The updater was wired client-side (prepareTauriConfig.js sets
plugins.updater.endpoints to
https://github.com/tinyhumansai/openhuman/releases/latest/download/latest.json
and embeds UPDATER_PUBLIC_KEY) but the manifest itself was never
generated after we moved off tauri-action — so installed apps would
fetch 404 and believe they were up to date forever.
Add scripts/release/publish-updater-manifest.sh which:
- Lists the release's assets via gh CLI
- Finds the updater bundles produced by createUpdaterArtifacts=true
(.app.tar.gz for macOS, .AppImage.tar.gz for Linux, -setup.nsis.zip
for Windows) for each of darwin-aarch64 / darwin-x86_64 /
linux-x86_64 / windows-x86_64
- Reads the matching .sig files (minisign base64 payloads)
- Composes latest.json per the Tauri v2 static-manifest schema with
version, pub_date, notes, and a platforms map
- Uploads it to the release via gh release upload --clobber
Wired as a new production-only job `publish-updater-manifest` that runs
after the build-desktop matrix. publish-release now waits on it, and
the asset-validation step requires /^latest\.json$/ so releases can't
ship without the manifest. cleanup-failed-release also tears down
if the manifest step fails.
Staging builds are deliberately skipped — they shouldn't poison the
public updater endpoint.
* fix(release): sync root Cargo version in bump flow (#449)
Add root Cargo.toml to release version bumping and introduce a
version-sync verifier for all four release version sources.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ci(release): enforce version sync before tagging (#449)
Run release version consistency verification and include root
Cargo.toml in the release commit staging list.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore(release): add local dmg preflight version dry-run (#449)
Add a local release dry-run script that builds frontend + release
sidecar, bundles app/dmg, and validates packaged core.version.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Split monolithic inline bash from release.yml and release-packages.yml
into standalone scripts under scripts/release/ for easier debugging
and manual execution.
New scripts:
- bump-version.js: version bumping across package.json/tauri/Cargo
- stage-sidecar.sh: stage + verify sidecar binary for Tauri bundler
- sign-and-notarize-macos.sh: macOS code signing and notarization
- repackage-dmg.sh: re-create and notarize DMG post-signing
- upload-macos-artifacts.sh: re-upload notarized artifacts to release
- package-cli-tarball.sh: package CLI binary into release tarball
- build-linux-arm64.sh: build Linux arm64 CLI tarball
- update-homebrew.sh: render and commit Homebrew formula to tap
- build-apt-packages.sh: build .deb packages and apt repository
- publish-npm.sh: stamp version and publish npm package
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Steven Enamakel