Releases on git.crt.fyi from a workflow: a v* tag push runs .forgejo/workflows/release.yml (tag = package.json version and every version copy, the full CI, Linux AppImage + deb and Windows NSIS on the VDS runners, privacy scan with the private terms, one Forgejo release with short CHANGELOG-summary notes, the installers and SHA256SUMS, older release entries deleted, tags kept); workflow_dispatch dry run makes a draft test-<sha> and deletes it; desktop.yml folded in, ci.yml and release.yml share .forgejo/actions/linux-setup and ci-run; tools/forgejo-release.ts (notes, upsert, prune, delete; uploads over 100 MB go to the origin because Cloudflare refuses them); desktop-release.ts upload-forgejo adds the notarized DMG and updater bundle from the Mac; docs/desktop-release.md release order

.forgejo/workflows/ci.yml

@@ -2,7 +2,8 @@
 # desktop i18n / typecheck / build, desktop boot check (headless Chromium), desktop Rust tests and clippy, scrub. Runs on the VDS runner (docs/desktop-release.md).
 # tools/ci.ts runs the steps as a task graph and the tests as parallel shards (CPU cores - 1, max 8) on the one
 # self-hosted runner, so a job matrix would only queue; CI=full makes it run the Rust steps on every push.
-# Publishes nothing: site/ is still published by Jenkins.
+# Publishes nothing: site/ is still published by Jenkins; releases come from release.yml (a v* tag).
+# release.yml's ci job runs the same steps (the setup is shared: .forgejo/actions/linux-setup).
 name: ci
 
 on:
@@ -27,57 +28,8 @@ jobs:
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
-      - name: System packages (Tauri on Linux)
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq --no-install-recommends libwebkit2gtk-4.1-dev libgtk-3-dev \
-            libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev libjavascriptcoregtk-4.1-dev libssl-dev libxdo-dev \
-            build-essential curl unzip pkg-config >/dev/null
-      - uses: actions/cache@v4
+      - uses: ./.forgejo/actions/linux-setup
         with:
-          path: |
-            ~/.bun/install/cache
-            ~/.cargo/registry/index
-            ~/.cargo/registry/cache
-            ~/.cargo/git/db
-            apps/desktop/src-tauri/target
-          key: ci-${{ runner.os }}-${{ hashFiles('bun.lock', 'apps/desktop/src-tauri/Cargo.lock') }}
-          restore-keys: ci-${{ runner.os }}-
-      # recorded test durations (shard balance) and tsc's incremental build info
-      - uses: actions/cache@v4
-        with:
-          path: node_modules/.cache/storebound-ci
-          key: ci-timings-${{ runner.os }}-${{ github.sha }}
-          restore-keys: ci-timings-${{ runner.os }}-
-      - name: Bun and Rust
-        run: |
-          P="${FORGEJO_PATH:-$GITHUB_PATH}"
-          curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}" >/dev/null
-          echo "$HOME/.bun/bin" >> "$P"
-          command -v rustup || curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --component clippy
-          echo "$HOME/.cargo/bin" >> "$P"
-      - name: Install
-        run: |
-          rustup component add clippy
-          bun --version && cargo --version
-          bun install --frozen-lockfile
-      # Playwright's Chromium and headless shell (~280 MB), keyed by the browser builds the installed playwright-core
-      # wants (its browsers.json); the system libraries and fonts (--with-deps) are installed on every run, the job
-      # container starts clean
-      - uses: actions/cache@v4
-        with:
-          path: ~/.cache/ms-playwright
-          key: playwright-${{ runner.os }}-${{ hashFiles('node_modules/playwright-core/browsers.json') }}
-          restore-keys: playwright-${{ runner.os }}-
-      # the job runs as root in a container: storebound adds --no-sandbox to the Chromium it starts itself there
-      # (cli/shots/browser.ts sandboxArgs), Playwright's own launches already pass it
-      - name: Headless Chromium (browser tests, desktop boot check)
-        run: bunx playwright install --with-deps chromium
-      # the npm bundle runs on Node 20+: tools/ci.ts smoke-tests dist/storebound.mjs with the oldest supported Node
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-      # the runner sets CI=true in the job and it wins over the workflow env above: set CI=full for the command
-      # itself, or tools/ci.ts skips the desktop Rust tests and clippy when the push did not touch src-tauri
-      - name: bun run ci
-        run: CI=full bun run ci
+          cache-key: ci
+          rust-components: clippy
+      - uses: ./.forgejo/actions/ci-run