Alpha/task46 - macOS Compatibility

.github/scripts/generate-latest-json.mjs

@@ -0,0 +1,87 @@
+// Generates the Tauri updater manifest (latest.json) from the signed bundles
+// produced by `createUpdaterArtifacts`, then uploads it to the GitHub release.
+//
+// The updater endpoint in tauri.conf.json points at this file. For each platform
+// it needs the signed artifact URL and the contents of the matching `.sig` file.
+//
+// Env: TAG (e.g. v1.5.2), VERSION (e.g. 1.5.2), GH_TOKEN (for `gh`).
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+
+const { TAG, VERSION } = process.env;
+if (!TAG || !VERSION) {
+  console.error('TAG and VERSION env vars are required');
+  process.exit(1);
+}
+
+// 1. Map uploaded asset name -> browser download URL.
+//    GitHub stores asset names with spaces replaced by dots, so we match both forms.
+const assets =
+  JSON.parse(execFileSync('gh', ['release', 'view', TAG, '--json', 'assets'], { encoding: 'utf8' }))
+    .assets ?? [];
+const urlByName = new Map(assets.map((a) => [a.name, a.url]));
+
+function resolveUrl(localBasename) {
+  return urlByName.get(localBasename) ?? urlByName.get(localBasename.replace(/ /g, '.')) ?? null;
+}
+
+// 2. Find every `.sig` file across the downloaded build artifacts.
+function walk(dir) {
+  const out = [];
+  for (const entry of readdirSync(dir)) {
+    const p = join(dir, entry);
+    if (statSync(p).isDirectory()) out.push(...walk(p));
+    else out.push(p);
+  }
+  return out;
+}
+const sigFiles = walk('release-artifacts').filter((f) => f.endsWith('.sig'));
+
+// 3. Map each updater artifact to its Tauri platform key(s).
+const platforms = {};
+for (const sig of sigFiles) {
+  const artifact = basename(sig.slice(0, -4)); // strip ".sig"
+  let keys = null;
+  if (artifact.endsWith('-setup.exe')) {
+    keys = ['windows-x86_64']; // NSIS installer
+  } else if (artifact.endsWith('.app.tar.gz')) {
+    // macOS updater bundle. A universal binary has no arch in its name and reports
+    // its *running* arch at runtime, so it must serve both darwin keys. An explicit
+    // arch in the name (a dedicated single-arch build) maps to just that key.
+    if (/x86_64|x64/.test(artifact)) keys = ['darwin-x86_64'];
+    else if (/aarch64|arm64/.test(artifact)) keys = ['darwin-aarch64'];
+    else keys = ['darwin-aarch64', 'darwin-x86_64']; // universal
+  } else {
+    continue; // ignore non-updater signatures (.msi, .dmg, etc.)
+  }
+
+  const url = resolveUrl(artifact);
+  if (!url) {
+    console.warn(`No uploaded asset URL for "${artifact}" - skipping ${keys.join(', ')}`);
+    continue;
+  }
+  const entry = { signature: readFileSync(sig, 'utf8').trim(), url };
+  for (const key of keys) platforms[key] = entry;
+}
+
+if (Object.keys(platforms).length === 0) {
+  console.error(
+    'No updater platforms resolved - is createUpdaterArtifacts enabled and signing configured?'
+  );
+  process.exit(1);
+}
+
+// 4. Write and upload the manifest.
+const manifest = {
+  version: VERSION,
+  pub_date: new Date().toISOString(),
+  notes: `Release ${TAG}`,
+  platforms,
+};
+writeFileSync('latest.json', JSON.stringify(manifest, null, 2));
+console.log(JSON.stringify(manifest, null, 2));
+
+execFileSync('gh', ['release', 'upload', TAG, 'latest.json', '--clobber'], { stdio: 'inherit' });
+console.log('Uploaded latest.json');

.github/workflows/manual-cross-platform-release.yml

@@ -18,53 +18,68 @@ jobs:
         include:
           - os: windows-latest
             platform: win
-            build_command: npx electron-builder --win --x64 --publish never
+            args: ''
+            rust-targets: ''
           - os: macos-latest
             platform: mac
-            build_command: npx electron-builder --mac --publish never
+            # Universal binary: runs natively on both Apple Silicon and Intel (macOS 14.4+).
+            args: '--target universal-apple-darwin'
+            rust-targets: 'aarch64-apple-darwin x86_64-apple-darwin'
     runs-on: ${{ matrix.os }}
     permissions:
       contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
+          cache: pnpm
 
-      - name: Install dependencies
-        run: npm ci
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri
 
-      - name: Build Electron main process
-        run: npm run electron:build-main
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
 
