From 77bd24acb851ed09c94822606b36f8d5613004db Mon Sep 17 00:00:00 2001 From: Kresna Date: Sat, 25 Jul 2026 17:20:28 +0700 Subject: [PATCH 1/4] fix(release): don't attempt Apple codesign without a certificate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit macOS builds compiled fine but failed at bundling: tauri-action tried `security import` on an empty APPLE_CERTIFICATE (the APPLE_* secrets aren't set) → "failed to import keychain certificate". Removed the empty APPLE_* env so macOS beta builds ship unsigned (Gatekeeper right-click→Open). Updater signing (TAURI_SIGNING_*) is unaffected. Re-add APPLE_* once the certs exist. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_013dqouzFP8vy9jaKhTDFj5H --- .github/workflows/release.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 923d4b6..0b1e0df 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -107,13 +107,12 @@ jobs: # Updater signing (required — tauri.conf.json declares a pubkey). TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} - # Code signing — set these secrets in the repo settings - APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} - APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} - APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} - APPLE_ID: ${{ secrets.APPLE_ID }} - APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} - APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} + # Apple code signing / notarization is intentionally NOT wired: the + # APPLE_* secrets aren't set, and passing empty ones makes tauri-action + # attempt `security import` and fail ("failed to import keychain + # certificate"). macOS beta builds ship unsigned (Gatekeeper: right-click + # → Open). To enable signing, set the APPLE_* secrets (see + # RELEASING-DESKTOP.md) and re-add them here. with: tagName: ${{ github.ref_name }} releaseName: 'GoodWebTools Desktop ${{ github.ref_name }}' From 5f0f9f5646f4dce6eb789e9b8cdeb329d5b0186f Mon Sep 17 00:00:00 2001 From: Kresna Date: Sat, 25 Jul 2026 17:20:56 +0700 Subject: [PATCH 2/4] chore(ci): remove stray Cloudflare Pages deploy workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The web app deploys via Cloudflare Workers Builds (git-based, no GitHub Actions — see DEPLOYMENT.md), and deploy.yml targeted Cloudflare *Pages* (wrong product; can't serve the R2 /models/* the Worker streams) while requiring CLOUDFLARE_API_TOKEN secrets that were never set. Only the desktop release uses GitHub Actions. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_013dqouzFP8vy9jaKhTDFj5H --- .github/workflows/deploy.yml | 40 ------------------------------------ 1 file changed, 40 deletions(-) delete mode 100644 .github/workflows/deploy.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml deleted file mode 100644 index 101f619..0000000 --- a/.github/workflows/deploy.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: Deploy to Cloudflare Pages - -on: - push: - branches: - - main - -jobs: - deploy: - runs-on: ubuntu-latest - permissions: - contents: read - deployments: write - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '20' - cache: 'npm' - - - name: Install dependencies - run: npm ci --legacy-peer-deps - - - name: Build - env: - # The asset-heavy Astro build OOMs on the default ~2 GB Node heap. - NODE_OPTIONS: --max-old-space-size=8192 - run: npm run build - - - name: Deploy to Cloudflare Pages - uses: cloudflare/pages-action@v1 - with: - apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} - accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} - projectName: goodwebtools - directory: dist - gitHubToken: ${{ secrets.GITHUB_TOKEN }} From 897fd9cec8a1e1c7c3b75233475594500b3de3f4 Mon Sep 17 00:00:00 2001 From: Kresna Date: Sat, 25 Jul 2026 17:27:03 +0700 Subject: [PATCH 3/4] fix(release): add gbm/EGL/GL dev libs for the Linux build link step The Linux release build failed at link: `rust-lld: error: unable to find library -lgbm`. xcap's Linux capture backend links gbm/EGL/GL (plus pipewire/ wayland already present). desktop-check passed because `cargo check` doesn't link. Added libgbm-dev, libegl1-mesa-dev, libgl1-mesa-dev. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_013dqouzFP8vy9jaKhTDFj5H --- .github/workflows/release.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0b1e0df..9446ddd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -72,6 +72,9 @@ jobs: libxcb1-dev \ libxcb-randr0-dev \ libxcb-shm0-dev \ + libgbm-dev \ + libegl1-mesa-dev \ + libgl1-mesa-dev \ libclang-dev \ clang \ pkg-config From 6cdfa9b7f325f1ec877ba6de53d871689811425b Mon Sep 17 00:00:00 2001 From: Kresna Date: Sat, 25 Jul 2026 17:31:38 +0700 Subject: [PATCH 4/4] fix(release): use NSIS (not MSI) for Windows so the beta version bundles Windows failed: MSI/WiX requires a numeric-only version, but the tag is 1.0.0-beta.1 ("pre-release identifier must be numeric-only for msi target"). Switched bundle.targets to an explicit list without msi: nsis (Windows), app+dmg (macOS), deb+appimage (Linux). NSIS handles arbitrary version strings and still supports the updater. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_013dqouzFP8vy9jaKhTDFj5H --- src-tauri/tauri.conf.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json index ec979a8..5e0c773 100644 --- a/src-tauri/tauri.conf.json +++ b/src-tauri/tauri.conf.json @@ -77,7 +77,7 @@ }, "bundle": { "active": true, - "targets": "all", + "targets": ["nsis", "app", "dmg", "deb", "appimage"], "resources": [], "category": "Utility", "shortDescription": "Privacy-first client-side tools",