feat(menubar): translate the Windows tray app

.github/workflows/build-desktop-mac.yml

@@ -0,0 +1,132 @@
+name: Build macOS desktop
+
+# Builds, signs and notarizes the desktop app for arm64 and x64 in one electron-builder run,
+# so a single latest-mac.yml lists both zips. Read-only like the Windows installer workflow:
+# the release owner uploads the artifact to the desktop-v* release by hand.
+on:
+  push:
+    tags:
+      - 'desktop-v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  mac:
+    runs-on: macos-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22.13.0
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            app/package-lock.json
+
+      - name: Check tag matches the app version
+        if: github.ref_type == 'tag'
+        run: test "desktop-v$(node -p "require('./app/package.json').version")" = "$GITHUB_REF_NAME"
+
+      - name: Install dependencies
+        run: |
+          npm ci
+          npm ci --prefix app
+
+      - name: Check secrets and write notary key
+        env:
+          MACOS_CERT_P12_BASE64: ${{ secrets.MACOS_CERT_P12_BASE64 }}
+          MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
+          APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
+          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
+          APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
+        run: |
+          for name in MACOS_CERT_P12_BASE64 MACOS_CERT_PASSWORD APPSTORE_API_KEY_P8_BASE64 APPSTORE_API_KEY_ID APPSTORE_API_ISSUER_ID; do
+            if [ -z "${!name}" ]; then echo "::error::secret $name is not set"; exit 1; fi
+          done
+          echo "$APPSTORE_API_KEY_P8_BASE64" | base64 --decode > "$RUNNER_TEMP/notary.p8"
+          # Keychain Access exports a legacy p12 (RC2-40, sha1 MAC, 1 iteration) that the
+          # runner's `security import` rejects as a wrong password; rewrap it in a form it reads.
+          # electron-builder's own temporary keychain fails to unlock on this runner, so import
+          # into our keychain (as release-menubar.yml does) and let it find the identity there.
+          umask 077
+          openssl3="$(brew --prefix openssl@3)/bin/openssl"
+          cert="$RUNNER_TEMP/signing.p12"
+          keychain="$RUNNER_TEMP/codeburn-signing.keychain-db"
+          base64 --decode <<< "$MACOS_CERT_P12_BASE64" > "$cert.in"
+          "$openssl3" pkcs12 -legacy -in "$cert.in" -passin env:MACOS_CERT_PASSWORD -nodes -out "$cert.pem"
+          export cert_password="$(openssl rand -hex 24)"
+          echo "::add-mask::$cert_password"
+          "$openssl3" pkcs12 -export -legacy -in "$cert.pem" -out "$cert" -passout env:cert_password \
+            -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1 -iter 2048
+          rm -f "$cert.in" "$cert.pem"
+          keychain_password="$(openssl rand -hex 24)"
+          echo "::add-mask::$keychain_password"
+          security create-keychain -p "$keychain_password" "$keychain"
+          security set-keychain-settings -lut 21600 "$keychain"
+          security unlock-keychain -p "$keychain_password" "$keychain"
+          security import "$cert" -k "$keychain" -P "$cert_password" -f pkcs12 -T /usr/bin/codesign -T /usr/bin/security
+          rm -f "$cert"
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain" > /dev/null
+          # shellcheck disable=SC2046
+          security list-keychains -d user -s "$keychain" $(security list-keychains -d user | tr -d '"')
+          security find-identity -v -p codesigning "$keychain" | grep -q 'Developer ID Application: .*(XRVP7P7F9M)' \
+            || { echo "::error::No Developer ID Application identity for team XRVP7P7F9M in MACOS_CERT_P12_BASE64."; exit 1; }
+
+      - name: Build, sign and notarize
+        working-directory: app
+        env:
+          APPLE_API_KEY: ${{ runner.temp }}/notary.p8
+          APPLE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPSTORE_API_ISSUER_ID }}
+        run: |
+          npm run stage-cli
+          npm run build
+          CSC_IDENTITY_AUTO_DISCOVERY=true npx electron-builder --mac --publish never \
+            -c.mac.identity="Resham Joshi (XRVP7P7F9M)" \
+            -c.mac.hardenedRuntime=true \
+            -c.dmg.sign=true
+
+      - name: Notarize and staple the dmgs
+        working-directory: app/release
+        env:
+          APPLE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPSTORE_API_ISSUER_ID }}
+        run: |
+          for dmg in CodeBurn-*.dmg; do
+            xcrun notarytool submit "$dmg" --key "$RUNNER_TEMP/notary.p8" --key-id "$APPLE_API_KEY_ID" --issuer "$APPLE_API_ISSUER" --wait
+            xcrun stapler staple "$dmg"
+          done
+
+      - name: Verify signatures
+        working-directory: app/release
+        run: |
+          for app in mac-arm64/CodeBurn.app mac/CodeBurn.app; do
+            codesign --verify --deep --strict "$app"
+            spctl --assess --type execute --verbose "$app"
+          done
+          for dmg in CodeBurn-*.dmg; do xcrun stapler validate "$dmg"; done
+          grep -Eq 'url: CodeBurn-[0-9.]+-arm64-mac\.zip' latest-mac.yml
+          grep -Eq 'url: CodeBurn-[0-9.]+-mac\.zip' latest-mac.yml
+
+      - name: Remove notary key
+        if: always()
+        run: |
+          rm -f "$RUNNER_TEMP/notary.p8"
+          security delete-keychain "$RUNNER_TEMP/codeburn-signing.keychain-db" 2>/dev/null || true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: CodeBurn-macOS
+          path: |
+            app/release/CodeBurn-*.dmg
+            app/release/CodeBurn-*.dmg.blockmap
+            app/release/CodeBurn-*-mac.zip
+            app/release/CodeBurn-*-mac.zip.blockmap
+            app/release/latest-mac.yml
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/build-windows-installer.yml

