chore: retire Winget publish and Tauri cargo audit

.github/dependabot.yml

@@ -18,17 +18,3 @@ updates:
         update-types:
           - minor
           - patch
-
-  # Rust / Cargo — covers the Tauri desktop app dependencies.
-  - package-ecosystem: cargo
-    directory: /apps/desktop/src-tauri
-    schedule:
-      interval: weekly
-      day: monday
-      time: "08:00"
-      timezone: "America/Edmonton"
-    open-pull-requests-limit: 3
-    labels:
-      - dependencies
-      - security
-      - rust

.github/workflows/dependency-security.yml

@@ -2,8 +2,8 @@ name: Dependency Security
 
 # Runs on every PR and every push to main.
 # Hard-blocks on Critical npm vulnerabilities.
-# Hard-blocks on any Rust advisory (cargo audit).
 # Warns on High npm vulnerabilities (non-blocking — devDep false positives are common).
+# Tauri/cargo audit is not run — desktop releases are retired.
 
 on:
   pull_request:
@@ -75,30 +75,3 @@ jobs:
       # server/CLI filesystem operations use variable paths by design.
       - name: Run ESLint security rules
         run: npx eslint .
-
-  # ── Rust / cargo audit ─────────────────────────────────────────────────────
-  cargo-audit:
-    name: cargo audit
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache Cargo registry
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-audit-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
-          restore-keys: cargo-audit-
-
-      - name: Install cargo-audit
-        run: cargo install cargo-audit --locked --quiet
-
-      - name: Run cargo audit
-        working-directory: apps/desktop/src-tauri
-        run: cargo audit

.github/workflows/desktop-release.yml

@@ -1,7 +1,7 @@
 name: Desktop Release
 
 # RETIRED — desktop (Tauri) installers are no longer published.
-# Distribution is CLI-first: npm, Homebrew, Winget (CLI), and Docker.
+# Distribution is CLI-first: npm, Homebrew, and Docker.
 # See README.md and docs/DEPLOYMENT.md.
 #
 # This workflow is kept only so old workflow links do not 404. It does not

.github/workflows/release-gate.yml

@@ -79,30 +79,11 @@ jobs:
             | tar -xz -C /usr/local/bin gitleaks
       - run: gitleaks detect --source . --config .gitleaks.toml --redact
 
-  # ── Gate: cargo audit ───────────────────────────────────────────────────────
-  cargo-audit:
-    name: cargo audit
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-audit-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
-      - run: cargo install cargo-audit --locked --quiet
-      - run: cargo audit
-        working-directory: apps/desktop/src-tauri
-
   # ── Publish: create GitHub Release draft ────────────────────────────────────
   # Only runs if ALL gate jobs succeed.
   create-release:
     name: Create Release Draft
-    needs: [unit-tests, eslint-security, npm-audit, gitleaks, cargo-audit]
+    needs: [unit-tests, eslint-security, npm-audit, gitleaks]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -129,6 +110,5 @@ jobs:
             - ✅ ESLint security rules
             - ✅ npm audit (no Critical vulnerabilities)
             - ✅ Gitleaks (no secrets detected)
-            - ✅ cargo audit (no Rust advisories)
 
             > **Review this draft before publishing.** Edit the release notes above, then click "Publish release."

README.md

@@ -28,13 +28,7 @@ brew install foxschema
 docker pull 5nickels/foxschema:latest
 ```
 
-Windows (Winget — after package merge):
-
-```powershell
-winget install TediousCode.FoxSchema
-```
-
-Or Node + npm:
+Windows:
 
 ```powershell
 winget install OpenJS.NodeJS.LTS

SECURITY.md

@@ -53,7 +53,6 @@ Out of scope:
 Automated security checks run on every pull request and every push to `main`:
 
 - **npm audit** — blocks merges on Critical npm vulnerabilities
-- **cargo audit** — blocks merges on RustSec advisories
 - **Gitleaks** — detects committed secrets
 - **ESLint security rules** — static analysis for injection patterns and unsafe regex
 - **CodeQL** — weekly deep analysis (SQL injection, path traversal, prototype pollution)

docs/INSTALL.md

@@ -4,7 +4,7 @@ Fox Schema is a **local web app** launched from the CLI. After install you run
 `foxschema` (or double-click the **Fox Schema** desktop shortcut) to open
 **http://localhost:3210** in your browser.
 
-Requires **Node.js ≥ 22.5** for npm / Homebrew / Winget paths. Docker needs no Node.
+Requires **Node.js ≥ 22.5** for npm / Homebrew paths. Docker needs no Node.
 
 ---
 
@@ -14,7 +14,7 @@ Requires **Node.js ≥ 22.5** for npm / Homebrew / Winget paths. Docker needs no
 |----------|---------|
 | **npm** (macOS / Windows / Linux) | `npm install -g foxschema` |
 | **Homebrew** (macOS Arm + Intel) | `brew tap … && brew trust tedious-code/foxschema && brew install foxschema` |
-| **Winget** (Windows) | `winget install TediousCode.FoxSchema` (or Node + `npm i -g foxschema`) |
+| **Windows** | Install Node (`winget install OpenJS.NodeJS.LTS`), then `npm i -g foxschema` |
 | **Docker** (servers, linux/amd64) | `docker pull 5nickels/foxschema:latest` |
 | **curl / wget** (scripted npm) | see [curl / wget](#curl--wget) below |
 
@@ -55,25 +55,17 @@ Details: [homebrew.md](homebrew.md).
 
 ---
 
-## Windows (Winget)
+## Windows
 
-One package — CLI portable zip (depends on Node.js LTS):
-
-```powershell
-winget install TediousCode.FoxSchema
-foxschema
-foxschema shortcut
-```
-
-If the winget package is not merged yet:
+Install Node, then the CLI from npm:
 
 ```powershell
 winget install OpenJS.NodeJS.LTS
 npm install -g foxschema
+foxschema
+foxschema shortcut
 ```
 
-Details: [winget.md](winget.md).
-
 ---
 
 ## Docker

docs/PUBLISH.md

@@ -9,8 +9,8 @@ Distribution channels (one product, no separate Db2 edition):
 | **npm** | `foxschema` on registry.npmjs.org | `.github/workflows/npm-publish.yml` on `v*` tag |
 | **Docker** | `5nickels/foxschema:latest` + `:vX.Y.Z` (linux/amd64, includes Db2) | `.github/workflows/web-release.yml` on `v*` tag |
 | **Homebrew** | `Formula/foxschema.rb` in this repo | Manual commit after npm publish |
-| **Winget** | `TediousCode.FoxSchema` portable zip on GitHub Releases | `.github/workflows/winget.yml` on release / dispatch |
 | **Desktop Tauri** | **Retired** — do not publish | — |
+| **Winget** | **Retired** — do not publish | — |
 
 Version numbers are bumped automatically on merge to `main`
 (`.github/workflows/version-bump.yml`). Do **not** bump version in feature PRs.
@@ -95,8 +95,8 @@ foxschema shortcut
 ## 5. What not to publish
 
 - Do **not** run Desktop Release (retired).
+- Do **not** publish to Winget (retired).
 - Do **not** publish separate `db2-latest` / `FoxSchema.DB2` packages.
-- Do **not** open new winget MSI PRs for Tauri installers.
 
 ---