ci: declare the Desktop Nightly environment

[Astro-Han]

Summary

Declare a nightly GitHub Environment through ASF's .asf.yaml self-service configuration.

The environment admits only main, has no required reviewer or wait timer, and stays separate from the human-gated release Environment. The operational documentation now treats .asf.yaml as the sole Environment-policy authority and tells operators to verify ASF reconciliation instead of creating nightly manually.

This creates the protected boundary required by the Desktop Nightly workflow; it does not add secrets or enable Nightly publishing.

Verification

• TDD RED: the repository control-plane test failed because github.environments.nightly was absent
• node --test --test-name-pattern='repository control plane admits only each release phase owner ref' scripts/product-release.test.mjs (passed after the configuration change)
• npm run build --workspace @maka/eval
• node --test scripts/product-release.test.mjs (28 passed at current head)
• npx biome check scripts/product-release.test.mjs
• git diff --check origin/main...HEAD

Typecheck was not run separately because this PR changes only ASF YAML, documentation, and a JavaScript contract test.

Rollout

After merge, wait for ASF's asfyaml automation to create the Environment, then verify its main-only policy before adding signing secrets or enabling Nightly.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex researched ASF's environment-management path, added the declarative Environment and its repository control-plane regression coverage, and aligned the operational documentation with that authority. The human contributor must review the final diff and owns its accuracy.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[zhiiw]

Reviewed at exact head 00d4a415 (verified unchanged at review time; the head was rebased during review — git range-diff shows the PR commit is patch-identical between the two heads, and the two touched files are byte-identical, so the verification below applies to this head).

Declarative environment, verified rather than assumed:

• The gate it creates is the one the workflow already references: the Desktop Nightly workflow's two publish jobs declare environment: nightly; until this Environment exists with a main-only branch policy, that protection is a name, not a boundary. The declared shape mirrors the existing npm-publication Environment exactly (no required reviewers, no wait timer, branch policy limited to main), keeping it separate from the human-gated release Environment.
• The control-plane test actually fails without the change: I re-ran it against the base .asf.yaml — the test fails (RED), and passes at this head. Full product-release suite 28/28 at this head.
• Scope is minimal: no secrets, no enablement flag, no workflow change — the Environment declaration only, with rollout (asfyaml automation → verify policy → then secrets) left to follow.

One environment note: the hosted test check was still running on the rebased head at approval time; the content under test is byte-identical to the head whose verification I ran.

---

Automated review notice: This comment was posted by an automated review agent operated by zhiiw. It is not an independent human review and does not replace one.

简体中文

声明式 Environment，全部核实而非假设：它建的门禁正是 workflow 两个发布作业已引用的 environment: nightly——没有这个 main-only 的 Environment，那个引用只是名字不是边界；声明形状与既有 npm-publication 完全一致，与人工把关的 release Environment 隔离。控制面测试我实测了 RED/GREEN（base 的 .asf.yaml 挂、本 head 过），product-release 全套 28/28。范围最小：只有声明，没有 secret 或启用开关。批的时候 rebase 后新 head 的 test 还在跑，内容与已验证 head 逐字节一致。

[jackwener]

Reviewed the latest head fcad4a5a4. No P0 or P1 in the change — approving. No inline comments, because I found nothing at P2 or P3 either. Two things below are worth your attention, and the first is not about this PR.

test is red on this head, and it is not this PR's doing. The failing step is Check renderer architecture, reporting drift in three Desktop renderer files:

src/renderer/app-shell-chat-actions.ts: nonTriviaTokens expected 4363, received 4376
src/renderer/app-shell-session-events.ts: nonTriviaTokens expected 2931, received 3042
src/renderer/settings/import-tasks-settings-page.tsx: hookCalls useEffect 4→5, useRef 3→5

This PR touches exactly two files, .asf.yaml and scripts/product-release.test.mjs, and neither is a renderer file. I checked main directly: run 33308508205 fails the same step with byte-identical numbers. So the breakage is already on main and every open PR will show it. It needs a re-baseline of those three files on main; this PR cannot fix it and should not be blamed for it. It does still gate the merge, so this approval does not let anything through until that is resolved.

The environment declaration itself is correct. The nightly entry matches the documented setup — a GitHub Environment that permits only main — and it is shape-identical to the existing npm-publication entry, so it introduces no new pattern. The control that matters here is deployment_branch_policy restricting deployments to the main branch, and it is present. That is what keeps pull-request branches away from the environment's secrets, which for nightly will include the Apple signing material and the Nightlies SSH key. required_reviewers: [] and prevent_self_review: false are looser than product-release, which requires a named reviewer, but that difference is defensible for a nightly channel and matches the precedent already set by npm-publication. Extending the existing test to assert both environments with one shared shape is the right way to keep them from drifting apart.

One coupling worth tracking. This PR declares the environment that #4254 then consumes for the Nightlies SSH transport. I have an open P1 on #4254 for disabling host key verification on that transport. Nothing about that finding is caused by or affects this change — the declaration is sound on its own — but the two should land in the right order, and #4254 should not go in while that P1 stands.

Automated review notice: This comment was posted by an automated review agent operated by jackwener. It is not an independent human review and does not replace one.

[hqhq1025]

Reviewed exact head 00d4a415560c19af76c2d30d5fe8d17e31802f02. No P0 or P1 findings; technical GO.

The new nightly Environment matches ASFs current deployment-environment schema and the existing approval-free npm-publication shape: no required reviewers, no wait timer, and a custom deployment policy restricted to the main branch. Both Desktop Nightly deployment jobs already reference environment: nightly, while the live repository currently has no Environment by that name, so this closes the intended control-plane gap without adding secrets or enabling publication.

Validation: clean dependency install; npm run build:test; full npm run build; full workspace typecheck; scripts/product-release.test.mjs 28/28; complete release-contract suite 132/132; full Biome lint and format checks; git diff --check; clean merge-tree against current main 3c52d2c9.

The required hosted test check is red in Check renderer architecture, but current main run 33308508205 fails with the same three debt-ledger mismatches. The PR changes only .asf.yaml and scripts/product-release.test.mjs, so that failure is not attributable to this diff; it still remains an external merge gate until CI is green.

I left one non-blocking P3 inline for the operational documentation. I could not exercise ASF reconciliation on a PR head; after merge, verify that automation creates nightly with the selected main branch policy before adding secrets or enabling the workflow.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.