feat(release): publish desktop updates from a tag through one feed

Desktop clients had two competing update sources: the runtime pointed at a
legacy GitLab registry while the Forgejo packages were filled in by
hardcoded, version-pinned scripts. Operators could not tell which feed was
authoritative, and no release could be reproduced from a tag.

Auto-update now reads a single canonical Forgejo registry feed, updated by
a version-agnostic publisher that runs from the tag on Forgejo, GitLab, and
GitHub CI alike. Channel, minimum supported version, forced install,
full-versus-delta thresholds, staged rollout, and a remote kill switch come
from one policy file the client fetches alongside the feed. Tag creation is
gated on a clean tree, matching version surfaces, and a changelog section.
This commit is contained in:
Yun Chan 2026-09-16 23:23:00 +09:00
parent 65ecc7aabc
commit 7953706142
21 changed files with 1619 additions and 90 deletions

View file

@ -22,8 +22,14 @@
"version:sync": "node scripts/ci/sync-version.mjs --write",
"release:metadata": "node scripts/ci/verify-release-metadata.mjs",
"release:metadata:test": "node scripts/ci/verify-release-metadata.mjs --self-test",
"release:forgejo": "node scripts/ci/publish-forgejo-release.mjs",
"release:forgejo:local": "node --env-file-if-exists=.env scripts/ci/publish-forgejo-release.mjs",
"release:forgejo:check": "node scripts/ci/publish-forgejo-release.mjs --check",
"release:tag": "node scripts/ci/create-release-tag.mjs",
"security:secrets": "node scripts/ci/check-no-hardcoded-secrets.mjs",
"security:secrets:test": "node scripts/ci/check-no-hardcoded-secrets.mjs --self-test",
"check:design": "node scripts/ci/check-design-tokens.mjs",
"check:design:test": "node scripts/ci/check-design-tokens.mjs --self-test",
"test:e2e:red": "node server/supabase/tests/content-report-red.e2e.mjs",
"release:mobile:boundary": "node scripts/ci/verify-mobile-release-boundary.mjs",
"release:mobile:boundary:test": "node scripts/ci/verify-mobile-release-boundary.mjs --self-test",
@ -35,7 +41,11 @@
"typecheck": "npm run typecheck --workspaces --if-present",
"test": "npm run test --workspaces --if-present",
"lint": "eslint apps/desktop apps/web apps/admin packages --ext .ts,.tsx --max-warnings=0",
"format": "prettier --write \"**/*.{ts,tsx,css}\""
"format": "prettier --write \"**/*.{ts,tsx,css}\"",
"typecheck:mobile": "npm --prefix apps/mobile-rn run typecheck",
"lint:mobile": "npm --prefix apps/mobile-rn run lint",
"test:mobile": "npm --prefix apps/mobile-rn test",
"verify:all": "npm run typecheck && npm run typecheck:mobile && npm run lint && npm run lint:mobile && npm run test && npm run test:mobile && npm run check:design"
},
"devDependencies": {
"@typescript-eslint/eslint-plugin": "^8.0.0",