Merge remote-tracking branch 'origin/main' into pr995-rebase

.github/workflows/release-menubar-windows.yml

@@ -0,0 +1,99 @@
+name: Release Windows Menubar
+
+# Triggers on a `windows-v*` tag push (e.g. `git tag windows-v0.9.20 && git push origin
+# windows-v0.9.20`), or manually via the Actions tab. Mirrors release-menubar.yml, which
+# does the same job for the macOS menubar under the `mac-v*` tags. The produced `.msi` is
+# unsigned; users see a SmartScreen prompt on first run until we add signing.
+on:
+  push:
+    tags:
+      - 'windows-v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version label for the bundle (e.g. v0.9.20 or dev-preview)'
+        required: true
+        default: 'dev-preview'
+
+permissions:
+  contents: write  # Needed to create the release + upload assets.
+
+jobs:
+  build:
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Resolve version label
+        id: version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/windows-v* ]]; then
+            echo "value=${GITHUB_REF#refs/tags/windows-}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=${{ github.event.inputs.version }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22.13.0
+          cache: npm
+          cache-dependency-path: windows/package-lock.json
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-pc-windows-msvc
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: windows/src-tauri
+
+      - name: Install dependencies
+        working-directory: windows
+        run: npm ci
+
+      - name: Build MSI bundle
+        working-directory: windows
+        run: npm run tauri build
+
+      - name: Collect artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p release-artifacts
+          find windows/src-tauri/target/release/bundle -type f -name '*.msi' \
+            -exec cp -v {} release-artifacts/ \;
+          (cd release-artifacts && for f in *.msi; do sha256sum "$f" > "$f.sha256"; done)
+          ls -la release-artifacts
+
+      - name: Upload artifact (for manual runs)
+        if: github.event_name == 'workflow_dispatch'
+        uses: actions/upload-artifact@v6
+        with:
+          name: CodeBurnMenubar-Windows-${{ steps.version.outputs.value }}
+          path: release-artifacts/*
+          if-no-files-found: error
+
+      - name: Create / update GitHub Release
+        if: startsWith(github.ref, 'refs/tags/windows-v')
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: Windows Menubar ${{ steps.version.outputs.value }}
+          body: |
+            Download the `.msi` below and run it. The tray app reads everything through the
+            CodeBurn CLI, so install that first:
+
+            ```
+            npm install -g codeburn
+            ```
+
+            Requires codeburn 0.9.9 or newer and the WebView2 Runtime (preinstalled on
+            Windows 11 and recent Windows 10 updates; installed on demand otherwise).
+
+            The bundle is unsigned, so Windows SmartScreen warns on first run: click
+            "More info", then "Run anyway". Signing is planned.
+          files: release-artifacts/*
+          fail_on_unmatched_files: true

.github/workflows/tests.yml

@@ -9,12 +9,18 @@ jobs:
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        # Package floor, and the newest 22.x so paths gated on later node:zlib
+        # features (zstd, 22.15+) get exercised.
+        node-version: [22.13.0, 22]
 
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v4
         with:
-          node-version: 22.13.0
+          node-version: ${{ matrix.node-version }}
           cache: npm
       - run: npm ci
       - name: Typecheck

.github/workflows/windows-menubar-ci.yml

@@ -0,0 +1,83 @@
+name: Windows Menubar CI
+
+# The Windows menubar (windows/) is a Tauri app: a React frontend plus a Rust binary whose
+# interesting code is `#[cfg(windows)]` and therefore only ever compiled on a Windows runner.
+# ubuntu-latest is in the matrix because the same crate has to stay clean on the ksni/Linux
+# paths and because contributors develop it on non-Windows machines.
+on:
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/windows-menubar-ci.yml
+      - windows/**
+  pull_request:
+    paths:
+      - .github/workflows/windows-menubar-ci.yml
+      - windows/**
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, ubuntu-latest]
+
+    steps:
+      - uses: actions/checkout@v6
+
+      # webkit2gtk + libayatana are what the Tauri and ksni crates link against; without
+      # them the Linux leg cannot even typecheck the Rust side.
+      - name: Install Linux system dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            libssl-dev \
+            libxdo-dev \
+            libgtk-3-dev \
+            build-essential
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22.13.0
+          cache: npm
+          cache-dependency-path: windows/package-lock.json
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: windows/src-tauri
+
+      - name: Install dependencies
+        working-directory: windows
+        run: npm ci
+
+      - name: Typecheck frontend
+        working-directory: windows
+        run: npx tsc --noEmit
+
+      - name: Clippy
+        working-directory: windows/src-tauri
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Rust tests
+        working-directory: windows/src-tauri
+        run: cargo test
+
+      # Release-profile compile of the real Windows binary. `--no-bundle` skips the WiX
+      # download and MSI packaging, which belong to the release workflow, not to every PR.
+      - name: Release build smoke
+        if: runner.os == 'Windows'
+        working-directory: windows
+        run: npm run tauri build -- --no-bundle