@@ -65,9 +65,11 @@ jobs:
         working-directory: windows
         run: npm ci
 
+      # The staged tray MSI needs no updater signature: the tray updates from its own windows-v* line.
       - name: Build tray app
         working-directory: windows
-        run: npm run tauri build
+        shell: bash
+        run: npm run tauri build -- --no-sign
 
       - name: Build NSIS installer
         run: npm --prefix app run package:win
@@ -88,6 +90,7 @@ jobs:
           path: |
             app/release/CodeBurn-Setup-*.exe
             app/release/CodeBurn-Setup-*.exe.blockmap
+            app/release/latest.yml
           if-no-files-found: error
           retention-days: 30
 
@@ -107,3 +110,36 @@ jobs:
           node app/scripts/verify-windows-installer.mjs \
             --tag "$RELEASE_TAG" \
             --release-assets "$RUNNER_TEMP/release-assets.json"
+
+  # Last step of a desktop release: point the app's update feed at it. Runs only after the
+  # live-asset check passes, and refuses to move the feed backwards.
+  publish-update-feeds:
+    needs: verify-release-assets
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Publish desktop update feeds
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.release_tag }}
+        run: |
+          set -euo pipefail
+          cd "$RUNNER_TEMP"
+          version="${RELEASE_TAG#desktop-v}"
+          gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" --jq '[.assets[].name]' > release-assets.json
+          gh release download "$RELEASE_TAG" -R "$GITHUB_REPOSITORY" -p 'latest*.yml'
+          node "$GITHUB_WORKSPACE/app/scripts/update-feed.mjs" --tag "$RELEASE_TAG" --release-assets release-assets.json latest*.yml
+          if gh release view update-feeds -R "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            current=$(gh release download update-feeds -R "$GITHUB_REPOSITORY" -p latest-mac.yml -O - 2>/dev/null | sed -n 's/^version: //p' || true)
+            if [ -n "$current" ] && [ "$(printf '%s\n%s\n' "$current" "$version" | sort -V | tail -1)" != "$version" ]; then
+              echo "::error::update-feeds already serves $current, newer than $version"
+              exit 1
+            fi
+          else
+            gh release create update-feeds -R "$GITHUB_REPOSITORY" --prerelease --latest=false \
+              --title "Update feeds" --notes "Update metadata for the apps. Not a release to download."
+          fi
+          gh release upload update-feeds -R "$GITHUB_REPOSITORY" latest*.yml --clobber

