Releases on git.crt.fyi from a workflow: a v* tag push runs .forgejo/workflows/release.yml (tag = package.json version and every version copy, the full CI, Linux AppImage + deb and Windows NSIS on the VDS runners, privacy scan with the private terms, one Forgejo release with short CHANGELOG-summary notes, the installers and SHA256SUMS, older release entries deleted, tags kept); workflow_dispatch dry run makes a draft test-<sha> and deletes it; desktop.yml folded in, ci.yml and release.yml share .forgejo/actions/linux-setup and ci-run; tools/forgejo-release.ts (notes, upsert, prune, delete; uploads over 100 MB go to the origin because Cloudflare refuses them); desktop-release.ts upload-forgejo adds the notarized DMG and updater bundle from the Mac; docs/desktop-release.md release order

.forgejo/actions/ci-run/action.yml

@@ -0,0 +1,45 @@
+# `bun run ci` after .forgejo/actions/linux-setup: the target / timings / Playwright caches, bun install, headless
+# Chromium, Node 20 (the npm bundle's oldest supported Node) and the full CI. Shared by ci.yml and release.yml.
+name: ci-run
+description: storebound's full CI (bun run ci) on the Linux runner
+runs:
+  using: composite
+  steps:
+    - uses: actions/cache@v4
+      with:
+        path: apps/desktop/src-tauri/target
+        key: ci-target-${{ runner.os }}-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
+        restore-keys: ci-target-${{ runner.os }}-
+    # recorded test durations (shard balance) and tsc's incremental build info
+    - uses: actions/cache@v4
+      with:
+        path: node_modules/.cache/storebound-ci
+        key: ci-timings-${{ runner.os }}-${{ github.sha }}
+        restore-keys: ci-timings-${{ runner.os }}-
+    - name: Install
+      shell: bash
+      run: |
+        bun --version && cargo --version
+        bun install --frozen-lockfile
+    # Playwright's Chromium and headless shell (~280 MB), keyed by the browser builds the installed playwright-core
+    # wants (its browsers.json); the system libraries and fonts (--with-deps) are installed on every run, the job
+    # container starts clean
+    - uses: actions/cache@v4
+      with:
+        path: ~/.cache/ms-playwright
+        key: playwright-${{ runner.os }}-${{ hashFiles('node_modules/playwright-core/browsers.json') }}
+        restore-keys: playwright-${{ runner.os }}-
+    # the job runs as root in a container: storebound adds --no-sandbox to the Chromium it starts itself there
+    # (cli/shots/browser.ts sandboxArgs), Playwright's own launches already pass it
+    - name: Headless Chromium (browser tests, desktop boot check)
+      shell: bash
+      run: bunx playwright install --with-deps chromium
+    # the npm bundle runs on Node 20+: tools/ci.ts smoke-tests dist/storebound.mjs with the oldest supported Node
+    - uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+    # the runner sets CI=true in the job and it wins over the workflow env above: set CI=full for the command
+    # itself, or tools/ci.ts skips the desktop Rust tests and clippy when the push did not touch src-tauri
+    - name: bun run ci
+      shell: bash
+      run: CI=full bun run ci

.forgejo/actions/linux-setup/action.yml

@@ -0,0 +1,42 @@
+# Shared setup of the Linux jobs (ci.yml; release.yml's ci and linux jobs) on the VDS runner (label ubuntu-22.04, the
+# catthehacker act image): Tauri's system packages plus `packages`, the Bun / Cargo caches, Bun and Rust on PATH.
+name: linux-setup
+description: System packages, caches, Bun and Rust for storebound's Linux jobs
+inputs:
+  packages:
+    description: Extra apt packages
+    default: ''
+  cache-key:
+    description: Cache key prefix (separate caches for CI and the installer build)
+    default: ci
+  rust-components:
+    description: Extra rustup components (for example clippy)
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: System packages
+      shell: bash
+      run: |
+        sudo apt-get update -qq
+        sudo apt-get install -y -qq --no-install-recommends libwebkit2gtk-4.1-dev libgtk-3-dev \
+          libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev libjavascriptcoregtk-4.1-dev libssl-dev libxdo-dev \
+          build-essential curl unzip pkg-config ${{ inputs.packages }} >/dev/null
+    - uses: actions/cache@v4
+      with:
+        path: |
+          ~/.bun/install/cache
+          ~/.cargo/registry/index
+          ~/.cargo/registry/cache
+          ~/.cargo/git/db
+        key: ${{ inputs.cache-key }}-${{ runner.os }}-${{ hashFiles('bun.lock', 'apps/desktop/src-tauri/Cargo.lock') }}
+        restore-keys: ${{ inputs.cache-key }}-${{ runner.os }}-
+    - name: Bun and Rust
+      shell: bash
+      run: |
+        P="${FORGEJO_PATH:-$GITHUB_PATH}"
+        curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}" >/dev/null
+        echo "$HOME/.bun/bin" >> "$P"
+        command -v rustup || curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
+        echo "$HOME/.cargo/bin" >> "$P"
+        for c in ${{ inputs.rust-components }}; do "$HOME/.cargo/bin/rustup" component add "$c"; done