-      - name: Build renderer assets
-        run: npm run build
+      - name: Add Rust targets
+        if: matrix.rust-targets != ''
+        run: rustup target add ${{ matrix.rust-targets }}
 
-      - name: Build release packages
+      - name: Build Tauri bundle
+        run: pnpm tauri build ${{ matrix.args }}
         env:
-          CSC_IDENTITY_AUTO_DISCOVERY: "false"
-        run: ${{ matrix.build_command }}
-        shell: bash
+          # Required for the updater to sign the bundles. Without these the
+          # `createUpdaterArtifacts` step cannot produce the `.sig` files and
+          # updates will fail signature verification on the client.
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@v4
         with:
           name: release-${{ matrix.platform }}
+          # Windows lands in target/release/bundle; the macOS universal build
+          # lands in target/universal-apple-darwin/release/bundle.
           path: |
-            release/*.exe
-            release/*.dmg
-            release/*.zip
-            release/*.yml
-            release/*.yaml
-            release/*.blockmap
+            src-tauri/target/release/bundle/**/*
+            src-tauri/target/universal-apple-darwin/release/bundle/**/*
           if-no-files-found: error
 
   publish:
-    if: ${{ inputs.publish }}
+    if: inputs.publish
     name: Publish GitHub Release
     needs: build
     runs-on: ubuntu-latest
@@ -74,35 +89,52 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - name: Download artifacts
         uses: actions/download-artifact@v4
         with:
           path: release-artifacts
 
-      - name: Prepare release metadata
+      - name: Read version
         id: meta
         run: |
           VERSION=$(node -p "require('./package.json').version")
-          TAG="v${VERSION}"
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
 
-      - name: Create or update release
+      - name: Create or update GitHub release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
-          TITLE="Release ${TAG}"
           if gh release view "$TAG" >/dev/null 2>&1; then
             echo "Release $TAG already exists; uploading artifacts."
           else
-            gh release create "$TAG" --title "$TITLE" --notes "Manual cross-platform build artifacts."
+            gh release create "$TAG" \
+              --title "Release $TAG" \
+              --notes "Manual cross-platform Tauri build."
           fi
           while IFS= read -r -d '' file; do
             echo "Uploading $(basename "$file")"
             gh release upload "$TAG" "$file" --clobber
-          done < <(
-            find release-artifacts -type f \
-              \( -name '*.exe' -o -name '*.dmg' -o -name '*.zip' -o -name '*.yml' -o -name '*.yaml' -o -name '*.blockmap' \) \
-              -print0
-          )
+          done < <(find release-artifacts -type f \( \
+            -name '*.exe' -o -name '*.msi' -o \
+            -name '*.dmg' -o -name '*.tar.gz' -o -name '*.zip' -o \
+            -name '*.sig' \
+          \) -print0)
+
+      - name: Generate and upload latest.json
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.meta.outputs.tag }}
+          VERSION: ${{ steps.meta.outputs.version }}
+        run: node .github/scripts/generate-latest-json.mjs

.gitignore

@@ -1,35 +1,55 @@
-# Logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-pnpm-debug.log*
-lerna-debug.log*
-
-# Environment variables
-.env
-.env.local
-.env.*.local
-.env.production
-
-node_modules
-dist
-dist-ssr
-electron-dist
-release
-*.local
-
-# Claude Code
-.claude
-
-# Editor directories and files
-.vscode/*
-!.vscode/extensions.json
-.idea
-.DS_Store
-*.suo
-*.ntvs*
-*.njsproj
-*.sln
-*.sw?
+# ── Logs ──────────────────────────────────────────────────────────────────────
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+# ── Environment variables ──────────────────────────────────────────────────────
+.env
+.env.local
+.env.*.local
+.env.production
+
+# ── Node.js ───────────────────────────────────────────────────────────────────
+node_modules/
+
+# ── Frontend build output ──────────────────────────────────────────────────────
+dist/
+dist-ssr/
+
+# ── Tauri ─────────────────────────────────────────────────────────────────────
+# Rust build artifacts - can be several GiB, always regenerated by cargo
+src-tauri/target/
+
+# Tauri-generated mobile/desktop scaffolding (tauri android/ios init)
+src-tauri/gen/
+
+# Wix toolchain downloaded by tauri-plugin-bundler for Windows NSIS/MSI
+src-tauri/WixTools/
+
+# Tauri CLI local cache
+.tauri/
+
+
+# ── Editor ────────────────────────────────────────────────────────────────────
+.vscode/*
+!.vscode/extensions.json
+.idea/
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+
+# ── OS ────────────────────────────────────────────────────────────────────────
+.DS_Store
+Thumbs.db
+
+# ── Misc ──────────────────────────────────────────────────────────────────────
+*.local
+
+# ── Claude Code ───────────────────────────────────────────────────────────────
+.claude/