp), serialized
against finalize-rollout in desktop-release.yml via a shared concurrency
group keyed on the tag. Replaces the hand-rolled mac manifest merge
with a js-yaml round-trip that preserves unknown fields.

.github/workflows/desktop-release.yml

@@ -37,6 +37,11 @@ on:
         options:
           - "true"
           - "false"
+      rollout_hours:
+        description: "Linear rollout duration in hours. Use 0 for instant rollout."
+        required: false
+        default: "24"
+        type: string
 
 concurrency:
   group: desktop-release-${{ github.ref }}
@@ -46,6 +51,7 @@ env:
   SOURCE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
   CHECKOUT_REF: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.checkout_ref || github.ref_name) || github.ref_name }}
   SHOULD_PUBLISH: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.publish != 'false' }}
+  ROLLOUT_HOURS: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.rollout_hours || '24' }}
   DESKTOP_WORKSPACE: "@getpaseo/desktop"
   DESKTOP_PACKAGE_PATH: "packages/desktop"
 
@@ -187,13 +193,30 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: scripts
+          sparse-checkout: |
+            package.json
+            package-lock.json
+            scripts
           ref: ${{ env.CHECKOUT_REF }}
 
       - name: Resolve release tag
         shell: bash
         run: node scripts/emit-release-env.mjs --source-tag "$SOURCE_TAG" >> "$GITHUB_ENV"
 
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: package-lock.json
+          registry-url: "https://npm.pkg.github.com"
+          scope: "@boudra"
+
+      - name: Install JS dependencies
+        run: npm ci
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Download manifest artifacts
         if: env.IS_SMOKE_TAG != 'true'
         uses: actions/download-artifact@v4
@@ -205,68 +228,11 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-
-          node <<'NODE'
-          const fs = require('node:fs');
-
-          // Simple YAML parser for electron-builder's latest-mac.yml format
-          function parseManifest(text) {
-            const lines = text.split('\n');
-            const result = { files: [] };
-            let currentFile = null;
-
-            for (const line of lines) {
-              if (line.startsWith('version:')) result.version = line.split(': ')[1].trim();
-              else if (line.startsWith('path:')) result.path = line.split(': ')[1].trim();
-              else if (line.startsWith('sha512:') && !currentFile) result.sha512 = line.split(': ')[1].trim();
-              else if (line.startsWith('releaseDate:')) result.releaseDate = line.split(': ')[1].trim().replace(/'/g, '');
-              else if (line.trim().startsWith('- url:')) {
-                currentFile = { url: line.trim().replace('- url: ', '') };
-                result.files.push(currentFile);
-              } else if (line.trim().startsWith('sha512:') && currentFile) {
-                currentFile.sha512 = line.trim().split(': ')[1].trim();
-              } else if (line.trim().startsWith('size:') && currentFile) {
-                currentFile.size = parseInt(line.trim().split(': ')[1].trim(), 10);
-                currentFile = null;
-              }
-            }
-            return result;
-          }
-
-          function toYaml(manifest) {
-            let out = `version: ${manifest.version}\n`;
-            out += `files:\n`;
-            for (const f of manifest.files) {
-              out += `  - url: ${f.url}\n`;
-              out += `    sha512: ${f.sha512}\n`;
-              out += `    size: ${f.size}\n`;
-            }
-            out += `path: ${manifest.path}\n`;
-            out += `sha512: ${manifest.sha512}\n`;
-            out += `releaseDate: '${manifest.releaseDate}'\n`;
-            return out;
-          }
-
-          const manifestName = `${process.env.RELEASE_CHANNEL}-mac.yml`;
-          const arm64Text = fs.readFileSync(`mac-manifest-arm64/${manifestName}`, 'utf8');
-          const x64Text = fs.readFileSync(`mac-manifest-x64/${manifestName}`, 'utf8');
-
-          const arm64 = parseManifest(arm64Text);
-          const x64 = parseManifest(x64Text);
-
-          // Merge: all files from both, default path points to arm64 zip
-          const merged = {
-            version: arm64.version,
-            files: [...arm64.files, ...x64.files],
-            path: arm64.path,
-            sha512: arm64.sha512,
-            releaseDate: arm64.releaseDate || x64.releaseDate,
-          };
-
-          const output = toYaml(merged);
-          fs.writeFileSync(manifestName, output);
-          console.log('Merged manifest:\n' + output);
-          NODE
+          manifest_name="${RELEASE_CHANNEL}-mac.yml"
+          node scripts/merge-mac-manifest.mjs \
+            "mac-manifest-arm64/${manifest_name}" \
+            "mac-manifest-x64/${manifest_name}" \
+            "${manifest_name}"
 
       - name: Upload merged manifest to release
         if: env.IS_SMOKE_TAG != 'true'
@@ -424,3 +390,60 @@ jobs:
           fi
 
           npm run build --workspace="$DESKTOP_WORKSPACE" "${build_args[@]}"
+
+  finalize-rollout:
+    needs: [publish-macos, finalize-mac-manifest, publish-linux, publish-windows]
+    if: ${{ always() && (needs.publish-macos.result == 'success' || needs.publish-macos.result == 'skipped') && (needs.finalize-mac-manifest.result == 'success' || needs.finalize-mac-manifest.result == 'skipped') && (needs.publish-linux.result == 'success' || needs.publish-linux.result == 'skipped') && (needs.publish-windows.result == 'success' || needs.publish-windows.result == 'skipped') && (github.event_name != 'workflow_dispatch' || github.event.inputs.publish != 'false') }}
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    concurrency:
+      group: desktop-rollout-${{ github.event.inputs.tag || github.ref_name }}
+      cancel-in-progress: false
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            package.json
+            package-lock.json
+            scripts
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Resolve release tag
+        shell: bash
+        run: node scripts/emit-release-env.mjs --source-tag "$SOURCE_TAG" >> "$GITHUB_ENV"
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: package-lock.json
+          registry-url: "https://npm.pkg.github.com"
+          scope: "@boudra"
+
+      - name: Install JS dependencies
+        run: npm ci
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Stamp rollout metadata
+        if: env.IS_SMOKE_TAG != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir release-manifests
+          cd release-manifests
+          gh release download "$RELEASE_TAG" --repo "${{ github.repository }}" --pattern "${RELEASE_CHANNEL}*.yml"
+          shopt -s nullglob
+          files=( ./*.yml )
+          if (( ${#files[@]} == 0 )); then
+            echo "::error::No manifests matched ${RELEASE_CHANNEL}*.yml on $RELEASE_TAG"
+            exit 1
+          fi
+          timestamp="$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")"
+          node ../scripts/stamp-rollout.mjs --release-date "$timestamp" --rollout-hours "$ROLLOUT_HOURS" "${files[@]}"
+          gh release upload "$RELEASE_TAG" "${files[@]}" --clobber --repo "${{ github.repository }}"

.github/workflows/desktop-rollout.yml

@@ -0,0 +1,152 @@
+name: Desktop Rollout
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to re-stamp (e.g. v0.1.42)."
+        required: true
+        type: string
+      rollout_hours:
+        description: "Total rollout duration since the original release date, in hours. Use 0 to admit everyone immediately."
+        required: true
+        type: string
+
+concurrency:
+  group: desktop-rollout-${{ inputs.tag }}
+  cancel-in-progress: false
+
+env:
+  SOURCE_TAG: ${{ inputs.tag }}
+
+jobs:
+  stamp:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            package.json
+            package-lock.json
+            scripts
+
+      - name: Resolve release metadata
+        shell: bash
+        run: node scripts/emit-release-env.mjs --source-tag "$SOURCE_TAG" >> "$GITHUB_ENV"
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: package-lock.json
+          registry-url: "https://npm.pkg.github.com"
+          scope: "@boudra"
+
+      - name: Install JS dependencies
+        run: npm ci
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Download release manifests
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir release-manifests
+          cd release-manifests
+          gh release download "$RELEASE_TAG" --repo "${{ github.repository }}" --pattern "${RELEASE_CHANNEL}*.yml"
+          shopt -s nullglob
+          files=( ./*.yml )
+          if (( ${#files[@]} == 0 )); then
+            echo "::error::No manifests matched ${RELEASE_CHANNEL}*.yml on $RELEASE_TAG"
+            exit 1
+          fi
+          echo "Downloaded ${#files[@]} manifest(s):"
+          printf '  %s\n' "${files[@]}"
+
+      - name: Capture before state
+        id: before
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd release-manifests
+          summary=$(node -e '
+            const yaml = require("js-yaml");
+            const fs = require("fs");
+            for (const f of process.argv.slice(1)) {
+              const m = yaml.load(fs.readFileSync(f, "utf8")) ?? {};
+              console.log(`  ${f}: rolloutHours=${m.rolloutHours ?? "<unset>"} releaseDate=${m.releaseDate ?? "<unset>"}`);
+            }
+          ' ./*.yml)
+          echo "$summary"
+          {
+            echo "summary<<EOF"
+            echo "$summary"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Re-stamp rolloutHours
+        env:
+          NEW_HOURS: ${{ inputs.rollout_hours }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd release-manifests
+          node ../scripts/stamp-rollout.mjs --rollout-hours "$NEW_HOURS" ./*.yml
+
+      - name: Validate rewritten manifests
+        env:
+          EXPECTED: ${{ inputs.rollout_hours }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd release-manifests
+          node -e '
+            const yaml = require("js-yaml");
+            const fs = require("fs");
+            const expected = Number(process.env.EXPECTED);
+            if (!Number.isFinite(expected) || expected < 0) {
+              throw new Error(`EXPECTED must be a non-negative number, got ${process.env.EXPECTED}`);
+            }
+            for (const f of process.argv.slice(1)) {
+              const m = yaml.load(fs.readFileSync(f, "utf8")) ?? {};
+              if (m.rolloutHours !== expected) {
+                throw new Error(`${f}: rolloutHours=${m.rolloutHours}, expected ${expected}`);
+              }
+              if (typeof m.version !== "string" || m.version.length === 0) {
+                throw new Error(`${f}: missing or invalid version`);
+              }
+            }
+          ' ./*.yml
+
+      - name: Upload to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd release-manifests
+          gh release upload "$RELEASE_TAG" ./*.yml --clobber --repo "${{ github.repository }}"
+
+      - name: Write summary
+        env:
+          BEFORE: ${{ steps.before.outputs.summary }}
+        shell: bash
+        run: |
+          {
+            echo "## Rollout updated"
+            echo ""
+            echo "**Tag:** \`$RELEASE_TAG\`"
+            echo "**Channel:** \`$RELEASE_CHANNEL\`"
+            echo "**New rolloutHours:** \`${{ inputs.rollout_hours }}\`"
+            echo ""
+            echo "### Before"
+            echo '```'
+            echo "$BEFORE"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"