ci.yml is now callable with a ref to test. The release workflow calls it on the prepared tag and both build jobs wait for it, so a tag whose sources fail tests, lint or the build publishes nothing. A called run gets its own concurrency group and is never cancelled. The release steps now push main and wait for green CI before pushing the tag.
The AppImage bundler downloads and runs unpinned linuxdeploy tools, so the updater signing key and its password no longer reach the bundle step. A separate step signs the renamed AppImage with tauri signer sign, as the Windows job signs the exe.
Rename the crate, binary, product name, identifier, settings folder, log
file, autostart entry, user agent, updater endpoint and release assets.
Legacy Win32 clients still update: they fall back to the first .exe asset,
and the legacy rollback workflow reads the package name from the ref it
builds. Upgraded installs start with default settings.
The release build jobs run npm install scripts, so their checkouts no longer persist the token in .git/config. The legacy rollback sets the new version on the package's own Cargo.lock entry instead of running cargo update, so the --locked build resolves nothing and fails if the lockfile differs in anything else.
The signing key moves from job-level to step-level env, so npm install scripts, setup actions and crate build scripts never see it. Linux compiles without the key and signs in a separate tauri bundle step. The legacy rollback builds and signs under a read-only, unpersisted token with the locked Tauri CLI, and a separate job holds the write token to publish.
tiennm99