From ddd1647ac87d14e47fe617e7b6e50542bad85558 Mon Sep 17 00:00:00 2001
From: Daniel Elskamp <daniel@dginx.dev>
Date: Wed, 1 Jul 2026 10:15:30 +0200
Subject: [PATCH] ci: make releases fully tag-driven across all version fields
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

v0.2.0 shipped with mismatched versions: the Windows/Linux artifacts and
the macOS app were 0.1.2 (from tauri.conf.json) while the tag and the
widget were 0.2.0, because the workflow only synced package.json.

Add scripts/set-version.sh, which sets the version in package.json,
tauri.conf.json, Cargo.toml and both lockfiles (node/npm/perl only, no
Rust toolchain needed). Call it from all three release contexts — the
changelog job (which now commits every bumped file back to main) and the
Windows/Linux and macOS build jobs — so tagging vX.Y.Z is enough and all
artifacts match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 23 ++++++++++++-----------
 scripts/set-version.sh        | 31 +++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 11 deletions(-)
 create mode 100755 scripts/set-version.sh

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cd9eeb5..814962b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,14 +36,14 @@ jobs:
         # --ignore-scripts: this job never builds the Tauri app, just the changelog.
         run: npm ci --ignore-scripts
 
-      - name: Sync package version to release tag
-        # conventional-changelog labels commits-since-the-last-tag with the
-        # package.json version. Derive the version from the tag (strip "v") and
-        # write it back so the newest section is labeled correctly.
-        # --allow-same-version makes this a no-op when they already agree.
+      - name: Sync all version fields to release tag
+        # Set the version everywhere (package.json, tauri.conf.json, Cargo.toml,
+        # lockfiles) so the release is fully tag-driven — no hand-editing — and
+        # every platform's artifacts match. conventional-changelog also reads
+        # package.json for the newest section's label.
         run: |
           TAG='${{ github.event.inputs.tag || github.ref_name }}'
-          npm version "${TAG#v}" --no-git-tag-version --allow-same-version
+          bash scripts/set-version.sh "${TAG#v}"
 
       - name: Generate full CHANGELOG.md
         run: |
@@ -59,7 +59,8 @@ jobs:
         run: |
           git config user.name 'github-actions[bot]'
           git config user.email 'github-actions[bot]@users.noreply.github.com'
-          git add package.json CHANGELOG.md
+          git add package.json package-lock.json \
+            src-tauri/tauri.conf.json src-tauri/Cargo.toml src-tauri/Cargo.lock CHANGELOG.md
           if git diff --cached --quiet; then
             echo 'Version and CHANGELOG.md unchanged — nothing to commit.'
           else
@@ -124,11 +125,11 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Sync package version to release tag
+      - name: Sync all version fields to release tag
         shell: bash
         run: |
           TAG='${{ github.event.inputs.tag || github.ref_name }}'
-          npm version "${TAG#v}" --no-git-tag-version --allow-same-version
+          bash scripts/set-version.sh "${TAG#v}"
 
       - name: Build & upload (tauri-action)
         uses: tauri-apps/tauri-action@v0
@@ -162,10 +163,10 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Sync package version to release tag
+      - name: Sync all version fields to release tag
         run: |
           TAG='${{ github.event.inputs.tag || github.ref_name }}'
-          npm version "${TAG#v}" --no-git-tag-version --allow-same-version
+          bash scripts/set-version.sh "${TAG#v}"
 
       - name: Set up code signing
         # Import the Developer ID cert into a dedicated keychain, derive the
diff --git a/scripts/set-version.sh b/scripts/set-version.sh
new file mode 100755
index 0000000..9f84268
--- /dev/null
+++ b/scripts/set-version.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Set the project version in every place that carries it, so a release is fully
+# driven by the git tag (no hand-editing of multiple files). Used by the release
+# workflow; safe to run locally too.
+#
+#   scripts/set-version.sh 0.2.0
+#
+# Touches: package.json (+ package-lock.json), src-tauri/tauri.conf.json,
+# src-tauri/Cargo.toml ([package] version) and src-tauri/Cargo.lock (the notefix
+# entry). Uses only node/npm/perl so it runs on any runner without a Rust
+# toolchain.
+
+V="${1:?usage: set-version.sh <version, e.g. 0.2.0>}"
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+# package.json + package-lock.json
+npm version "$V" --no-git-tag-version --allow-same-version >/dev/null
+
+# tauri.conf.json (drives the app + Windows/Linux artifact version)
+node -e "const fs=require('fs');const f='src-tauri/tauri.conf.json';const c=JSON.parse(fs.readFileSync(f,'utf8'));c.version=process.argv[1];fs.writeFileSync(f,JSON.stringify(c,null,2)+'\n')" "$V"
+
+# src-tauri/Cargo.toml — only the [package] version, not dependency versions.
+V="$V" perl -0pi -e 's/(\[package\][^\[]*?\nversion = ")[^"]*(")/$1$ENV{V}$2/s' src-tauri/Cargo.toml
+
+# src-tauri/Cargo.lock — the notefix entry (version string only; deps unchanged).
+V="$V" perl -0pi -e 's/(name = "notefix"\nversion = ")[^"]*(")/$1$ENV{V}$2/' src-tauri/Cargo.lock
+
+echo "version set to $V"