revert: roll back post-5831626 CI pipeline changes

.github/workflows/release-macos-aarch64.yml

@@ -60,7 +60,7 @@ concurrency:
 jobs:
   resolve-release:
     name: Resolve Release Metadata
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     outputs:
       release_tag: ${{ steps.resolve.outputs.release_tag }}
       release_name: ${{ steps.resolve.outputs.release_name }}
@@ -203,7 +203,7 @@ jobs:
   verify-release:
     name: Verify Release Versions
     needs: resolve-release
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     env:
       RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
     steps:
@@ -225,15 +225,19 @@ jobs:
         run: node scripts/release/review.mjs --strict
 
   publish-tauri:
-    name: Build + Package (${{ matrix.target }})
+    name: Build + Publish (${{ matrix.target }})
     needs: [resolve-release, verify-release]
     if: needs.resolve-release.outputs.build_tauri == 'true'
-    # Use explicit per-target runner labels so each release build can scale independently.
-    runs-on: ${{ matrix.runs_on }}
+    # Set OPENWORK_LINUX_X64_RUNNER_LABEL to route only the Linux x86_64 build to a larger runner.
+    runs-on: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL != '' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL || matrix.platform }}
     timeout-minutes: 360
     env:
+      RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
+      RELEASE_NAME: ${{ needs.resolve-release.outputs.release_name }}
+      RELEASE_BODY: ${{ needs.resolve-release.outputs.release_body }}
+      RELEASE_DRAFT: ${{ needs.resolve-release.outputs.draft }}
+      RELEASE_PRERELEASE: ${{ needs.resolve-release.outputs.prerelease }}
       MACOS_NOTARIZE: ${{ needs.resolve-release.outputs.notarize }}
-      RUSTFLAGS: ${{ matrix.os_type == 'linux' && '-C link-arg=-fuse-ld=lld' || '' }}
       # Ensure Tauri's beforeBuildCommand (prepare:sidecar) uses our fork.
       OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
       OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
@@ -242,32 +246,36 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os_type: macos
+          - platform: macos-14
+            os_type: macos
             target: aarch64-apple-darwin
-            runs_on: macos-latest
             args: "--target aarch64-apple-darwin --bundles dmg,app"
-          - os_type: macos
+          - platform: macos-14
+            os_type: macos
             target: x86_64-apple-darwin
-            runs_on: macos-26-intel
             args: "--target x86_64-apple-darwin --bundles dmg,app"
-          - os_type: linux
+          - platform: ubuntu-22.04
+            os_type: linux
             target: x86_64-unknown-linux-gnu
-            runs_on: blacksmith-16vcpu-ubuntu-2404
             args: "--target x86_64-unknown-linux-gnu --bundles deb,rpm"
-          - os_type: windows
+          - platform: ubuntu-22.04-arm
+            os_type: linux
+            target: aarch64-unknown-linux-gnu
+            args: "--target aarch64-unknown-linux-gnu --bundles deb,rpm"
+          - platform: windows-2022
+            os_type: windows
             target: x86_64-pc-windows-msvc
-            runs_on: blacksmith-16vcpu-windows-2025
             args: "--target x86_64-pc-windows-msvc --bundles msi"
 
     steps:
       - name: Log runner selection
         shell: bash
         run: |
-          echo "Configured runs-on: ${RUNS_ON}"
-          echo "Build target: ${TARGET}"
+          echo "Requested larger runner label: ${RUNNER_LABEL:-<unset>}"
+          echo "Effective runs-on: ${EFFECTIVE_RUNS_ON}"
         env:
-          RUNS_ON: ${{ matrix.runs_on }}
-          TARGET: ${{ matrix.target }}
+          RUNNER_LABEL: ${{ vars.OPENWORK_LINUX_X64_RUNNER_LABEL }}
+          EFFECTIVE_RUNS_ON: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL != '' && vars.OPENWORK_LINUX_X64_RUNNER_LABEL || matrix.platform }}
 
