tiennm99
9a9b01ff07
ci: scope the updater signing key to signing steps and split the legacy publish job
...
The signing key moves from job-level to step-level env, so npm install scripts, setup actions and crate build scripts never see it. Linux compiles without the key and signs in a separate tauri bundle step. The legacy rollback builds and signs under a read-only, unpersisted token with the locked Tauri CLI, and a separate job holds the write token to publish.
2026-10-21 17:29:56 +07:00
tiennm99
81f29f2e4f
ci: publish only plain vX.Y.Z tags so suffixed dry-run tags stay drafts
2026-10-21 17:19:23 +07:00
tiennm99
435797ad91
ci: release a signed Windows exe, Linux AppImage and deb with latest.json
2026-10-21 17:06:05 +07:00
tiennm99
94722f2741
ci: refuse a release while the updater public key is empty
2026-10-21 16:45:27 +07:00
tiennm99
1ba2883989
ci: switch back to windows-latest
...
Prefer staying on the floating tag — accept GitHub's auto-redirect to
windows-2025-vs2026 in mid-2026 rather than pin and chase.
2026-05-18 13:23:37 +07:00
tiennm99
713eb5bbde
ci: bump actions to latest, pin windows runner
...
- actions/checkout v4 -> v6 (Node 24, addresses Node 20 deprecation).
- runs-on windows-latest -> windows-2025 (current image; pin avoids
silent surprise when GitHub redirects windows-latest to a newer
image mid-2026).
- Swatinem/rust-cache@v2 retained (v2 floating tag still maintained;
latest is v2.9.1 under that major).
2026-05-18 11:00:39 +07:00
tiennm99
60cde291bd
ci: add windows release workflow
2026-05-16 12:34:26 +07:00
tiennm99