Git for Windows checks Cargo.lock out with CRLF endings on the windows-latest runner, so the whole-line sed and grep anchors matched nothing and the rollback build stopped at its own check. The patterns now allow a trailing CR and keep it, and the check runs on a CR-stripped copy.
The release build jobs run npm install scripts, so their checkouts no longer persist the token in .git/config. The legacy rollback sets the new version on the package's own Cargo.lock entry instead of running cargo update, so the --locked build resolves nothing and fails if the lockfile differs in anything else.
The signing key moves from job-level to step-level env, so npm install scripts, setup actions and crate build scripts never see it. Linux compiles without the key and signs in a separate tauri bundle step. The legacy rollback builds and signs under a read-only, unpersisted token with the locked Tauri CLI, and a separate job holds the write token to publish.
The bundler has no icon fallback, so an empty list breaks the AppImage
step and ships a deb without hicolor icons. Put icon.png first so it stays
the default window icon on Linux and macOS, and bundle the deb in the
Linux CI row to catch a broken list before release.
Windows and Ubuntu 22.04 run fmt, clippy, tests, lint, the JS tests and
a no-bundle release build. The Windows row checks the exe version
resource and uploads the exe as a 7-day artifact. macOS runs cargo check
as the compile gate.
tiennm99