You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -124,7 +124,7 @@ On top of that archive, PathKeep gives you powerful recall (full-text search, re
124
124
Download the latest release from [GitHub Releases](https://github.com/t41372/PathKeep/releases).
125
125
126
126
-**macOS:** open the `.dmg`, move `PathKeep.app` to `/Applications`, then open it. Safari Browser Direct import requires granting Full Disk Access to PathKeep before scanning Safari history.
127
-
-**Windows:**Support is on the way. Build from source if you want to try it out right now. ~~install the release package. Scheduled backups use Windows Task Scheduler and remain preview-quality until more machines are validated.~~
127
+
-**Windows:**install the unsigned `.msi` or `-setup.exe` release package. Windows will show `Unknown Publisher`, and SmartScreen may require **More info -> Run anyway** until PathKeep has publisher reputation. Scheduled backups use Windows Task Scheduler. The installer bundles the WebView2 offline installer, but Windows Server Core / headless Server environments are not valid GUI acceptance hosts.
128
128
-**Linux:** Support is on the way. Build from source if you want to try it out right now. ~~install the `.AppImage`, `.deb`, or `.rpm` artifact. Linux scheduled-backup support is still preview/manual-review because desktop keyring and `systemd --user` behavior varies by distribution.~~
129
129
130
130
## Uninstall
@@ -206,7 +206,7 @@ Implemented browsers appear in discovery and archive data but are not yet in the
| Browser bundle |`bun run build`| CI / local validation | Confirms the frontend bundle still builds. |
24
+
| Debug desktop binary |`bun run desktop:build:debug`| Maintainers | Used for pre-release smoke and packaging rehearsal. |
25
+
| macOS `.app` / `.dmg`| GitHub `Release` workflow | Users | Signed / notarized only when Apple secrets are configured. |
26
+
| Windows installers | GitHub `Release` workflow | Users |Unsigned MSI / NSIS outputs bundle the WebView2 offline installer; `Unknown Publisher` and SmartScreen prompts are expected. |
27
+
| Linux `.AppImage` / `.deb` / `.rpm`| GitHub `Release` workflow | Users | Requires Linux packaging dependencies on the runner. |
28
+
|`SHA256SUMS.txt`| GitHub `Release` workflow | Users / operators | Attached to every release. |
29
+
|`RELEASE-MANIFEST.json`| GitHub `Release` workflow | Operators / support | Lists released files, sizes, and checksums for traceability. |
30
30
31
31
## Versioning Rules
32
32
@@ -83,6 +83,8 @@ Manual workflow inputs:
83
83
-`draft`
84
84
-`prerelease`
85
85
-`release_tag` (optional explicit tag; defaults to `v<package.json version>`)
86
+
-`platforms` (`all`, `linux-windows`, `linux`, `windows`, or `macos`)
87
+
-`unsigned_preview` (default `true`; required for the unsigned Windows release path)
86
88
87
89
Workflow behavior:
88
90
@@ -91,8 +93,9 @@ Workflow behavior:
91
93
- generate the local size attribution bundle with `bun run release:size-audit`
92
94
- resolves the tag and version up front
93
95
- verifies version sync across the repo
94
-
- builds release bundles on macOS, Windows, and Linux
95
-
- builds updater artifacts and publishes `latest.json`
96
+
- builds release bundles on the selected platform matrix
97
+
- when `unsigned_preview=true`, builds unsigned bundles with `--no-sign`, disables updater artifacts, and skips `latest.json`
98
+
- when `unsigned_preview=false`, builds updater artifacts and publishes `latest.json`
96
99
- uploads assets to the GitHub Release
97
100
- downloads the assets again
98
101
- publishes `SHA256SUMS.txt`
@@ -117,7 +120,9 @@ Workflow behavior:
117
120
-`TAURI_SIGNING_PRIVATE_KEY`
118
121
-`TAURI_SIGNING_PRIVATE_KEY_PASSWORD`
119
122
120
-
The current Tauri config has `bundle.createUpdaterArtifacts=true`, so the `Release` workflow fails fast when `TAURI_SIGNING_PRIVATE_KEY` is not configured. Set the private key as a repository Actions secret before dispatching the workflow:
123
+
The current Tauri config has `bundle.createUpdaterArtifacts=true`, so the `Release` workflow fails fast when `unsigned_preview=false` and `TAURI_SIGNING_PRIVATE_KEY` is not configured. Unsigned Windows installer builds use `unsigned_preview=true`; they do not need updater signing secrets and do not publish updater artifacts.
124
+
125
+
Set the updater private key as a repository Actions secret only before dispatching an updater-enabled release:
121
126
122
127
```bash
123
128
gh secret set TAURI_SIGNING_PRIVATE_KEY --repo t41372/PathKeep
@@ -126,13 +131,15 @@ gh secret set TAURI_SIGNING_PRIVATE_KEY_PASSWORD --repo t41372/PathKeep
126
131
127
132
### Windows Signing
128
133
129
-
PathKeep does not hardcode a single Windows signing provider in repo config. If you want signed Windows releases, choose and wire one operator-owned path before GA:
134
+
PathKeep's Windows release path is unsigned. The installer is expected to show `Unknown Publisher`, and SmartScreen may require the user to choose **More info -> Run anyway** until the project has publisher reputation.
135
+
136
+
The CI release config must keep Windows buildable without Windows code-signing secrets. If maintainers later want signed Windows releases, wire that as an optional hardening path without making unsigned Windows installers fail:
130
137
131
138
- certificate thumbprint in Tauri config
132
139
- custom `signCommand`
133
140
- Azure Trusted Signing / Azure Key Vault
134
141
135
-
Until that is configured, Windows stays an explicit preview channel.
