- Set a real GitHub remote and choose the permanent application identifier before the first public release.
- Generate an updater signing key with
npm run tauri -- signer generate. Store the private key and password only in GitHub Actions secrets namedTAURI_SIGNING_PRIVATE_KEYandTAURI_SIGNING_PRIVATE_KEY_PASSWORD. - Add the updater plugin and its permissions, then configure
plugins.updater.pubkeywith the generated public key andplugins.updater.endpointswith the repository'slatest.jsonURL. Enablebundle.createUpdaterArtifactsonly after this configuration exists; Tauri deliberately rejects an incomplete updater configuration. - Confirm
package.json,src-tauri/Cargo.toml, andsrc-tauri/tauri.conf.jsonuse the same version. - Run the CI commands from the README and build both installers with
npm run tauri -- buildon a clean Windows runner. - Push
v<version>. The workflow creates a draft release. Install both artifacts on a clean Windows VM, exercise file paging/export, workspace recovery and a real mGBA connection, then publish the draft.
Authenticode signing is separate from Tauri updater signing. Configure a code-signing certificate in the Windows bundle settings or sign the produced installers in the release job before making them public.