Summary

• Add explicit no-publish desktop dist scripts that pass --publish never to electron-builder.
• Update the desktop release build matrix to use the no-publish scripts.
• Keep GitHub Release creation and asset upload centralized in the workflow's publish job.

Root Cause

After desktop auto-update metadata added a GitHub publish config, electron-builder detected CI and defaulted to onTagOrDraft. The macOS, Windows, and Linux build jobs then tried to publish artifacts themselves, but those jobs do not set GH_TOKEN, so all three failed with:

GitHub Personal Access Token is not set, neither programmatically, nor using env "GH_TOKEN"

Validation

• git diff --check
• Parsed .github/workflows/desktop-release.yml with js-yaml
• Verified no-publish scripts exist in package.json
• Verified electron-builder supports --publish never
• bun run electron:builder-config

Notes

--publish never still lets electron-builder generate updater metadata from the publish config; it only disables uploader creation. The workflow's dedicated publish job remains responsible for Release creation/upload, including dry-run, draft, prerelease, and replace behavior.