fix(updater): generate latest.json manifest (workaround tauri-action#1098) + bun release#187
Merged
Merged
Conversation
…1098)
tauri-action@v1 fails to collect the `.sig` artifacts ("Signature not
found for the updater JSON. Skipping upload..."), so the auto-update
manifest `latest.json` is never uploaded — every release since v0.2.0 is
missing it, and clients error with "Could not fetch a valid release JSON
from the remote".
Workaround (deterministic, doesn't depend on tauri-action's flaky manifest
logic):
- Each platform build uploads its signed updater bundle + `.sig` as a
workflow artifact (the `.sig` exists on disk; tauri-action just doesn't
collect it).
- A new `publish-updater-json` job downloads those artifacts and runs
scripts/build-updater-manifest.ts, which reads each `.sig` + maps it to
the matching release-asset URL (via `gh`) and writes a Tauri v2
`latest.json` (version/notes/pub_date/platforms), then uploads it to the
release with `gh release upload --clobber`.
Also:
- Switch the release runner to bun (oven-sh/setup-bun@v2 + bun install +
tauriScript: "bunx tauri"), matching the project tooling preference.
- Remove the invalid `updaterKeepSingleGroup` input (not a valid
tauri-action@v1 input — it was warned + ignored).
NOTE: end-to-end verification requires a release cut (tag push) — the
manifest job only runs there. Suggest cutting v0.3.3-beta.1 to confirm
latest.json appears + the in-app updater resolves.
Linux (deb/rpm) has no auto-update bundle (no AppImage target); it's
omitted from the manifest by design (updater_key: "").
🔍 Cora AI Code Review✅ No issues found. Code looks good! Review powered by cora-cli · BYOK · MIT |
Merged
ajianaz
added a commit
that referenced
this pull request
Jul 21, 2026
* chore(release): v0.3.3 Patch release — auto-update now works, unified search, HTTP-only version gate, server version in Settings, bun tooling. - bump version 0.3.2 → 0.3.3 (package.json, Cargo.toml, Cargo.lock, tauri.conf.json) - CHANGELOG entry Contents (since v0.3.2): - Added: unified search across memories + documents — "Memories | All" toggle (#184, #185) - Fixed: auto-update — generates latest.json manifest (workaround tauri-action#1098 that left every release since v0.2.0 without it) (#187) - Changed: version detection fully HTTP-only (#183); uteke server version in Settings → Connections (#186); tooling switched to bun (#186, #187) Verified: cargo fmt/clippy(-D warnings)/test (18), svelte-check (0 err), vitest (61), npm build. * feat(settings): make codecora.dev clickable (opens in browser) The "codecora.dev" line under CorIn vX.Y.Z in the Settings sidebar is now a link — clicking opens https://codecora.dev in the system browser via @tauri-apps/plugin-shell (preventDefault + shellOpen), matching how DocumentsView handles external links. Accessible (real href) + hover style.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes auto-update. Every release since v0.2.0 is missing
latest.json, so the in-app updater errors with "Could not fetch a valid release JSON from the remote".Root cause (confirmed in v0.3.2 run logs + tauri-action#1098): tauri-action@v1 fails to collect the
.sigartifacts →Signature not found for the updater JSON. Skipping upload...→ nolatest.json. Signing secrets ARE correctly set; the.sigfiles ARE generated on disk — the action just doesn't assemble them into the manifest.Workaround (deterministic — no reliance on tauri-action's manifest logic):
.sigas a workflow artifact (actions/upload-artifact@v4).publish-updater-jsonjob downloads them + runsscripts/build-updater-manifest.ts, which reads each.sigand maps it to the matching release-asset URL (viagh release view) → writes a Tauri v2latest.json(version/notes/pub_date/platforms{os-arch:{signature,url}}) →gh release upload --clobber.Also: release runner switched to bun (
oven-sh/setup-bun@v2+bun install+tauriScript: "bunx tauri"); removed the invalidupdaterKeepSingleGroupinput.Verified locally: YAML parses;
bun build scripts/build-updater-manifest.tstranspiles clean; FE unchanged (svelte-check 0 err, vitest 61).⚠ End-to-end needs a release cut to confirm — the manifest job only runs on tag push. Suggest cutting
v0.3.3-beta.1to verifylatest.jsonappears in the release + the in-app updater resolves. Linux (deb/rpm) has no auto-update bundle (no AppImage target) → omitted from the manifest by design.