Governance: add head-bound macOS Electron screenshot check #133

Proposal

Add a maintainer-authored GitHub Actions job that validates the Desktop Electron window natively on macOS and publishes a screenshot artifact bound to the pull request head SHA.

Why this needs maintainer action

The Desktop foundation now has a secure Electron process boundary, a macOS-first workbench shell, and real Linux Xvfb interaction coverage. Repository governance protects .github/workflows/**, so the development bot must not add or modify the workflow itself.

Required job contract

• Run on a GitHub-hosted macOS runner.
• Check out the exact pull request head SHA, not a moving branch ref.
• Install dependencies and build the Electron desktop entry points.
• Launch the real Electron BrowserWindow natively.
• Wait for the renderer ready state and verify the project rail, workbench, inspector, and composer landmarks.
• Capture the native application window as a PNG.
• Upload the PNG and a small manifest containing the tested head SHA, platform, command outcome, and capture timestamp.
• Fail if the app exits early, the ready state is absent, the landmarks are missing, the screenshot is empty, or the manifest SHA differs from the tested head.
• Expose a stable check name suitable for the Desktop required-check policy.

Existing evidence

• feat(desktop): establish secure Electron foundation #128 established the secure Electron process and preload boundary.
• feat(desktop): render the macOS-first workbench shell #130 added the macOS-first workbench shell and explicit renderer states.
• test(desktop): exercise the real workbench under Xvfb #132 added real Electron interaction coverage under Linux Xvfb and runs it in the integration suite.

Acceptance criteria

• A maintainer-authored workflow change lands through normal review.
• A test pull request produces a non-empty native macOS window screenshot artifact and matching head-SHA manifest.
• The check is repeatable and does not rely on simulated terminal output or a mocked BrowserWindow.
• Desktop parent Desktop: launch a secure macOS session shell #106 links the successful run before it is closed.

Related

• Parent: Desktop: launch a secure macOS session shell #106
• Roadmap: Roadmap: macOS desktop workbench v1 #105