From f0ba7ad1d90e49fcd363bbab34f679a746c23afc Mon Sep 17 00:00:00 2001 From: Adam Jolicoeur Date: Mon, 27 Jul 2026 11:13:29 -0400 Subject: [PATCH] chore: combine tauri-release workflow into release workflow Merges the separate workflow_run-triggered Tauri build into release.yml as a desktop job that depends on release. Removes the release-info artifact bridge; the desktop matrix now reads the tag from the release job outputs and checks it out so tauri.conf.json picks up the bumped version. --- .github/workflows/release.yml | 71 ++++++++++++++++++++---- .github/workflows/tauri-release.yml | 86 ----------------------------- AGENTS.md | 2 +- 3 files changed, 62 insertions(+), 97 deletions(-) delete mode 100644 .github/workflows/tauri-release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3f4e1c0..3dc61f1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -125,6 +125,10 @@ jobs: contents: write pull-requests: read + outputs: + version: ${{ steps.new_version.outputs.version }} + tag: v${{ steps.new_version.outputs.version }} + steps: - name: Checkout code uses: actions/checkout@v4 @@ -241,16 +245,6 @@ jobs: prerelease: false token: ${{ secrets.GITHUB_TOKEN }} - - name: Save release info for desktop build - run: echo "TAG=v${{ steps.new_version.outputs.version }}" > release-info.txt - - - name: Upload release info artifact - uses: actions/upload-artifact@v4 - with: - name: release-info - path: release-info.txt - retention-days: 1 - - name: Summary run: | echo "## Release Summary" >> "$GITHUB_STEP_SUMMARY" @@ -267,3 +261,60 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "### Changelog" >> "$GITHUB_STEP_SUMMARY" echo "${{ steps.changelog.outputs.content }}" >> "$GITHUB_STEP_SUMMARY" + + desktop: + needs: release + if: needs.release.result == 'success' + strategy: + fail-fast: false + matrix: + include: + - platform: macos-latest + - platform: windows-latest + + runs-on: ${{ matrix.platform }} + + permissions: + contents: write + + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }} + VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }} + TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} + TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} + + steps: + - name: Checkout release tag + uses: actions/checkout@v4 + with: + ref: ${{ needs.release.outputs.tag }} + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: "20" + + - name: Setup pnpm + uses: pnpm/action-setup@v4 + + - name: Setup Rust + uses: dtolnay/rust-toolchain@stable + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Build and publish Tauri app + uses: tauri-apps/tauri-action@v0 + with: + tagName: ${{ needs.release.outputs.tag }} + releaseName: "Timetraked ${{ needs.release.outputs.tag }}" + releaseDraft: false + prerelease: false + + - name: Summary + run: | + echo "## Desktop Build (${{ matrix.platform }})" >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + echo "- **Tag:** ${{ needs.release.outputs.tag }}" >> "$GITHUB_STEP_SUMMARY" + echo "- **Installers attached to release:** v${{ needs.release.outputs.version }}" >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/tauri-release.yml b/.github/workflows/tauri-release.yml deleted file mode 100644 index d4cf708..0000000 --- a/.github/workflows/tauri-release.yml +++ /dev/null @@ -1,86 +0,0 @@ -name: Tauri Release - -on: - workflow_run: - workflows: ["Release"] - types: [completed] - -jobs: - check: - if: github.event.workflow_run.conclusion == 'success' - runs-on: ubuntu-latest - permissions: - actions: read - outputs: - tag: ${{ steps.tag.outputs.tag }} - should_build: ${{ steps.tag.outputs.should_build }} - steps: - - name: Download release info - continue-on-error: true - uses: actions/download-artifact@v4 - with: - name: release-info - run-id: ${{ github.event.workflow_run.id }} - github-token: ${{ secrets.GH_TOKEN }} - - - name: Read release tag - id: tag - run: | - if [ -f release-info.txt ]; then - TAG=$(grep '^TAG=' release-info.txt | cut -d= -f2) - echo "tag=$TAG" >> "$GITHUB_OUTPUT" - echo "should_build=true" >> "$GITHUB_OUTPUT" - echo "Found release tag: $TAG" - else - echo "should_build=false" >> "$GITHUB_OUTPUT" - echo "No release-info artifact found; Release workflow run did not publish a release." - fi - - build: - needs: check - if: needs.check.outputs.should_build == 'true' - strategy: - fail-fast: false - matrix: - include: - - platform: macos-latest - - platform: windows-latest - - runs-on: ${{ matrix.platform }} - - permissions: - contents: write - - env: - VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }} - VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }} - TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} - TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} - - steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - ref: ${{ needs.check.outputs.tag }} - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: "20" - - - name: Setup pnpm - uses: pnpm/action-setup@v4 - - - name: Setup Rust - uses: dtolnay/rust-toolchain@stable - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - - name: Build and publish Tauri app - uses: tauri-apps/tauri-action@v0 - with: - tagName: ${{ needs.check.outputs.tag }} - releaseName: "Timetraked ${{ needs.check.outputs.tag }}" - releaseDraft: false - prerelease: false diff --git a/AGENTS.md b/AGENTS.md index f317a58..5707d4f 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -232,7 +232,7 @@ pnpm tauri:build # full production build + package signed DMG/NSIS install - All privileged logic lives in Rust (`src-tauri/src/`) instead of a Node main process; the frontend never gets Node APIs — it only reaches Rust through `@tauri-apps/api`'s `invoke`/`listen`, gated by `src-tauri/capabilities/default.json` - Signed auto-updates are frontend-driven (`tauriUpdater.ts` + `tauri-plugin-updater`) rather than main-process-driven (`electron-updater`); the updater's release feed and Ed25519 public key live in `tauri.conf.json`'s `plugins.updater` block, with the matching private key held in CI secrets for `tauri:build` signing - `src-tauri/target/` (Rust build output) and `src-tauri/gen/` (generated schemas/bindings) are both gitignored -- `.github/workflows/tauri-release.yml` builds macOS (DMG) and Windows (NSIS) installers and attaches them to the GitHub Release whenever `release.yml` publishes a new version-bump release (same `workflow_run`-triggered pattern as the old `electron-release.yml`) +- `.github/workflows/release.yml` handles the whole release in one workflow: `detect` (bump type from PR/commit titles) → `approve-major` (gated environment) → `release` (version bump, tag, changelog, GitHub Release) → `desktop` (matrix of `macos-latest`/`windows-latest` building signed DMG/NSIS installers via `tauri-apps/tauri-action` and attaching them to that same release). The `desktop` job checks out the new tag, so `tauri.conf.json`'s `"version": "../package.json"` picks up the bumped version. Replaces the old separate `tauri-release.yml`/`electron-release.yml` `workflow_run` chain **When adding Tauri-specific features:**