.github/workflows/build-windows-store.yml

@@ -57,7 +57,8 @@ jobs:
 
       - name: Build tray app
         working-directory: windows
-        run: npm run tauri build -- --no-bundle
+        shell: bash
+        run: npm run tauri build -- --no-bundle --no-sign
 
       - name: Build Microsoft Store package
         run: npm --prefix app run package:store

.github/workflows/release-menubar-windows.yml

@@ -2,8 +2,9 @@ name: Release Windows Menubar
 
 # Triggers on a `windows-v*` tag push (e.g. `git tag windows-v0.9.20 && git push origin
 # windows-v0.9.20`), or manually via the Actions tab. Mirrors release-menubar.yml, which
-# does the same job for the macOS menubar under the `mac-v*` tags. The produced `.msi` is
-# unsigned; users see a SmartScreen prompt on first run until we add signing.
+# does the same job for the macOS menubar under the `mac-v*` tags. The produced `.msi` has no
+# Authenticode signature, so SmartScreen prompts on first run; the tray's one-click updater
+# instead checks the minisign signature written into windows-latest.json on update-feeds.
 on:
   push:
     tags:
@@ -54,9 +55,20 @@ jobs:
         working-directory: windows
         run: npm ci
 
+      # Without the updater key the MSI ships unsigned for the updater and the feed is left alone.
       - name: Build MSI bundle
         working-directory: windows
-        run: npm run tauri build
+        shell: bash
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          if [ -n "$TAURI_SIGNING_PRIVATE_KEY" ]; then
+            npm run tauri build
+          else
+            echo "::warning::TAURI_SIGNING_PRIVATE_KEY is not set; building without an updater signature"
+            npm run tauri build -- --no-sign
+          fi
 
       - name: Collect artifacts
         shell: bash
@@ -98,8 +110,43 @@ jobs:
 
             This `.msi` is a developer preview. The recommended install is the Microsoft
             Store (https://apps.microsoft.com/detail/9P0R4ZL5XMB8), which is signed and
-            updates itself. Preview builds do not update themselves: the tray app reports
-            that a newer version exists and links to the release, and you take it by
-            re-running `codeburn menubar --force` or downloading the new `.msi` here.
+            updates itself. Previews built with the updater key install newer previews from
+            the tray in one click, after checking their signature. Older previews link to the
+            release instead: take it by re-running `codeburn menubar --force` or downloading
+            the new `.msi` here.
           files: release-artifacts/*
           fail_on_unmatched_files: true
+
+      # Last: point the tray's updater at the release, once its MSI is live on it.
+      - name: Publish tray update feed
+        if: startsWith(github.ref, 'refs/tags/windows-v')
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#windows-v}"
+          msi="CodeBurn.Menubar_${version}_x64_en-US.msi"
+          gh release view "$GITHUB_REF_NAME" -R "$GITHUB_REPOSITORY" --json assets --jq '.assets[].name' | grep -Fqx "$msi"
+          sig=$(find windows/src-tauri/target/release/bundle/msi -name "*_${version}_x64_en-US.msi.sig" | head -1)
+          if [ -z "$sig" ]; then
+            echo "::warning::no updater signature for $msi; update-feeds/windows-latest.json not changed"
+            exit 0
+          fi
+          VERSION="$version" MSI="$msi" SIG="$sig" node -e '
+            const fs = require("fs")
+            const { VERSION, MSI, SIG } = process.env
+            fs.writeFileSync("windows-latest.json", JSON.stringify({
+              version: VERSION,
+              pub_date: new Date().toISOString(),
+              platforms: {
+                "windows-x86_64": {
+                  signature: fs.readFileSync(SIG, "utf8").trim(),
+                  url: `https://github.com/getagentseal/codeburn/releases/download/windows-v${VERSION}/${MSI}`,
+                },
+              },
+            }, null, 2))'
+          gh release view update-feeds -R "$GITHUB_REPOSITORY" >/dev/null 2>&1 || \
+            gh release create update-feeds -R "$GITHUB_REPOSITORY" --prerelease --latest=false \
+              --title "Update feeds" --notes "Update metadata for the apps. Not a release to download."
+          gh release upload update-feeds -R "$GITHUB_REPOSITORY" windows-latest.json --clobber