142
+
Do not gate Windows preview support on any of those providers.
136
143
137
144
## Platform Validation
138
145
@@ -146,6 +153,7 @@ Every release rehearsal should cover:
146
153
- Safari baseline backup after Full Disk Access is granted
147
154
- schedule preview / install / verify / remove
148
155
- Windows Task Scheduler apply / status / mismatch or not-installed / remove on a real Windows host or VM
156
+
- Windows unsigned installer download, `Unknown Publisher` / SmartScreen prompt path, first launch, and reinstall / upgrade over an existing install
149
157
- encrypted archive unlock and re-open
150
158
- remote backup preview / execute / verify
151
159
- upgrade or reinstall over existing data
@@ -179,7 +187,7 @@ If a release is bad:
179
187
- Safari access on macOS still depends on Full Disk Access outside the app.
180
188
- Firefox support is a history-only baseline in this release; Firefox favicons, downloads, keyword-search sidecars, and richer `moz_*` evidence remain future work.
181
189
- ChatGPT Atlas / Perplexity Comet support remains scoped to the validated macOS browser-history profile layouts; Windows / Linux locations are not public release promises.
182
-
- Windows SmartScreen reputation depends on maintainer signing policy and reputation, not just a successful CI build.
190
+
- Windows installers are unsigned in the preview channel. SmartScreen reputation is not proof that the binary failed to build.
183
191
- Linux keyring behavior varies by desktop environment; encrypted mode remains supported, but unattended unlock can degrade.
184
192
- App Lock remains a session-only boundary; only macOS currently ships a real Touch ID unlock path.
Copy file name to clipboardExpand all lines: TESTING.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ bun run check
12
12
13
13
`bun run check` is the authoritative per-commit checker. It runs:
14
14
15
-
-`bun run check:base`: formatting, linting, i18n checks, type checking, unit tests, desktop-contract checks, Rust checks, supply-chain audit, and host-matched platform checks.
15
+
-`bun run check:base`: formatting, linting, i18n checks, type checking, unit tests, desktop-contract checks, Rust checks, supply-chain audit, host-matched platform checks, and release-config drift checks.
16
16
-`bun run coverage:js`: 100% statement / branch / function / line coverage for active frontend runtime source under `src/**/*.{ts,tsx}`.
17
17
-`bun run coverage:rust`: 100% line + function coverage for full `src-tauri/**/src/*.rs` workspace source.
18
18
-`bun run build`: TypeScript compile + Vite browser bundle.
@@ -27,6 +27,7 @@ Use these for release rehearsal and focused triage:
27
27
```bash
28
28
bun run verify
29
29
bun run check:base
30
+
bun run release:check
30
31
bun run coverage:js
31
32
bun run coverage:rust
32
33
bun run mutation:js
@@ -45,6 +46,7 @@ bun run test:e2e:desktop-bridge
45
46
What they mean:
46
47
47
48
-`bun run check:base`: fast static/unit/native triage path; it is not a signed-off merge gate by itself.
49
+
-`bun run release:check`: focused release config guard for updater URLs, unsigned Windows installer workflow, offline WebView2 bundling, and support-link drift.
48
50
-`bun run mutation:js`: desktop-contract Stryker gate used by `bun run check`.
49
51
-`bun run mutation:js:full`: active frontend runtime Stryker sweep for manual / scheduled deep checks.
50
52
-`bun run mutation:rust`: whole-workspace cargo-mutants deep sweep. Surviving mutants are failures unless a narrow equivalent/inapplicable exclusion is documented with evidence.
@@ -70,6 +72,7 @@ bun run test:unit:desktop-contract
70
72
bun run coverage:js:desktop-contract
71
73
bun run check:js
72
74
bun run check:rust
75
+
bun run release:check
73
76
bun run mutation:js:desktop-contract
74
77
bun run mutation:js:full
75
78
bun run mutation:rust:quality
@@ -80,6 +83,7 @@ bun run mutation:rust:quality
80
83
- Focused helpers do not replace `bun run check`.
81
84
- The desktop-contract slice only protects `src/main.tsx` and `src/lib/ipc/bridge.ts`.
82
85
- Browser-preview e2e does not verify native scheduler install, keyring integration, signing, notarization, or filesystem side effects. Windows Task Scheduler apply/status/remove must still be accepted on a real Windows host or VM even though the Rust unit slice uses a stubbed `schtasks` runner.
86
+
-`bun run release:check` proves the release config still permits unsigned Windows installers and bundles the WebView2 offline installer; it does not prove a specific Windows host can launch the installer.
83
87
- GitHub-hosted Windows runners currently validate the desktop surface with `desktop:build:debug`, `vault-platform` native-host tests, and frontend updater coverage. The `pathkeep-desktop` Rust test binary for updater/file-manager facades is skipped on Windows CI because the hosted runner fails before the test harness starts with a loader-level `STATUS_ENTRYPOINT_NOT_FOUND`; macOS/Linux still run those Rust facade tests.
84
88
- Chrome desktop-bridge smoke verifies the typed desktop command facade from a real browser, but it still does not magically grant every Tauri guest API to Chrome. Treat it as an agent/dev-loop surface, not the final WebView plugin truth.
85
89
- Platform validation for macOS / Windows / Linux lives in [RELEASE.md](./RELEASE.md) and [docs/plan/m4-full-polish/release-readiness-runbook.md](./docs/plan/m4-full-polish/release-readiness-runbook.md).
0 commit comments