Skip to content

feat(release): build Windows in the Release workflow, one update feed per platform - #54

Open
THPubs wants to merge 11 commits into
feat/windowsfrom
feat/windows-release
Open

THPubs wants to merge 11 commits into
feat/windowsfrom
feat/windows-release

Conversation

@THPubs

@THPubs THPubs commented Nov 2, 2026 •

Copy link
Copy Markdown
Member

What changed

Windows in the Release workflow

  • A Windows job builds the unsigned NSIS setup.exe with its update signature, into the same draft release as the Mac build.

One update feed file per platform (ADR 0056)

  • The app now reads feed-<channel>/{{target}}.json, which is darwin.json or windows.json, from a fixed feed release per channel. Stable gets a new feed-stable release.
  • A feed with no entry for this platform now counts as "no update", not an error (update_rt.rs).
  • A new job makes the draft first, then the Mac and Windows builds run side by side into it.
    • Each build checks its own feed file and uploads it last.
    • A failed build removes its own files from the draft.
  • Platform-only releases:
    • Betas and nightlies: publish for whichever platform finished, or run by hand with -f platforms=mac|windows.
    • Stable: Publish takes -f platforms=mac|windows, which first removes the other platform's files from the draft.
    • Both channels share one version sequence, so the other platform skips that number.
  • The Homebrew tap is bumped, and GitHub's "latest release" moved, only for releases that have a Mac build.
  • The Windows download link for the website is releases/download/feed-stable/Kriyon-setup.exe.
  • Old Mac installs (0.15.0 and earlier, which read latest.json):
    • Every Mac build still uploads latest.json, and only Mac builds become "latest", so releases/latest/download/latest.json keeps working.
    • Publish also copies it to feed-beta and feed-nightly.
    • Their first update moves them onto the new feeds.
  • docs/RELEASING.md, ADR 0055 and the new ADR 0056 are updated.

Why

So Windows ships from the same pipeline, and an urgent Mac-only or Windows-only fix can ship without the other platform. This is the same approach as electron-builder's per-platform files and the per-platform update endpoints of VS Code, Zed, Yaak and GitButler.

How I tested it

  • Unit tests:
    • Feed URLs per channel.
    • Platform-entry matching.
    • The "no entry for this platform" comparator.
    • Per-platform feed checks in scripts/publish.test.mjs.
  • pnpm check, actionlint, zizmor and shellcheck are clean.
  • I checked the Tauri updater 2.14.0 source ({{target}} substitution, the TargetNotFound path, the comparator running first) and tauri-action v1.0.0, against the real 0.15.0 latest.json.
  • Not run yet: the workflows only run from dev/main, so the first beta is the real test. It covers making the draft, the per-platform cleanup, publishing one platform, and creating feed-stable the first time.

Stacked on #48. After #48 is squash-merged, rebase onto dev and retarget.

Checklist

  • The PR targets dev. (It targets feat/windows until feat(windows): run Kriyon on Windows #48 merges.)
  • I wrote or updated tests, and pnpm check passes.
  • I read and tested every line, and I can explain it in review.
  • AI tools wrote most of this change.

🤖 Generated with Claude Code

THPubs and others added 4 commits November 2, 2026 08:15
A new build-windows job runs on a Windows runner after the Mac build has
made the draft release. It builds the NSIS setup.exe with the update
signature, uploads it into the same draft, and lets tauri-action merge the
windows-x86_64 entry into latest.json. The setup.exe is also uploaded as
Kriyon-setup.exe so the website can link to a fixed name.

The update feed check now requires the Windows entry as well as both Mac
entries, and it runs at the end of the Windows job, once the feed is
complete. Publishing waits for both builds.

Windows builds are not code-signed yet, so SmartScreen warns on install.
The signing service is still to be chosen.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Each channel's feed is now a file per platform on a fixed release:
feed-<channel>/darwin.json or windows.json, chosen by the updater's
{{target}} substitution. A release built for one platform can then move
only that platform's feed, so an urgent Mac-only or Windows-only fix never
waits for the other build.

A feed that is newer but has no entry for this platform now reads as no
update. The updater would otherwise fail the check with "target not
found" and show the person an error.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Mac and Windows builds now run side by side into one draft made by a
new draft job. Each checks its own feed file (darwin.json, windows.json)
and uploads it last, so its presence means that platform passed every
check. A build that fails removes its files from the draft
(scripts/drop-platform.sh), and betas and nightlies publish for whichever
platforms finished. A run by hand can build one platform, and Publish can
publish a stable draft for one platform only, so an urgent fix ships
without the other.

publish-release.sh moves each built platform's file on the channel's
fixed feed release, now including feed-stable, only forward. Builds up to
0.15.0 keep updating: the Mac latest.json is still uploaded, stable stays
GitHub's latest release only when it has a Mac build, and beta and
nightly copies go on their feed releases. A stable Windows build puts its
installer on feed-stable as Kriyon-setup.exe. The Homebrew tap moves only
for a Mac build.

