Skip to content

chore(release): prepare v0.3.0-beta.1 (MAT-137) #176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mpiton merged 2 commits into from
Jul 19, 2026
Merged

chore(release): prepare v0.3.0-beta.1 (MAT-137) #176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
de38e63
chore(release): prepare v0.3.0-beta.1 (MAT-137)
mpiton Jul 19, 2026
d87537e
chore(release): harden release.yml and version script per review
mpiton Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
147 changes: 95 additions & 52 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,14 @@ jobs:
verify-tag:
name: Verify tag vs Cargo.toml + package.json + CHANGELOG
runs-on: ubuntu-latest
permissions:
contents: read
outputs:
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.
version: ${{ steps.tag.outputs.version }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false

- name: Extract version from tag
id: tag
Expand All @@ -37,32 +41,14 @@ jobs:
exit 1
fi

- name: Verify Cargo.toml version
run: |
CARGO_VERSION=$(grep -m1 '^version' src-tauri/Cargo.toml | cut -d'"' -f2)
if [ "$CARGO_VERSION" != "${{ steps.tag.outputs.version }}" ]; then
echo "::error::Cargo.toml version ($CARGO_VERSION) != tag (${{ steps.tag.outputs.version }})"
exit 1
fi

- name: Verify package.json version
run: |
PKG_VERSION=$(node -p "require('./package.json').version")
if [ "$PKG_VERSION" != "${{ steps.tag.outputs.version }}" ]; then
echo "::error::package.json version ($PKG_VERSION) != tag (${{ steps.tag.outputs.version }})"
exit 1
fi

- name: Verify CHANGELOG entry
run: |
VERSION='${{ steps.tag.outputs.version }}'
# Use fixed-string match for version prefix to avoid `.` matching any
# char (e.g., `1X2X3` accepted by an unescaped regex).
if ! grep -qF "## [${VERSION}]" CHANGELOG.md \
&& ! grep -qF "## ${VERSION}" CHANGELOG.md; then
echo "::error::CHANGELOG.md has no section for version ${VERSION}"
exit 1
fi
- name: Verify release version coherence
# Checks package.json, Cargo.toml, tauri.conf.json (app + wix) and
# the CHANGELOG section against the tag. Same script as the local
# pre-tag check documented in RELEASING.md. Version goes through env,
# not inline interpolation, so tag names can't inject into the shell.
env:
VERSION: ${{ steps.tag.outputs.version }}
run: bash scripts/check-release-versions.sh "$VERSION"
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.

create-release:
name: Create GitHub Release
Expand All @@ -74,7 +60,9 @@ jobs:
release_id: ${{ steps.create_release.outputs.id }}
upload_url: ${{ steps.create_release.outputs.upload_url }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false

- name: Verify updater pubkey is configured
run: |
Expand Down Expand Up @@ -103,7 +91,7 @@ jobs:

- name: Create GitHub Release
id: create_release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
name: Vortex ${{ github.ref_name }}
body: ${{ steps.meta.outputs.body }}
Expand All @@ -118,7 +106,9 @@ jobs:
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
Comment thread
coderabbitai[bot] marked this conversation as resolved.
with:
persist-credentials: false

- name: Install Linux dependencies
run: |
Expand All @@ -130,17 +120,17 @@ jobs:
libappindicator3-dev \
librsvg2-dev

- uses: actions/setup-node@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 22
cache: npm

- name: Install frontend dependencies
run: npm ci

- uses: dtolnay/rust-toolchain@stable
- uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable

- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
workspaces: src-tauri

Expand All @@ -151,19 +141,19 @@ jobs:
run: npx tauri build

- name: Upload .deb to release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: src-tauri/target/release/bundle/deb/*.deb

- name: Upload .rpm to release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: src-tauri/target/release/bundle/rpm/*.rpm

- name: Upload updater bundle to release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: |
Expand Down Expand Up @@ -193,21 +183,23 @@ jobs:
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false

- uses: actions/setup-node@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 22
cache: npm

- name: Install frontend dependencies
run: npm ci

- uses: dtolnay/rust-toolchain@stable
- uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
with:
targets: aarch64-apple-darwin,x86_64-apple-darwin

- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
workspaces: src-tauri

Expand Down Expand Up @@ -251,13 +243,13 @@ jobs:
xcrun stapler staple "$DMG"

- name: Upload .dmg to release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg

- name: Upload updater bundle to release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: |
Expand All @@ -271,19 +263,21 @@ jobs:
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false

- uses: actions/setup-node@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 22
cache: npm

- name: Install frontend dependencies
run: npm ci

- uses: dtolnay/rust-toolchain@stable
- uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable

- uses: Swatinem/rust-cache@v2
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
with:
workspaces: src-tauri

Expand All @@ -308,13 +302,13 @@ jobs:
run: Remove-Item -Path certificate.p12 -ErrorAction SilentlyContinue

- name: Upload .msi to release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: src-tauri/target/release/bundle/msi/*.msi

- name: Upload updater bundle to release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: |
Expand All @@ -328,7 +322,9 @@ jobs:
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false

- name: Install Flatpak tools
run: |
Expand All @@ -344,7 +340,7 @@ jobs:
flatpak build-bundle _repo vortex.flatpak org.vortex.Vortex

- name: Upload .flatpak to release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: vortex.flatpak
Expand All @@ -356,7 +352,9 @@ jobs:
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false

- name: Download signature files from release
env:
Expand Down Expand Up @@ -412,7 +410,52 @@ jobs:
EOF

- name: Upload latest.json to release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: latest.json

checksums:
name: Publish SHA-256 checksums + provenance
needs: [publish-flatpak, update-updater]
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false

- name: Download release assets
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
TAG_NAME: ${{ github.ref_name }}
run: |
mkdir -p assets
gh release download "$TAG_NAME" --repo "$GITHUB_REPOSITORY" --dir assets
# On a re-run the previous checksum files are release assets too;
# they must not end up inside the new SHA256SUMS.
rm -f assets/SHA256SUMS assets/PROVENANCE.txt

- name: Generate SHA256SUMS and PROVENANCE.txt
env:
TAG_NAME: ${{ github.ref_name }}
run: |
# git rev-list resolves annotated tags to the tagged commit;
# GITHUB_SHA is not reliable for that on tag pushes.
COMMIT=$(git rev-list -n1 "$TAG_NAME")
(cd assets && sha256sum *) > SHA256SUMS
{
echo "tag: $TAG_NAME"
echo "commit: $COMMIT"
echo "workflow_run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
echo "verify: sha256sum --check --ignore-missing SHA256SUMS"
} > PROVENANCE.txt

- name: Upload SHA256SUMS and PROVENANCE.txt
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: |
SHA256SUMS
PROVENANCE.txt
40 changes: 40 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

## [0.3.0-beta.1] - 2026-07-19

### Highlights

- CI is now the merge gate: a three-OS matrix (tests, lint, audits, Tauri
packaging), secrets scans, a blocking desktop E2E smoke test, and
reproducible plugin CI with checksummed release artifacts.
- Premium accounts work end to end: real validation, per-service selection,
rotation on quota or cooldown, credentials confined to the OS keyring.
- MediaFire, PixelDrain and Gofile pages are resolved by their hoster plugins
before transfer — HTML pages can no longer be saved as "successful" files.
- Galleries expand into selectable per-image rows in Link Grabber.
- Settings, plugin catalog and docs now match real capabilities: every visible
control either works or is explicitly marked as planned.

### Known limitations

- No CAPTCHA solving yet: 1fichier free downloads that require a CAPTCHA are
not supported.
- MEGA downloads are refused with an explicit error until host-side decryption
ships; the plugin only parses and validates links.
- No remote access: the REST API, WebSocket and Web UI do not exist yet; the
Remote Access settings section shows a planned-feature notice.
- Speed limit, disk pre-allocation and DNS-over-HTTPS settings are disabled
("Coming soon").
- macOS and Windows binaries ship unsigned; Gatekeeper/SmartScreen warnings
are expected.

### Upgrade notes (from v0.2.0-beta)

- SQLite migrations run automatically on first launch (adds the
premium-accounts wiring migration); existing downloads, packages, history
and accounts are preserved.
- `config.toml` keeps the same format; an invalid hand-edited `user_agent`
now falls back to the default instead of aborting startup.
- Installed plugins keep working: every registry entry declares
`min_vortex_version` ≤ 0.2.0, which this release satisfies. Updating
plugins from the Plugins view is still recommended to pick up the fixes
below.

### Security

- **MAT-132 transient premium URLs**: link analysis, IPC, queued downloads, and
Expand Down
Loading
Loading