desktop dev update channel: every push to main builds dev bundles (<next patch>-dev.<UTC>), the VDS signs and publishes dev/latest.json (newest 5); app channel setting stable|dev, background updater at start / 15 min / resume / channel switch, deferred while in use, no downgrade, autostart rewritten on every start, card shows version and channel

.forgejo/workflows/ci.yml

@@ -223,6 +223,33 @@ jobs:
           name: storebound-desktop-linux
           path: out/
           retention-days: 7
+      # dev channel (tools/desktop-dev.ts): the same commit again with the version <next patch>-dev.<commit UTC>, only in
+      # this workspace (never committed); a failure here never touches the release candidate above
+      - name: Dev build (AppImage + deb, dev version)
+        id: dev
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        continue-on-error: true
+        env:
+          FORBIDDEN_TERMS: ${{ secrets.FORBIDDEN_TERMS }}
+        run: |
+          set -euo pipefail
+          V=$(bun tools/desktop-dev.ts set)
+          bun tools/build-sidecars.ts --target bun-linux-x64
+          patchelf --set-rpath '$ORIGIN/../lib' apps/desktop/src-tauri/binaries/storebound-x86_64-unknown-linux-gnu
+          B="$CARGO_TARGET_DIR/release/bundle"; rm -rf "$B"
+          (cd apps/desktop && bun ../../tools/desktop-release.ts exec -- bunx tauri build --bundles appimage,deb --ci)
+          mkdir -p dev && cp "$B/appimage/storebound_${V}_amd64.AppImage" "$B/deb/storebound_${V}_amd64.deb" dev/
+          chmod +x dev/*.AppImage
+          (cd /tmp && rm -rf squashfs-root && "$GITHUB_WORKSPACE/dev/storebound_${V}_amd64.AppImage" --appimage-extract >/dev/null && squashfs-root/usr/bin/storebound-desktop --self-test)
+          umask 077; printf '%s\n' "$FORBIDDEN_TERMS" > "$RUNNER_TEMP/terms.txt"
+          rc=0; STOREBOUND_FORBIDDEN_TERMS="$RUNNER_TEMP/terms.txt" bun tools/privacy-scan.ts dev/ || rc=$?
+          rm -f "$RUNNER_TEMP/terms.txt"; git checkout -- . ; exit $rc
+      - uses: actions/upload-artifact@v3
+        if: steps.dev.outcome == 'success'
+        with:
+          name: storebound-desktop-dev-linux
+          path: dev/
+          retention-days: 3
 
   windows:
     needs: gate
@@ -288,6 +315,78 @@ jobs:
           name: storebound-desktop-windows
           path: out/
           retention-days: 7
+      # dev channel (tools/desktop-dev.ts): see the linux job
+      - name: Dev build (NSIS, dev version)
+        id: dev
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        continue-on-error: true
+        shell: pwsh
+        env:
+          FORBIDDEN_TERMS: ${{ secrets.FORBIDDEN_TERMS }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $V = bun tools/desktop-dev.ts set
+          if ($LASTEXITCODE -ne 0) { throw "dev version stamp refused" }
+          bun tools/build-sidecars.ts --target bun-windows-x64
+          Remove-Item -Recurse -Force "$env:CARGO_TARGET_DIR\release\bundle\nsis" -ErrorAction SilentlyContinue
+          Push-Location apps/desktop
+          bun ../../tools/desktop-release.ts exec -- bunx tauri build --bundles nsis --ci
+          if ($LASTEXITCODE -ne 0) { throw "dev build failed" }
+          Pop-Location
+          New-Item -ItemType Directory -Force dev | Out-Null
+          Copy-Item "$env:CARGO_TARGET_DIR\release\bundle\nsis\storebound_${V}_x64-setup.exe" dev\
+          Start-Process -Wait -FilePath "dev\storebound_${V}_x64-setup.exe" -ArgumentList '/S'
+          & "$env:LOCALAPPDATA\storebound\storebound-desktop.exe" --self-test
+          if ($LASTEXITCODE -ne 0) { throw "dev self-test failed" }
+          Start-Process -Wait -FilePath "$env:LOCALAPPDATA\storebound\uninstall.exe" -ArgumentList '/S'
+          $t = Join-Path $env:RUNNER_TEMP "terms-$([guid]::NewGuid()).txt"
+          Set-Content -Path $t -Value $env:FORBIDDEN_TERMS -NoNewline:$false
+          $env:STOREBOUND_FORBIDDEN_TERMS = $t
+          bun tools/privacy-scan.ts dev
+          $rc = $LASTEXITCODE
+          Remove-Item -Force $t
+          git checkout -- .
+          if ($rc -ne 0) { throw "privacy scan failed" }
+      - uses: actions/upload-artifact@v3
+        if: steps.dev.outcome == 'success'
+        with:
+          name: storebound-desktop-dev-windows
+          path: dev/
+          retention-days: 3
+
+  # dev channel: the dev bundles of both jobs go to a Forgejo draft dev-<version> (no tag; the newest 5 kept); the VDS
+  # (tools/vds/storebound-desktop-dev, a root timer) signs them with the updater key and publishes
+  # storebound.dev/desktop/dev/latest.json. macOS has no dev build: Developer ID signing needs the Mac's GUI session.
+  dev:
+    needs: [linux, windows]
+    if: ${{ always() && github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.linux.result == 'success' && needs.windows.result == 'success' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 40
+    env:
+      FORGEJO_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+      FORGEJO_URL: ${{ github.server_url }}
+      FORGEJO_ORIGIN: ${{ secrets.FORGEJO_ORIGIN }}
+      SHA: ${{ github.sha }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Tools
+        run: |
+          curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}" >/dev/null
+          echo "$HOME/.bun/bin" >> "${FORGEJO_PATH:-$GITHUB_PATH}"
+      - uses: actions/download-artifact@v3
+        with:
+          name: storebound-desktop-dev-linux
+          path: dev
+      - uses: actions/download-artifact@v3
+        with:
+          name: storebound-desktop-dev-windows
+          path: dev
+      - name: Draft dev-<version> (newest 5 kept), then wait for the VDS to publish it
+        run: |
+          ls -la dev
+          bun tools/desktop-dev.ts record --dir dev --yes
+          V=$(ls dev | sed -n 's/^storebound_\(.*\)_x64-setup\.exe$/\1/p')
+          bun tools/desktop-dev.ts wait "$V" --minutes 20
 
   record:
     needs: [gate, linux, windows]