The signing key moves from job-level to step-level env, so npm install scripts, setup actions and crate build scripts never see it. Linux compiles without the key and signs in a separate tauri bundle step. The legacy rollback builds and signs under a read-only, unpersisted token with the locked Tauri CLI, and a separate job holds the write token to publish.
The bundler has no icon fallback, so an empty list breaks the AppImage
step and ships a deb without hicolor icons. Put icon.png first so it stays
the default window icon on Linux and macOS, and bundle the deb in the
Linux CI row to catch a broken list before release.
Windows and Ubuntu 22.04 run fmt, clippy, tests, lint, the JS tests and
a no-bundle release build. The Windows row checks the exe version
resource and uploads the exe as a 7-day artifact. macOS runs cargo check
as the compile gate.
tiennm99