ci: sign Tauri migration payload with Tauri signer

.github/workflows/release.yml

@@ -104,6 +104,7 @@ jobs:
         run: npm pack
 
       - name: Upload npm tarball to release
+        if: ${{ github.event.inputs.dry_run != 'true' }}
         uses: softprops/action-gh-release@v2
         with:
           tag_name: v${{ needs.create-release.outputs.version }}
@@ -287,19 +288,22 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Setup bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
       - name: Download signed Electron app
         uses: actions/download-artifact@v4
         with:
           name: electron-app-${{ matrix.arch }}
           path: staged
 
-      - name: Install minisign
-        run: brew install minisign
-
       - name: Tar and sign Electron app as Tauri update payload
         env:
-          TAURI_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           VERSION: ${{ needs.create-release.outputs.version }}
         run: |
           set -euo pipefail
@@ -319,11 +323,10 @@ jobs:
           TARBALL="OpenChamber.app.tar.gz"
           tar -czf "$TARBALL" OpenChamber.app
 
-          printf '%s\n' "$TAURI_KEY" > ../tauri-signing.key
-          printf '%s\n' "$TAURI_KEY_PASSWORD" | minisign -S -s ../tauri-signing.key -m "$TARBALL" -W
+          bun run --cwd ../packages/desktop tauri signer sign "$PWD/$TARBALL"
 
           mv "$TARBALL" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz"
-          mv "${TARBALL}.minisig" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz.sig"
+          mv "${TARBALL}.sig" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz.sig"
 
       - name: Generate Tauri latest platform manifest
         env: