ci(desktop): harden Xcode selection and assert the Liquid Glass icon ships

.github/workflows/tauri-build.yml

@@ -154,6 +154,30 @@ jobs:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
 
+      # Tauri compiles the Liquid Glass icon (icons/macos/app.icon) with actool
+      # and skips it when actool is older than 26, so the icon would vanish with
+      # a green build. Runs before Setup Rust so the whole macOS build, tests
+      # included, compiles against one SDK rather than two either side of it.
+      - name: Select Xcode 26+ (Liquid Glass app icon)
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          set -euo pipefail
+          xcode=""
+          for candidate in $(ls -d /Applications/Xcode_*.app 2>/dev/null | sort -Vr); do
+            major=$(basename "$candidate" | sed -E 's/^Xcode_([0-9]+).*/\1/')
+            case "$major" in ''|*[!0-9]*) continue ;; esac
+            if [ "$major" -ge 26 ]; then xcode="$candidate"; break; fi
+          done
+          if [ -z "$xcode" ]; then
+            echo "::error::No Xcode >= 26 on this runner - Tauri would silently skip the Liquid Glass icon"
+            exit 1
+          fi
+          sudo xcode-select -s "$xcode"
+          echo "Selected $xcode"
+          xcodebuild -version
+          command -v actool
+
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
         with:
@@ -379,21 +403,6 @@ jobs:
             exit 1
           fi
 
-      # Tauri compiles the Liquid Glass icon (icons/macos/app.icon) with actool,
-      # but skips it silently when actool is older than 26. macos-15 defaults to
-      # Xcode 16.4, so select the newest Xcode 26 or the glass icon is dropped.
-      - name: Select Xcode 26 (Liquid Glass app icon)
-        if: matrix.platform == 'macos-15'
-        run: |
-          XCODE=$(ls -d /Applications/Xcode_26*.app 2>/dev/null | sort -V | tail -1)
-          if [ -z "$XCODE" ]; then
-            echo "No Xcode 26 found - the Liquid Glass icon would be silently skipped"
-            exit 1
-          fi
-          sudo xcode-select -s "$XCODE"
-          echo "Selected $XCODE"
-          actool --version | head -3
-
       - name: Build Tauri app (signed)
         if: env.SIGN_BUNDLE == 'true'
         uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
@@ -530,6 +539,27 @@ jobs:
             echo "⚠️ No DMG file found to verify"
           fi
 
+      # actool can succeed and still leave CFBundleIconName unwritten, which ships
+      # a green build with the icon quietly falling back to the icns. Assert both
+      # halves rather than trusting the bundler's warning.
+      - name: Verify Liquid Glass icon landed (macOS only)
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          set -euo pipefail
+          APP=$(find ./frontend/editor/src-tauri/target -maxdepth 6 -type d -name "*.app" | head -1)
+          if [ -z "$APP" ]; then
+            echo "::error::No .app bundle found to verify"
+            exit 1
+          fi
+          echo "Checking $APP"
+          if [ ! -f "$APP/Contents/Resources/Assets.car" ]; then
+            echo "::error::Assets.car missing - actool did not compile icons/macos/app.icon"
+            exit 1
+          fi
+          NAME=$(plutil -extract CFBundleIconName raw "$APP/Contents/Info.plist")
+          echo "Assets.car present, CFBundleIconName=$NAME"
+
       - name: Rename artifacts
         shell: bash
         run: |