ci: sign Tauri migration payload with Tauri signer

.github/workflows/release.yml

@@ -104,6 +104,7 @@ jobs:
         run: npm pack
 
       - name: Upload npm tarball to release
+        if: ${{ github.event.inputs.dry_run != 'true' }}
         uses: softprops/action-gh-release@v2
         with:
           tag_name: v${{ needs.create-release.outputs.version }}
@@ -287,19 +288,22 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Setup bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
       - name: Download signed Electron app
         uses: actions/download-artifact@v4
         with:
           name: electron-app-${{ matrix.arch }}
           path: staged
 
-      - name: Install minisign
-        run: brew install minisign
-
       - name: Tar and sign Electron app as Tauri update payload
         env:
-          TAURI_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           VERSION: ${{ needs.create-release.outputs.version }}
         run: |
           set -euo pipefail
@@ -319,11 +323,10 @@ jobs:
           TARBALL="OpenChamber.app.tar.gz"
           tar -czf "$TARBALL" OpenChamber.app
 
-          printf '%s\n' "$TAURI_KEY" > ../tauri-signing.key
+          bun run --cwd ../packages/desktop tauri signer sign "$PWD/$TARBALL"
-          printf '%s\n' "$TAURI_KEY_PASSWORD" | minisign -S -s ../tauri-signing.key -m "$TARBALL" -W
 
           mv "$TARBALL" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz"
-          mv "${TARBALL}.minisig" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz.sig"
+          mv "${TARBALL}.sig" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz.sig"
 
       - name: Generate Tauri latest platform manifest
         env:

docs/TAURI_TO_ELECTRON_CUTOVER.md

@@ -20,7 +20,7 @@ and each has its own auto-update channel:
 
 | Shell    | Manifest          | Update format       | Secret used to sign |
 |----------|-------------------|---------------------|---------------------|
-| Tauri    | `latest.json`     | `.tar.gz` + `.sig`  | `TAURI_SIGNING_PRIVATE_KEY` (minisign) |
+| Tauri    | `latest.json`     | `.tar.gz` + `.sig`  | `TAURI_SIGNING_PRIVATE_KEY` (Tauri signer / minisign format) |
 | Electron | `latest-mac.yml`  | `.zip` + `blockmap` | Developer ID codesign (APPLE_* secrets) |
 
 Existing Tauri installs keep their own auto-update path (`latest.json`).
@@ -99,7 +99,7 @@ The transition works like this:
 2. It uploads the signed `OpenChamber.app` as a short-lived Actions artifact.
 3. `repackage-electron-as-tauri-update` downloads that Electron `.app`.
 4. It packs it into `OpenChamber-<version>-darwin-*.app.tar.gz`.
-5. It signs that tarball with the existing Tauri minisign private key.
+5. It signs that tarball with `tauri signer sign` and the existing Tauri signing key.
 6. It uploads the tarball and `.sig` to the GitHub release.
 7. It generates Tauri-compatible manifests and `combine-manifests` merges them into `latest.json`.
 
@@ -183,13 +183,10 @@ repackage-electron-as-tauri-update:
         name: electron-app-${{ matrix.arch }}
         path: staged
 
-    - name: Install minisign
-      run: brew install minisign
-
     - name: Tar and sign Electron .app as Tauri update payload
       env:
-        TAURI_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+        TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-        TAURI_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         VERSION: ${{ needs.create-release.outputs.version }}
       run: |
         set -euo pipefail
@@ -200,16 +197,13 @@ repackage-electron-as-tauri-update:
         TARBALL="OpenChamber.app.tar.gz"
         tar -czf "$TARBALL" OpenChamber.app
 
-        # minisign needs the private key written to a file and a non-interactive
+        # Use Tauri's signer instead of minisign directly. The CI secret is in
-        # password via -W (or env). The key in the secret is a minisign secret
+        # the format consumed by TAURI_SIGNING_PRIVATE_KEY.
-        # key block (base64-ish multi-line blob). Write to a file verbatim.
+        bun run --cwd ../packages/desktop tauri signer sign "$PWD/$TARBALL"
-        echo "$TAURI_KEY" > ../tauri-signing.key
-        echo "$TAURI_KEY_PASSWORD" | minisign -S -s ../tauri-signing.key \
-          -m "$TARBALL" -W
 
         # Rename per platform so the release has distinct names for arm64/x64.
         mv "$TARBALL" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz"
-        mv "${TARBALL}.minisig" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz.sig"
+        mv "${TARBALL}.sig" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz.sig"
 
     - name: Generate Tauri latest-<platform>.json
       env:
@@ -315,6 +309,11 @@ The manual arm64 macOS DMG workflow has already been changed to build Electron
 only, so there should be no GitHub Actions path that accidentally produces a new
 Tauri DMG.
 
+When rerunning the same release version with `workflow_dispatch`, use
+`dry_run=true` if npm and marketplace packages are already published. In that
+mode the workflow still rebuilds release assets, but skips publishing to npm and
+skips re-uploading the npm tarball asset.
+
 ## Validation before tagging the transition release
 
 You must manually validate with a real Tauri install. Do NOT skip this.