       - name: Enable git long paths (Windows)
         if: matrix.os_type == 'windows'
@@ -277,23 +285,219 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: ${{ needs.resolve-release.outputs.release_tag }}
+          ref: ${{ env.RELEASE_TAG }}
           fetch-depth: 0
 
-      - name: Setup desktop build environment
-        uses: ./.github/actions/setup-desktop-build-env
+      - name: Setup Node
+        uses: actions/setup-node@v4
         with:
-          os-type: ${{ matrix.os_type }}
-          rust-target: ${{ matrix.target }}
+          node-version: 20
 
-      - name: Install OpenCode sidecar
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.27.0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.6"
+
+      - name: Get pnpm store path
+        id: pnpm-store
+        shell: bash
+        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v4
+        continue-on-error: true
+        with:
+          path: ${{ steps.pnpm-store.outputs.path }}
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        continue-on-error: true
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            packages/desktop/src-tauri/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('packages/desktop/src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --prefer-offline
+
+      - name: Install OpenTUI x64 core (macOS x86_64)
+        if: matrix.os_type == 'macos' && matrix.target == 'x86_64-apple-darwin'
+        run: pnpm add -w --ignore-workspace-root-check @opentui/core-darwin-x64@0.1.77
+
+      - name: Install Linux build dependencies
+        if: matrix.os_type == 'linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libgtk-3-dev \
+            libglib2.0-dev \
+            libayatana-appindicator3-dev \
+            libsoup-3.0-dev \
+            libwebkit2gtk-4.1-dev \
+            libssl-dev \
+            rpm \
+            libdbus-1-dev \
+            librsvg2-dev
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Resolve OpenCode version
+        id: opencode-version
+        shell: bash
         env:
           GITHUB_TOKEN: ${{ github.token }}
           OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
           OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
-          TARGET: ${{ matrix.target }}
-          OS_TYPE: ${{ matrix.os_type }}
-        run: node scripts/release/install-opencode-sidecar.mjs
+        run: |
+          node <<'NODE' >> "$GITHUB_OUTPUT"
+          const fs = require('fs');
+          const repo = (process.env.OPENCODE_GITHUB_REPO || 'anomalyco/opencode').trim() || 'anomalyco/opencode';
+
+          async function resolveLatest() {
+            const token = (process.env.GITHUB_TOKEN || '').trim();
+            const headers = {
+              'Accept': 'application/vnd.github+json',
+              'X-GitHub-Api-Version': '2022-11-28',
+              'User-Agent': 'openwork-ci',
+            };
+            if (token) headers.Authorization = `Bearer ${token}`;
+
+            // Prefer API, but fall back to the web "latest" redirect if rate-limited (403) or otherwise blocked.
+            try {
+              const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, { headers });
+              if (res.ok) {
+                const data = await res.json();
+                const tag = (typeof data.tag_name === 'string' ? data.tag_name : '').trim();
+                let v = tag.startsWith('v') ? tag.slice(1) : tag;
+                v = v.trim();
+                if (v) return v;
+              }
+              if (res.status !== 403) {
+                throw new Error(`Failed to resolve latest OpenCode version (HTTP ${res.status})`);
+              }
+            } catch {
+              // continue to fallback
+            }
+
+            const web = await fetch(`https://github.com/${repo}/releases/latest`, {
+              headers: { 'User-Agent': 'openwork-ci' },
+              redirect: 'follow',
+            });
+            const url = (web && web.url) ? String(web.url) : '';
+            const match = url.match(/\/tag\/v([^/?#]+)/);
+            if (!match) throw new Error('Failed to resolve latest OpenCode version (web redirect).');
+            return match[1];
+          }
+
+          async function main() {
+            const pkg = JSON.parse(fs.readFileSync('./packages/desktop/package.json', 'utf8'));
+            const configuredRaw = (process.env.OPENCODE_VERSION || pkg.opencodeVersion || '').toString().trim();
+            if (configuredRaw && configuredRaw.toLowerCase() !== 'latest') {
+              const normalized = configuredRaw.startsWith('v') ? configuredRaw.slice(1) : configuredRaw;
+              const resolved = normalized.trim();
+              if (process.env.GITHUB_ENV) {
+                fs.appendFileSync(process.env.GITHUB_ENV, `OPENCODE_VERSION=${resolved}\n`);
+              }
+              console.log('version=' + resolved);
+              return;
+            }
+            const latest = await resolveLatest();
+            if (process.env.GITHUB_ENV) {
+              fs.appendFileSync(process.env.GITHUB_ENV, `OPENCODE_VERSION=${latest}\n`);
+            }
+            console.log('version=' + latest);
+          }
+
+          main().catch((err) => {
+            console.error(err);
+            process.exit(1);
+          });
+          NODE
+
+      - name: Download OpenCode sidecar
+        shell: bash
+        env:
+          OPENCODE_VERSION: ${{ steps.opencode-version.outputs.version }}
+          OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
+        run: |
+          set -euo pipefail
+
+          case "${{ matrix.target }}" in
+            aarch64-apple-darwin)
+              opencode_asset="opencode-darwin-arm64.zip"
+              ;;
+            x86_64-apple-darwin)
+              opencode_asset="opencode-darwin-x64-baseline.zip"
+              ;;
+            x86_64-unknown-linux-gnu)
+              opencode_asset="opencode-linux-x64-baseline.tar.gz"
+              ;;
+            aarch64-unknown-linux-gnu)
+              opencode_asset="opencode-linux-arm64.tar.gz"
+              ;;
+            x86_64-pc-windows-msvc)
+              opencode_asset="opencode-windows-x64-baseline.zip"
+              ;;
+            *)
+              echo "Unsupported target: ${{ matrix.target }}" >&2
+              exit 1
+              ;;
+          esac
+
+          repo="${OPENCODE_GITHUB_REPO:-anomalyco/opencode}"
+          url="https://github.com/${repo}/releases/download/v${OPENCODE_VERSION}/${opencode_asset}"
+          tmp_dir="$RUNNER_TEMP/opencode"
+          extract_dir="$tmp_dir/extracted"
+          rm -rf "$tmp_dir"
+          mkdir -p "$extract_dir"
+          curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 -o "$tmp_dir/$opencode_asset" "$url"
+
+          if [[ "$opencode_asset" == *.tar.gz ]]; then
+            tar -xzf "$tmp_dir/$opencode_asset" -C "$extract_dir"
+          else
+            if command -v unzip >/dev/null 2>&1; then
+              unzip -q "$tmp_dir/$opencode_asset" -d "$extract_dir"
+            elif command -v 7z >/dev/null 2>&1; then
+              7z x "$tmp_dir/$opencode_asset" -o"$extract_dir" >/dev/null
+            else
+              echo "No unzip utility available" >&2
+              exit 1
+            fi
+          fi
+
+          if [ -f "$extract_dir/opencode" ]; then
+            bin_path="$extract_dir/opencode"
+          elif [ -f "$extract_dir/opencode.exe" ]; then
+            bin_path="$extract_dir/opencode.exe"
+          else
+            echo "OpenCode binary not found in archive" >&2
+            ls -la "$extract_dir"
+            exit 1
+          fi
+
+          target_name="opencode-${{ matrix.target }}"
+          if [ "${{ matrix.os_type }}" = "windows" ]; then
+            target_name="${target_name}.exe"
+          fi
+
+          mkdir -p packages/desktop/src-tauri/sidecars
+          cp "$bin_path" "packages/desktop/src-tauri/sidecars/${target_name}"
+          chmod 755 "packages/desktop/src-tauri/sidecars/${target_name}"
 
       - name: Write notary API key
         if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true'
@@ -308,32 +512,102 @@ jobs:
 
           echo "NOTARY_KEY_PATH=$NOTARY_KEY_PATH" >> "$GITHUB_ENV"
 
-      - name: Build desktop workflow artifacts
-        uses: ./.github/actions/run-tauri-release-build
+      - name: Build + upload (notarized)
+        if: matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true'
+        uses: tauri-apps/tauri-action@390cbe447412ced1303d35abe75287949e43437a
         env:
+          CI: true
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+          # Tauri updater signing
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
+          # macOS signing
           APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+
+          # macOS notarization (App Store Connect API key)
           APPLE_API_KEY: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
           APPLE_API_ISSUER: ${{ secrets.APPLE_NOTARY_API_ISSUER_ID }}
           APPLE_API_KEY_PATH: ${{ env.NOTARY_KEY_PATH }}
         with:
-          os-type: ${{ matrix.os_type }}
-          notarize: ${{ matrix.os_type == 'macos' && env.MACOS_NOTARIZE == 'true' }}
+          tagName: ${{ env.RELEASE_TAG }}
+          releaseName: ${{ env.RELEASE_NAME }}
+          releaseBody: ${{ env.RELEASE_BODY }}
+          releaseDraft: ${{ env.RELEASE_DRAFT == 'true' }}
+          prerelease: ${{ env.RELEASE_PRERELEASE == 'true' }}
+          projectPath: packages/desktop
+          tauriScript: pnpm exec tauri -vvv
           args: ${{ matrix.args }}
-          upload-updater-json: false
-          updater-json-prefer-nsis: true
-          workflow-artifact-name-pattern: desktop-release-[platform]-[arch]-[bundle]
+          retryAttempts: 3
+          uploadUpdaterJson: false
+          updaterJsonPreferNsis: true
+          releaseAssetNamePattern: openwork-desktop-[platform]-[arch][ext]
+
+      - name: Build + upload
+        if: matrix.os_type != 'macos' || env.MACOS_NOTARIZE != 'true'
+        uses: tauri-apps/tauri-action@390cbe447412ced1303d35abe75287949e43437a
+        env:
+          CI: true
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+          # Tauri updater signing
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
+          # macOS signing
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CODESIGN_CERT_P12_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CODESIGN_CERT_PASSWORD }}
+        with:
+          tagName: ${{ env.RELEASE_TAG }}
+          releaseName: ${{ env.RELEASE_NAME }}
+          releaseBody: ${{ env.RELEASE_BODY }}
+          releaseDraft: ${{ env.RELEASE_DRAFT == 'true' }}
+          prerelease: ${{ env.RELEASE_PRERELEASE == 'true' }}
+          projectPath: packages/desktop
+          tauriScript: pnpm exec tauri -vvv
+          args: ${{ matrix.args }}
+          retryAttempts: 3
+          uploadUpdaterJson: false
+          updaterJsonPreferNsis: true
+          releaseAssetNamePattern: openwork-desktop-[platform]-[arch][ext]
 
       - name: Verify versions.json bundled (macOS)
         if: success() && matrix.os_type == 'macos'
         shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          app_path="packages/desktop/src-tauri/target/${{ matrix.target }}/release/bundle/macos/OpenWork.app"
+
+          case "${{ matrix.target }}" in
+            aarch64-apple-darwin)
+              asset_arch="aarch64"
+              ;;
+            x86_64-apple-darwin)
+              asset_arch="x64"
+              ;;
+            *)
+              echo "Unexpected target for macOS verify: ${{ matrix.target }}" >&2
+              exit 1
+              ;;
+          esac
+
+          tmp_dir="$RUNNER_TEMP/openwork-bundle-verify"
+          rm -rf "$tmp_dir"
+          mkdir -p "$tmp_dir"
+
+          gh release download "${RELEASE_TAG}" \
+            --repo "$GITHUB_REPOSITORY" \
+            --pattern "openwork-desktop-darwin-${asset_arch}.app.tar.gz" \
+            --dir "$tmp_dir"
+
+          tar -xzf "$tmp_dir/openwork-desktop-darwin-${asset_arch}.app.tar.gz" -C "$tmp_dir"
+
+          app_path="$tmp_dir/OpenWork.app"
           manifest_path="$app_path/Contents/MacOS/versions.json"
 
           if [ ! -f "$manifest_path" ]; then
@@ -344,154 +618,11 @@ jobs:
 
           echo "Found bundled versions.json at $manifest_path"
 
-  build-tauri-linux-arm64:
-    name: Build ARM64 Linux binary
-    needs: [resolve-release, verify-release]
-    if: needs.resolve-release.outputs.build_tauri == 'true'
-    runs-on: blacksmith-16vcpu-ubuntu-2404-arm
-    timeout-minutes: 360
-    env:
-      RUSTFLAGS: -C link-arg=-fuse-ld=lld
-      OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
-      OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
-    steps:
-      - name: Log runner selection
-        shell: bash
-        run: |
-          echo "Configured runs-on: blacksmith-16vcpu-ubuntu-2404-arm"
-          echo "Build target: aarch64-unknown-linux-gnu"
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.resolve-release.outputs.release_tag }}
-          fetch-depth: 0
-
-      - name: Setup desktop build environment
-        uses: ./.github/actions/setup-desktop-build-env
-        with:
-          os-type: linux
-          rust-target: aarch64-unknown-linux-gnu
-
-      - name: Install OpenCode sidecar
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
-          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
-          TARGET: aarch64-unknown-linux-gnu
-          OS_TYPE: linux
-        run: node scripts/release/install-opencode-sidecar.mjs
-
-      - name: Build ARM64 binary without bundling
-        run: pnpm --dir packages/desktop exec tauri build --target aarch64-unknown-linux-gnu --no-bundle
-
-      - name: Upload ARM64 target directory
-        uses: actions/upload-artifact@v4
-        with:
-          name: desktop-build-linux-arm64-target-dir
-          path: packages/desktop/src-tauri/target/aarch64-unknown-linux-gnu
-          if-no-files-found: error
-
-  bundle-tauri-linux-arm64:
-    name: Bundle ARM64 Linux packages
-    needs: [resolve-release, verify-release, build-tauri-linux-arm64]
-    if: needs.resolve-release.outputs.build_tauri == 'true'
-    runs-on: blacksmith-16vcpu-ubuntu-2404
-    timeout-minutes: 360
-    env:
-      RUSTFLAGS: -C link-arg=-fuse-ld=lld
-      OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
-      OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
-    steps:
-      - name: Log runner selection
-        shell: bash
-        run: |
-          echo "Configured runs-on: blacksmith-16vcpu-ubuntu-2404"
-          echo "Bundle target: aarch64-unknown-linux-gnu"
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.resolve-release.outputs.release_tag }}
-          fetch-depth: 0
-
-      - name: Setup desktop build environment
-        uses: ./.github/actions/setup-desktop-build-env
-        with:
-          os-type: linux
-          rust-target: aarch64-unknown-linux-gnu
-
-      - name: Install OpenCode sidecar
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          OPENCODE_GITHUB_REPO: ${{ vars.OPENCODE_GITHUB_REPO || 'anomalyco/opencode' }}
-          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION || '1.2.20' }}
-          TARGET: aarch64-unknown-linux-gnu
-          OS_TYPE: linux
-        run: node scripts/release/install-opencode-sidecar.mjs
-
-      - name: Restore ARM64 target directory
-        uses: actions/download-artifact@v4
-        with:
-          name: desktop-build-linux-arm64-target-dir
-          path: packages/desktop/src-tauri/target
-
-      - name: Bundle ARM64 Linux packages on x86 runner
-        run: pnpm --dir packages/desktop exec tauri bundle --target aarch64-unknown-linux-gnu --bundles deb,rpm
-
-      - name: Upload ARM64 deb workflow artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: desktop-release-linux-arm64-deb
-          path: |
-            packages/desktop/src-tauri/target/aarch64-unknown-linux-gnu/release/bundle/deb/*.deb
-            packages/desktop/src-tauri/target/aarch64-unknown-linux-gnu/release/bundle/deb/*.deb.sig
-          if-no-files-found: error
-
-      - name: Upload ARM64 rpm workflow artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: desktop-release-linux-aarch64-rpm
-          path: |
-            packages/desktop/src-tauri/target/aarch64-unknown-linux-gnu/release/bundle/rpm/*.rpm
-            packages/desktop/src-tauri/target/aarch64-unknown-linux-gnu/release/bundle/rpm/*.rpm.sig
-          if-no-files-found: error
-
-  upload-tauri-release-assets:
-    name: Upload desktop release assets
-    needs: [resolve-release, verify-release, publish-tauri, bundle-tauri-linux-arm64]
-    if: needs.resolve-release.outputs.build_tauri == 'true'
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    env:
-      RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ env.RELEASE_TAG }}
-          fetch-depth: 0
-
-      - name: Download desktop workflow artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: desktop-release-*
-          path: ${{ runner.temp }}/desktop-release-artifacts
-
-      - name: Upload desktop assets to release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          node scripts/release/upload-desktop-release-assets.mjs \
-            --repo "$GITHUB_REPOSITORY" \
-            --tag "$RELEASE_TAG" \
-            --artifacts-dir "$RUNNER_TEMP/desktop-release-artifacts"
-
   publish-updater-json:
     name: Publish consolidated latest.json
-    needs: [resolve-release, verify-release, upload-tauri-release-assets]
+    needs: [resolve-release, verify-release, publish-tauri]
     if: needs.resolve-release.outputs.build_tauri == 'true'
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     env:
       RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
     steps:
@@ -524,7 +655,7 @@ jobs:
     name: Build + Upload openwork-orchestrator Sidecars
     needs: [resolve-release, verify-release]
     if: needs.resolve-release.outputs.publish_sidecars == 'true'
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     env:
       RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
     steps:
@@ -633,7 +764,7 @@ jobs:
       needs.verify-release.result == 'success' &&
       (needs.release-orchestrator-sidecars.result == 'success' || needs.release-orchestrator-sidecars.result == 'skipped') &&
       needs.resolve-release.outputs.publish_npm == 'true'
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     env:
       RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
     steps:
@@ -753,11 +884,9 @@ jobs:
 
       - name: Publish openwork-orchestrator
         if: steps.npm-auth.outputs.enabled == 'true' && steps.npm-versions.outputs.publish_orchestrator == 'true'
-        working-directory: packages/orchestrator
         env:
           GH_TOKEN: ${{ github.token }}
           ORCHESTRATOR_VERSION: ${{ steps.package-versions.outputs.orchestrator }}
-          ORCHESTRATOR_DISABLE_LINUX_ARM64: "1"
         run: |
           set -euo pipefail
           tag="openwork-orchestrator-v${ORCHESTRATOR_VERSION}"
@@ -765,15 +894,8 @@ jobs:
             echo "openwork-orchestrator sidecar release $tag not found. Publish sidecars before openwork-orchestrator." >&2
             exit 1
           fi
-          # Linux ARM build is temporarily disabled in GitHub Actions.
-          bun script/build.ts \
-            --outdir dist/bin \
-            --filename openwork \
-            --target bun-darwin-arm64 \
-            --target bun-darwin-x64 \
-            --target bun-linux-x64 \
-            --target bun-windows-x64
-          node scripts/publish-npm.mjs
+          pnpm --filter openwork-orchestrator build:bin:all
+          node packages/orchestrator/scripts/publish-npm.mjs
 
   aur-publish:
     name: Publish AUR
@@ -783,7 +905,7 @@ jobs:
       needs.resolve-release.result == 'success' &&
       (needs.publish-tauri.result == 'success' || needs.publish-tauri.result == 'skipped') &&
       (needs.publish-release.result == 'success' || needs.publish-release.result == 'skipped')
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     env:
@@ -846,7 +968,7 @@ jobs:
       (needs.publish-updater-json.result == 'success' || needs.publish-updater-json.result == 'skipped') &&
       (needs.release-orchestrator-sidecars.result == 'success' || needs.release-orchestrator-sidecars.result == 'skipped') &&
       (needs.publish-npm.result == 'success' || needs.publish-npm.result == 'skipped')
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     env:
       RELEASE_TAG: ${{ needs.resolve-release.outputs.release_tag }}
       RELEASE_PRERELEASE: ${{ needs.resolve-release.outputs.prerelease }}