[charneykaye]

Summary

Unblocks the v0.4.0 release (#495).

What failed

Release run 42749626023 (full edition, v0.4.0, from main 6bd5f6b) failed on all three platforms at Build Tauri desktop, two seconds into the step:

Found version mismatched Tauri packages. Make sure the NPM package and Rust crate versions are on the same major/minor releases:
tauri (v2.12.1) : @tauri-apps/api (v2.11.1)

Nothing was published. The release, Steam and Defender jobs were all skipped, and no tag was created.

Why nothing caught it

• apps/desktop/src-tauri/Cargo.lock has held tauri 2.12.1 since it was committed on 2026-10-02 (d1d3b87).
• pnpm-lock.yaml still locked @tauri-apps/api 2.11.1.
• v0.2.9 had no committed Cargo.lock, so its build resolved a matching crate.
• Only the release workflow runs tauri build. CI's desktop jobs run cargo check, which never looks at npm.

The fix

• @tauri-apps/api → 2.12.4 (published 2026-10-14) in apps/desktop/package.json and pnpm-lock.yaml.

  • The package declares no dependencies, so the lockfile change is just the importer entry plus the version's registry integrity hash.
  • Nothing in the apps imports @tauri-apps/api at runtime; the CLI's check is the only consumer.
  • @tauri-apps/cli stays at 2.11.4. That is the CLI the last good release built with, and the check doesn't compare it.

• scripts/check-tauri-versions.sh reads both lockfiles and checks the pairs the Tauri CLI checks:

  • tauri with @tauri-apps/api;
  • each tauri-plugin-<name> with @tauri-apps/plugin-<name>, when both are locked.

  It fails if it cannot read a version, rather than passing silently. It runs in two places:

  • CI's Smoke check job, so a lockfile that moves one side fails on its pull request;
  • the release workflow's Validate job, so it fails in seconds instead of on three runners.

• docs/release-checklist.md: the validate row now lists what that job actually checks.

Closes #

---

Checklist

Tests and CI

• All existing tests pass locally (pnpm install --frozen-lockfile with the edited lockfile; no code under test changed)
• New behaviour is covered by new or updated tests (the guard runs in CI on every PR; cases exercised locally are listed below)
• Smoke check passes: bash scripts/smoke-check.sh

Documentation

• New source files include # SPDX-License-Identifier: Apache-2.0 header
• Links in new or modified docs resolve correctly (no links added)

---

Testing notes

• Reproduced the release failure locally, using the real Tauri CLI 2.11.4 against main's lockfiles:
  pnpm --filter @convsim/desktop exec tauri build --config apps/desktop/src-tauri/tauri.steam.conf.json --no-bundle
  It printed the same tauri (v2.12.1) : @tauri-apps/api (v2.11.1) error.
• Same command on this branch: the version check passes, beforeBuildCommand builds the web frontend, and cargo starts compiling. It then stops at gdk-sys, because this container has no GTK system libraries. The release runner installs them in an earlier step.
• pnpm install --frozen-lockfile succeeds on this branch. pnpm checked the hand-written integrity hash when it downloaded 2.12.4.
• scripts/check-tauri-versions.sh:
  • passes on this branch;
  • fails on main's lockfiles with the release run's exact pair;
  • fails on a synthetic lockfile with mismatched plugin pairs, and strips pnpm's peer-dependency version suffix;
  • fails on a duplicate tauri crate on a different minor;
  • errors out when the npm entry or a lockfile is missing.
• Other checks:
  • shellcheck 0.9.0 (CI's version) is clean on scripts/*.sh;
  • both workflow files parse;
  • python3 scripts/project-structure.py validate passes.

---

Generated by Claude Code