chore: bump version to 0.4.6

.github/actions/desktop-setup/action.yml

@@ -0,0 +1,75 @@
+name: Desktop build setup
+description: Restore target-specific toolchains and caches, and consume the shared web/catalog artifacts.
+
+inputs:
+  target:
+    description: Rust target triple; also separates cross-compiled Go and Rust caches.
+    required: true
+  source-sha:
+    description: Immutable source commit used to refresh the Go compilation cache.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Verify source commit
+      shell: bash
+      env:
+        SOURCE_SHA: ${{ inputs.source-sha }}
+      run: node apps/desktop/scripts/desktop-source.mjs
+    - uses: pnpm/action-setup@v5
+      with:
+        version: 10.17.0
+    - uses: actions/setup-node@v5
+      with:
+        node-version-file: .nvmrc
+        cache: pnpm
+    - uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: 1.99.1
+        targets: ${{ inputs.target }}
+    - uses: Swatinem/rust-cache@v2
+      with:
+        workspaces: apps/desktop/src-tauri
+        shared-key: desktop-release-${{ inputs.target }}
+    - uses: actions/setup-go@v6
+      id: go
+      with:
+        go-version-file: backend/go.mod
+        cache: false
+    - name: Locate Go caches
+      id: go-paths
+      shell: bash
+      run: |
+        echo "build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
+        echo "modules=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
+    # Both macOS targets run on arm64, so key compiled packages by target
+    # triple; the source SHA refreshes builds while retaining dependency caches.
+    - name: Cache Go sidecar build
+      uses: actions/cache@v5
+      with:
+        path: |
+          ${{ steps.go-paths.outputs.build }}
+          ${{ steps.go-paths.outputs.modules }}
+        key: desktop-go-${{ runner.os }}-${{ inputs.target }}-${{ steps.go.outputs.go-version }}-${{ hashFiles('backend/go.sum') }}-${{ inputs.source-sha }}
+        restore-keys: |
+          desktop-go-${{ runner.os }}-${{ inputs.target }}-${{ steps.go.outputs.go-version }}-${{ hashFiles('backend/go.sum') }}-
+          desktop-go-${{ runner.os }}-${{ inputs.target }}-${{ steps.go.outputs.go-version }}-
+    - name: Install desktop CLI
+      shell: bash
+      run: pnpm --filter @deeix/desktop install --frozen-lockfile
+    - name: Download frontend
+      uses: actions/download-artifact@v7
+      with:
+        name: desktop-web
+        path: apps/web/out
+    - name: Download catalog snapshots
+      uses: actions/download-artifact@v7
+      with:
+        name: desktop-catalog
+        path: backend/internal/infra/catalogdata/data
+    - name: Check C compiler and frontend
+      shell: bash
+      run: |
+        gcc --version
+        test -f apps/web/out/index.html

.github/workflows/ci.yml

@@ -20,7 +20,6 @@ concurrency:
 
 env:
   PNPM_VERSION: 10.17.0
-  NODE_VERSION: 24
   # Incremental artefacts are useless across CI runs and bloat the Rust cache.
   CARGO_INCREMENTAL: 0
 
@@ -36,9 +35,9 @@ jobs:
       docker: ${{ steps.filter.outputs.docker }}
       lockfiles: ${{ steps.filter.outputs.lockfiles }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - id: filter
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         with:
           filters: |
             shared: &shared
@@ -77,7 +76,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Check commit subjects
@@ -113,8 +112,8 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: backend/go.mod
           cache-dependency-path: backend/go.sum
@@ -140,15 +139,15 @@ jobs:
     if: needs.changes.outputs.web == 'true'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v5
         with:
           version: ${{ env.PNPM_VERSION }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: .nvmrc
           cache: pnpm
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: backend/go.mod
           cache-dependency-path: backend/go.sum
@@ -159,7 +158,7 @@ jobs:
       - name: Test
         run: pnpm turbo run test --filter=./packages/*
       - name: Cache Next.js build
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: apps/web/.next/cache
           # Source hash excludes installed and generated trees, which exist by the time this step runs.
@@ -178,7 +177,7 @@ jobs:
       run:
         working-directory: apps/desktop/src-tauri
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -213,11 +212,11 @@ jobs:
     if: needs.changes.outputs.python == 'true'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/ruff-action@v3
+      - uses: actions/checkout@v5
+      - uses: astral-sh/ruff-action@v4.1.0
         with:
           args: check deploy/services backend/tools
-      - uses: astral-sh/ruff-action@v3
+      - uses: astral-sh/ruff-action@v4.1.0
         with:
           args: format --check deploy/services backend/tools
 
@@ -227,13 +226,13 @@ jobs:
     if: needs.changes.outputs.docker == 'true'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
+      - uses: actions/checkout@v5
+      - uses: docker/setup-buildx-action@v4
       # Builds the default Dockerfile target, the path users take; release images use the prebuilt
       # web assets (see .github/workflows/image.yml). mode=min keeps this job from filling the
       # repository-wide cache quota with the multi-GB install and compile layers.
       - name: Build image (no push)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: false
@@ -246,13 +245,13 @@ jobs:
     if: needs.changes.outputs.lockfiles == 'true' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v5
         with:
           version: ${{ env.PNPM_VERSION }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: .nvmrc
           cache: pnpm
       - uses: dtolnay/rust-toolchain@stable
       - name: Install

.github/workflows/codeql.yml

@@ -35,7 +35,7 @@ jobs:
           build-mode: none
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4
       with:

.github/workflows/desktop-channel.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.event.release.tag_name != 'desktop-beta'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Refresh
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/desktop-linux.yml

@@ -0,0 +1,93 @@
+name: Desktop · Linux x64
+
+on:
+  workflow_call:
+    inputs:
+      source-sha:
+        required: true
+        type: string
+      channel:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    env:
+      CARGO_INCREMENTAL: 0
+      TARGET: x86_64-unknown-linux-gnu
+      CHANNEL: ${{ inputs.channel }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+      - uses: ./.github/actions/desktop-setup
+        with:
+          target: ${{ env.TARGET }}
+          source-sha: ${{ inputs.source-sha }}
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
+      - name: Build server sidecar
+        run: node apps/desktop/scripts/build-sidecar.mjs --target "$TARGET"
+      - name: Configure desktop build
+        run: |
+          node apps/desktop/scripts/release-config.mjs --channel "$CHANNEL" --repository "$GITHUB_REPOSITORY" \
+            --prebuilt-frontend --output "$RUNNER_TEMP/desktop-config.json"
+      - name: Compile desktop executable
+        run: |
+          pnpm --filter @deeix/desktop exec tauri build --no-bundle --target "$TARGET" \
+            --config "$RUNNER_TEMP/desktop-config.json" -- --locked --timings
+      - name: Exclude Wayland libraries from AppImage
+        run: bash apps/desktop/scripts/prepare-linuxdeploy-wrapper.sh
+      - name: Bundle deb and AppImage
+        env:
+          LINUXDEPLOY_DEBUG_LOG: ${{ runner.temp }}/linuxdeploy.log
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          pnpm --filter @deeix/desktop exec tauri bundle --target "$TARGET" --bundles deb,appimage \
+            --config "$RUNNER_TEMP/desktop-config.json"
+      - name: Show linuxdeploy log
+        if: always()
+        run: cat "$RUNNER_TEMP/linuxdeploy.log" 2>/dev/null || echo "(no linuxdeploy log)"
+      - name: Verify AppImage
+        run: |
+          shopt -s nullglob
+          images=(apps/desktop/src-tauri/target/"$TARGET"/release/bundle/appimage/*.AppImage)
+          ((${#images[@]} == 1)) || { echo "::error::expected one AppImage"; exit 1; }
+          workdir="$(mktemp -d)"
+          trap 'rm -rf "$workdir"' EXIT
+          (cd "$workdir" && "$GITHUB_WORKSPACE/${images[0]}" --appimage-extract >/dev/null 2>&1)
+          test -d "$workdir/squashfs-root/usr/lib"
+          if find "$workdir/squashfs-root/usr/lib" -name 'libwayland*' -print -quit | grep -q .; then
+            echo "::error::AppImage still bundles Wayland libraries"
+            exit 1
+          fi
+      - name: Stage release assets
+        run: |
+          node apps/desktop/scripts/collect-release-assets.mjs --platform linux-x64 \
+            --bundle "apps/desktop/src-tauri/target/$TARGET/release/bundle" --out "$RUNNER_TEMP/release-assets"
+      - uses: actions/upload-artifact@v6
+        with:
+          name: desktop-release-linux-x64
+          path: ${{ runner.temp }}/release-assets
+          compression-level: 0
+          if-no-files-found: error
+          overwrite: true
+      - name: Upload compilation timings
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: desktop-timings-linux-x64
+          path: apps/desktop/src-tauri/target/cargo-timings
+          overwrite: true
+          retention-days: 7