feat(product): add desktop preview packaging and product page

.github/workflows/ci.yml

@@ -13,6 +13,18 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  product-site:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Check product assets, cache versions and download selection
+        run: |
+          python3 scripts/sync-site-assets.py --check
+          python3 scripts/refresh-site-versions.py --check
+          node --check site/site.js
+          node --test scripts/tests/downloads.test.mjs
+          python3 -m unittest discover -s scripts/tests -p 'test_*.py'
+
   native:
     runs-on: ubuntu-24.04
     steps:

.github/workflows/desktop-preview.yml

@@ -0,0 +1,146 @@
+name: Desktop packages
+
+on:
+  workflow_dispatch:
+  push:
+    branches: ['candidate/**']
+    tags: ['v*']
+  pull_request:
+    paths: ['packaging/**', 'scripts/package-desktop.py', 'scripts/tests/**', 'scripts/release-manifest.py', '.github/workflows/desktop-preview.yml', '.cargo/**', 'crates/**', 'src/**', 'assets/**', 'build.rs', 'LICENSE-*', 'THIRD_PARTY.md', 'Cargo.toml', 'Cargo.lock', 'rust-toolchain*']
+
+permissions:
+  contents: read
+
+concurrency:
+  group: desktop-packages-${{ github.ref }}
+  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
+
+jobs:
+  package:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-15-intel
+            platform: macos
+            arch: universal
+            target: x86_64-apple-darwin
+          - os: windows-2025
+            platform: windows
+            arch: x64
+            target: x86_64-pc-windows-msvc
+          - os: ubuntu-24.04
+            platform: linux
+            arch: x64
+            target: x86_64-unknown-linux-gnu
+    runs-on: ${{ matrix.os }}
+    env:
+      RUSTUP_TOOLCHAIN: 1.95.0
+      CARGO_TERM_COLOR: always
+      MACOSX_DEPLOYMENT_TARGET: '11.0'
+      CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_RUSTFLAGS: '-C target-feature=+crt-static'
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Test package publication and release manifests on this OS
+        run: python -m unittest discover -s scripts/tests -p 'test_*.py'
+      - name: Toolchain
+        shell: bash
+        run: |
+          rustup toolchain install 1.95.0 --profile minimal
+          rustup target add ${{ matrix.target }}
+      - name: Reuse Rust dependencies and release build cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target/release
+            target/${{ matrix.target }}/release
+            target/aarch64-apple-darwin/release
+          key: desktop-rust-1.95-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('Cargo.lock', '**/Cargo.toml') }}-${{ github.sha }}
+          restore-keys: |
+            desktop-rust-1.95-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('Cargo.lock', '**/Cargo.toml') }}-
+      - name: Linux dependencies
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libxkbcommon-dev libxkbcommon-x11-0 libwayland-dev libxcb1-dev libgtk-3-dev mesa-vulkan-drivers
+      - name: Build and check native contracts
+        shell: bash
+        run: |
+          cargo build --release --locked --target ${{ matrix.target }} --bin openpaperdesign --bin paper-rs-mcp
+          cargo test --release --locked --target ${{ matrix.target }} --lib --bin openpaperdesign --test projects -- --test-threads=1
+      - name: Restore screenshots generated by project tests
+        shell: bash
+        run: git restore --worktree -- docs/screenshots
+      - name: Build Apple Silicon slice and assemble universal executables
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          rustup target add aarch64-apple-darwin
+          cargo build --release --locked --target aarch64-apple-darwin --bin openpaperdesign --bin paper-rs-mcp
+          mkdir -p target/distribution
+          for binary in openpaperdesign paper-rs-mcp; do
+            lipo -create target/x86_64-apple-darwin/release/$binary target/aarch64-apple-darwin/release/$binary -output target/distribution/$binary
+            lipo target/distribution/$binary -verify_arch x86_64 arm64
+          done
+      - name: Stage native executables
+        if: runner.os != 'macOS'
+        shell: bash
+        run: |
+          mkdir -p target/distribution
+          suffix=''
+          if [ '${{ runner.os }}' = Windows ]; then suffix=.exe; fi
+          cp target/${{ matrix.target }}/release/openpaperdesign$suffix target/distribution/
+          cp target/${{ matrix.target }}/release/paper-rs-mcp$suffix target/distribution/
+      - name: Verify actual packaged CLI executables
+        shell: bash
+        run: |
+          suffix=''
+          if [ '${{ runner.os }}' = Windows ]; then suffix=.exe; fi
+          ./target/distribution/openpaperdesign$suffix --help
+          ./target/distribution/paper-rs-mcp$suffix --url
+      - name: Package exact clean source and checksums
+        run: python scripts/package-desktop.py --platform ${{ matrix.platform }} --arch ${{ matrix.arch }} --bin-dir target/distribution --output dist --require-clean
+      - name: Keep exact packages for review
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: OpenPaperDesign-${{ matrix.platform }}-${{ matrix.arch }}
+          path: dist/*
+          if-no-files-found: error
+          retention-days: 14
+
+  draft-release:
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    needs: package
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Require a reviewed main-branch release source
+        shell: bash
+        run: git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          pattern: OpenPaperDesign-*
+          merge-multiple: true
+          path: dist
+      - name: Verify packages and generate manifest
+        run: python scripts/release-manifest.py dist --repository arcitai/openpaperdesign --tag "$GITHUB_REF_NAME" --revision "$GITHUB_SHA"
+      - name: Create a draft for review, never publish automatically
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          if gh release view "$GITHUB_REF_NAME" --repo arcitai/openpaperdesign --json isDraft >/dev/null 2>&1; then
+            echo 'Release already exists; leave its reviewed assets unchanged.' >&2
+            exit 1
+          fi
+          gh release create "$GITHUB_REF_NAME" dist/* --repo arcitai/openpaperdesign --target "$GITHUB_SHA" --draft --prerelease --title "OpenPaperDesign $GITHUB_REF_NAME" --notes 'Desktop review packages. macOS is ad-hoc signed and not notarized. See packaged BUILD.json, licences and checksums. Publication is a separate deliberate action.'
+          test "$(gh release view "$GITHUB_REF_NAME" --repo arcitai/openpaperdesign --json isDraft --jq .isDraft)" = true

.gitignore

@@ -3,3 +3,7 @@ target/
 *.asar
 app.asar.unpacked/
 .toolchain/
+dist/
+site/downloads/
+site/releases.preview.json
+__pycache__/

Cargo.toml

@@ -27,6 +27,10 @@ path = "src/main.rs"
 name = "paper-rs-mcp"
 path = "src/bin/paper-rs-mcp.rs"
 
+[[bin]]
+name = "openpaperdesign"
+path = "packaging/native.rs"
+
 [dependencies]
 egui = "0.36"
 egui-wgpu = "0.36"