moving

.github/workflows/tauri-build-pr.yml

@@ -0,0 +1,178 @@
+# Waggle — Tauri Build Verification (per-PR + main pushes)
+#
+# CC Sesija A §2.4 Task A13 (PM-reframed scope). Verifies the desktop app
+# builds cleanly on Win + macOS for every PR + main push, so a regression
+# can't sneak in unnoticed between releases. Distinct from release.yml
+# which only triggers on `v*` tags + uploads to GitHub Releases (this
+# workflow only uploads to the workflow run as artifacts for download
+# verification, no release publishing).
+#
+# Exit signal: green CI here means tag-push to release.yml is safe to
+# pull the trigger on. Red CI here = same investigation flow as release.yml
+# (Rust compile / Vite build / sidecar bundle / native dep failure).
+
+name: Tauri Build Verification
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'app/**'
+      - 'apps/web/**'
+      - 'packages/**'
+      - 'scripts/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - '.github/workflows/tauri-build-pr.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'app/**'
+      - 'apps/web/**'
+      - 'packages/**'
+      - 'scripts/**'
+      - 'package.json'
+      - 'package-lock.json'
+  workflow_dispatch:
+
+jobs:
+  verify-windows:
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: app/src-tauri
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build packages (shared → core → agent → server)
+        run: npm run build:packages
+
+      - name: Build sidecar
+        run: node scripts/build-sidecar.mjs
+
+      - name: Bundle native dependencies
+        run: node scripts/bundle-native-deps.mjs
+
+      - name: Bundle Node.js runtime
+        run: node scripts/bundle-node.mjs
+
+      - name: Stage sidecar dependencies
+        run: node scripts/stage-sidecar-deps.mjs
+
+      - name: Build frontend
+        run: cd apps/web && npx vite build
+
+      - name: Build Tauri (Windows)
+        # @tauri-apps/cli is declared in app/package.json devDeps but is absent
+        # from package-lock.json, so `npm install` never installs it and a bare
+        # `npx tauri` errors "could not determine executable to run". Fetch the
+        # CLI explicitly by package name (npx resolves the win32 binary).
+        run: cd app && npx --yes @tauri-apps/cli@2 build
+        env:
+          # Skip code signing for PR verification — release.yml handles signing
+          # only on tag push.
+          TAURI_PRIVATE_KEY: ''
+          TAURI_KEY_PASSWORD: ''
+
+      - name: Upload Windows artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: waggle-windows-${{ github.sha }}
+          path: |
+            app/src-tauri/target/release/bundle/nsis/*.exe
+            app/src-tauri/target/release/bundle/msi/*.msi
+          if-no-files-found: warn
+          retention-days: 7
+
+  verify-macos:
+    runs-on: macos-latest
+    timeout-minutes: 60
+    strategy:
+      # Per-arch, matching release.yml. Universal builds are rejected by the
+      # bundle scripts (sqlite-vec / onnxruntime / node ship per-arch binaries),
+      # so each arch is staged and built separately.
+      matrix:
+        target: [aarch64-apple-darwin, x86_64-apple-darwin]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: app/src-tauri
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build packages (shared → core → agent → server)
+        run: npm run build:packages
+
+      - name: Build sidecar
+        run: node scripts/build-sidecar.mjs
+
+      - name: Bundle native dependencies
+        run: node scripts/bundle-native-deps.mjs
+        env:
+          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}
+
+      - name: Bundle Node.js runtime
+        run: node scripts/bundle-node.mjs
+        env:
+          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}
+
+      - name: Stage sidecar dependencies
+        run: node scripts/stage-sidecar-deps.mjs
+        env:
+          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}
+
+      - name: Build frontend
+        run: cd apps/web && npx vite build
+
+      - name: Build Tauri (macOS ${{ matrix.target }})
+        # See verify-windows note: fetch @tauri-apps/cli by package name (absent
+        # from the lockfile). Built per-arch — universal is rejected by the
+        # bundle scripts (per-arch native modules), matching release.yml.
+        run: cd app && npx --yes @tauri-apps/cli@2 build --target ${{ matrix.target }}
+        env:
+          TAURI_PRIVATE_KEY: ''
+          TAURI_KEY_PASSWORD: ''
+
+      - name: Upload macOS artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: waggle-macos-${{ matrix.target }}-${{ github.sha }}
+          path: |
+            app/src-tauri/target/${{ matrix.target }}/release/bundle/dmg/*.dmg
+            app/src-tauri/target/${{ matrix.target }}/release/bundle/macos/*.app
+          if-no-files-found: warn
+          retention-days: 7