From 7e1972a3155e14bd06efd5cbaae4068867ec2e8d Mon Sep 17 00:00:00 2001
From: Yun Chan <yunchan@twentyoz.kr>
Date: Fri, 18 Sep 2026 00:50:33 +0900
Subject: [PATCH] ci(release): build and verify the STT sidecar in every
 packaging pipeline

Packaging silently tolerates a missing resource directory: electron-builder
prints "file source doesn't exist" and continues, which is how installers that
could not transcribe were published.

Every pipeline that packages the desktop app now builds the sidecar and fails
when the engine or its VAD data is absent, so a release cannot ship without
local transcription.
---
 .forgejo/workflows/release.yml           |  8 ++++++++
 .github/workflows/build-mac.yml          | 13 ++++++-------
 .github/workflows/release-signing-ca.yml |  7 +++++++
 .github/workflows/release.yml            | 18 ++++++++++++++++++
 4 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 0336ee7..e5c3913 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -41,6 +41,14 @@ jobs:
       - name: 의존성 설치
         run: npm ci
 
+      - name: STT 사이드카 빌드 (로컬 전사 엔진)
+        run: |
+          # 로컬 전사는 faster-whisper 사이드카에 의존한다. 이 번들이 빠지면
+          # 설치본에서 전사가 전혀 동작하지 않으므로 패키징 전에 반드시 빌드/검증한다.
+          npm run sidecar:setup --workspace=@d3ro/desktop
+          npm run sidecar:build --workspace=@d3ro/desktop
+          node scripts/ci/verify-sidecar-bundle.mjs
+
       - name: 데스크톱 빌드 (서명 필수)
         env:
           WIN_CSC_LINK: "${{ secrets.WIN_CSC_LINK }}"
diff --git a/.github/workflows/build-mac.yml b/.github/workflows/build-mac.yml
index 3c9ea50..b81eb36 100644
--- a/.github/workflows/build-mac.yml
+++ b/.github/workflows/build-mac.yml
@@ -48,15 +48,14 @@ jobs:
         working-directory: apps/desktop
         run: bash scripts/install-sox.sh
 
-      - name: Install Python dependencies
+      - name: Build STT sidecar (PyInstaller)
         working-directory: apps/desktop
         run: |
-          pip install pyinstaller
-          pip install -r sidecar/requirements.txt
-
-      - name: Build sidecar (PyInstaller)
-        working-directory: apps/desktop
-        run: python scripts/build-sidecar.py
+          # 로컬 전사는 사이드카 번들에 의존한다. 누락된 채 패키징하면 설치본에서
+          # 전사가 전혀 동작하지 않으므로 빌드 후 반드시 검증한다.
+          npm run sidecar:setup
+          npm run sidecar:build
+          node ../../scripts/ci/verify-sidecar-bundle.mjs
 
       - name: Rebuild native modules for Electron
         run: npx --yes @electron/rebuild@3 --version=33.4.11
diff --git a/.github/workflows/release-signing-ca.yml b/.github/workflows/release-signing-ca.yml
index 2eb432c..6d0fec6 100644
--- a/.github/workflows/release-signing-ca.yml
+++ b/.github/workflows/release-signing-ca.yml
@@ -36,6 +36,13 @@ jobs:
           trusted-signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
           certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE }}
 
+      - name: Build STT Sidecar (local transcription engine)
+        run: |
+          # Without this bundle the packaged app cannot transcribe at all.
+          npm run sidecar:setup --workspace=@d3ro/desktop
+          npm run sidecar:build --workspace=@d3ro/desktop
+          node scripts/ci/verify-sidecar-bundle.mjs
+
       - name: Build and Package Windows (NSIS + RFC 3161 TSA)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2c06ddb..7391d26 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -109,6 +109,15 @@ jobs:
           npm run typecheck
           npm run build --workspace=@d3ro/desktop
 
+      - name: Build STT Sidecar (local transcription engine)
+        run: |
+          # Local transcription depends on the faster-whisper sidecar; a release
+          # that ships without it cannot transcribe at all, so build and verify
+          # the bundle before packaging.
+          npm run sidecar:setup --workspace=@d3ro/desktop
+          npm run sidecar:build --workspace=@d3ro/desktop
+          node scripts/ci/verify-sidecar-bundle.mjs
+
       - name: Package with Electron Builder (NSIS x64)
         shell: pwsh
         run: |
@@ -179,6 +188,15 @@ jobs:
           npm run typecheck
           npm run build --workspace=@d3ro/desktop
 
+      - name: Build STT Sidecar (local transcription engine)
+        run: |
+          # Local transcription depends on the faster-whisper sidecar; a release
+          # that ships without it cannot transcribe at all, so build and verify
+          # the bundle before packaging.
+          npm run sidecar:setup --workspace=@d3ro/desktop
+          npm run sidecar:build --workspace=@d3ro/desktop
+          node scripts/ci/verify-sidecar-bundle.mjs
+
       - name: Package with Electron Builder (DMG & ZIP arm64)
         run: |
           cd apps/desktop