fix(release): presence is not validity — shape-check credentials in the preflight

[runyourempire]

Today's dry run spent 25 minutes per platform discovering this:

failed to decode secret key: failed to decode base64 secret key:
failed to decode base64 key: Invalid symbol 32, offset 0.

ASCII 32, at position 0 — TAURI_SIGNING_PRIVATE_KEY begins with a space.

That secret was set on 2026-02-16, is non-empty, and passed every check this repository has. gh secret list shows it present. The preflight's require only tests for emptiness. And it had never been exercised at all, because createUpdaterArtifacts was unset until #539 — so nothing ever asked Tauri to decode it. The first release that got far enough to need it would have died on it, after a full four-platform compile.

The change

The preflight exists precisely so a credential problem costs seconds instead of 45 minutes. It was only checking that credentials are there. Now it also checks they are shaped like credentials: no leading or trailing whitespace, on every value, on every platform.

Deliberately narrow

It does not validate content. That would mean reimplementing base64, minisign and eSigner's auth inside a preflight — and a check that is wrong about a valid credential is worse than no check at all, because it blocks a good release.

Surrounding whitespace is unambiguous: no credential should ever carry it, and a value pasted with a stray leading space is exactly the failure that just cost an hour of runner time.

Verified by execution, not by reading

The validator was extracted and run against fixtures:

fixture	flagged?	why
leading space	✅ yes	the actual bug
trailing space	✅ yes	same class
leading tab	✅ yes	same class
clean base64 key	✅ no	must not block a good credential
empty	✅ no	absence is require's job, not this one's
password with spaces inside	✅ no	legitimate; flagging it would break a working release

bash -n over the whole extracted preflight passes, and YAML re-parses.

That last pair matters. I caught a real bug in my own first attempt at this — the shape loop landed inside the shape() function because my anchor matched the wrong esac. YAML still parsed cleanly, because it is all one block scalar. Only executing the bash found it.

Not included

An xcrun notarytool history probe, which would have caught the other credential failure this dry run found — Apple rejecting notarization with "a required agreement is missing or has expired", again after a 25-minute macOS build.

It is the obvious next step and worth doing. But it cannot be tested from this machine, and the release path is the wrong place to put code I have only read. Recommended as a follow-up rather than shipped blind.