ADR 0056 records the decision; docs/RELEASING.md explains the flows.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@THPubs THPubs changed the title feat(release): build the Windows installer in the Release workflow feat(release): build Windows in the Release workflow, one update feed per platform Nov 2, 2026
THPubs and others added 7 commits November 2, 2026 15:18
Each publish run now fills in any channel's missing darwin.json or
windows.json. A missing file is a 404, which the updater reports as a
failed check, for example when someone on a new beta switches to stable
before the first new stable ships. The Mac's file is made from that
channel's latest.json, so the first run puts 0.15.0 on feed-stable; the
Windows file gets the same version with no entries, which the app reads
as no update until a Windows build replaces it.

From the fourth stable release after 0.15.0, Publish also warns in its
run summary that latest.json can probably be dropped.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
The hero and install sections get a "Download for Windows" button with a
BETA tag. It links to feed-beta/Kriyon-setup.exe: publishing a Windows
build now puts its installer on each feed release it moves, not only on
feed-stable, so the beta installer has a fixed link too. Stable also lands
on feed-beta, so the link is the newest of beta and stable.

The platform facts, rating plate, contribute card and structured data now
say Windows is in beta instead of "help wanted".

Co-Authored-By: Claude Opus 5.5 <[email protected]>
- publish-release.sh checks the chosen platforms' feed files before it
  drops anything, so a wrong choice or a failed check no longer throws
  away the other platform's good build.
- It then drops every platform without a feed file, not only the one
  not chosen, so files from a build that timed out before it could
  clean up never ship.
- move_feed no longer runs inside $(...), where set -e is off: a failed
  upload or lookup now stops the run instead of reporting success or
  moving a feed backwards.
- drop-platform.sh treats only "release not found" as nothing to
  remove; any other gh error fails the step.
- The platform list and the Windows installer's name rule now live in
  publish-lib.mjs (publish.mjs platforms, windows-installer), and the
  scripts ask for them instead of repeating them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
…cancel

Both build jobs now set the version the prepare job worked out
(release.mjs set-version) instead of working it out again, so the rule
lives in one place. A cancelled build also removes its files from the
draft, and both jobs find the Windows installer with the shared rule.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Also update a website test comment that still called Kriyon Mac-only.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
… table

PLATFORMS and the rule for which release files a platform's build
uploads now come from the same table, so adding a platform to one
without the other is no longer possible: a new platform's half-made
files would otherwise never be dropped from a draft.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Build jobs set their version with release.mjs set-version now, so
beta and nightly only print it. ADR 0045 and 0046 say so.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@THPubs

THPubs commented Nov 2, 2026

Copy link
Copy Markdown
Member Author

Review and fix — pass 1

Reviewed the whole pull request, fixed 11 issues in 2 passes. Local checks green.

Notes

Fixed this pass

  • scripts/publish-release.sh:72 — Check the chosen platform's feed before dropping the other's files
  • scripts/publish-release.sh:167 — Don't run move_feed inside $(...), where set -e is off
  • .github/workflows/release.yml:394 — Also clean up a platform's files when its build times out or is cancelled
  • scripts/drop-platform.sh:21 — Treat only a missing release as nothing to remove
  • docs/adr/0056-one-update-feed-per-platform.md:20 — Drop the named products from the ADR's comparison
  • scripts/publish-release.sh:169 — Name the Windows installer in one place
  • scripts/publish-release.sh:193 — Keep the platform list in one place
  • .github/workflows/release.yml:444 — Have the build jobs write prepare's version, not work it out again
  • website/src/components/Hero.test.tsx:12 — Update the stale Mac-only comment
  • scripts/release.mjs:320 — Remove the dead --write path and its stale docs
  • scripts/publish-lib.mjs:28 — Derive asset ownership from the same platform list

Pull request checks

  • the pull request targets feat/windows; work goes into dev, and only dev goes into main

Checked by 3 finders (correctness, workflows, tests, contract, public text, step 5 re-check of the fixes) · architecture review · scorer: 28 scored, 11 kept.


Not ready to merge — 1 thing(s) still open. 1 pull request check(s) failing.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant