Release v1.1.0 - Design, memory and native Mission scheduling

.gitattributes

@@ -0,0 +1,3 @@
+# Vendored-crate patches apply to the published LF crates; keep them byte-exact on every checkout.
+packages/tauri-app/vendor/patches/*.patch -text
+packages/tauri-app/tests/webkit-capabilities/*.sh text eol=lf

.github/FUNDING.yml

@@ -0,0 +1,2 @@
+github: [pascalandr]
+custom: ["https://neuralnomadsai.github.io/CodeNomad/en/sponsor.html"]

.github/actions/download-cache/action.yml

@@ -0,0 +1,54 @@
+name: Restore download cache
+description: >-
+  Restore one download cache written only by trusted dev runs, then check the
+  files that Cargo and the Tauri bundler would use unverified. Never saves; a
+  miss leaves every download to its tool.
+
+inputs:
+  kind:
+    description: electron, cargo, tauri or appimage-runtime
+    required: true
+  exact:
+    description: Restore only the exact key (seeding), without an older Cargo cache
+    required: false
+    default: "false"
+
+outputs:
+  key:
+    description: Cache key; empty when this kind has no cache on this runner
+    value: ${{ steps.spec.outputs.key }}
+  path:
+    description: Cached paths, one per line
+    value: ${{ steps.spec.outputs.path }}
+  cache-hit:
+    description: Whether the exact key was restored
+    value: ${{ steps.restore.outputs.cache-hit }}
+
+runs:
+  using: composite
+  steps:
+    # Without a key the cache is skipped and every tool downloads as usual.
+    - name: Resolve ${{ inputs.kind }} cache
+      id: spec
+      continue-on-error: true
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: node "$GITHUB_ACTION_PATH/../../scripts/download-cache.cjs" spec "${{ inputs.kind }}" >> "$GITHUB_OUTPUT"
+
+    - name: Restore ${{ inputs.kind }} cache
+      id: restore
+      if: ${{ steps.spec.outputs.key != '' }}
+      uses: actions/cache/restore@v6.1.0
+      with:
+        key: ${{ steps.spec.outputs.key }}
+        path: ${{ steps.spec.outputs.path }}
+        restore-keys: ${{ inputs.exact != 'true' && steps.spec.outputs.restore-keys || '' }}
+
+    - name: Check restored ${{ inputs.kind }} files
+      if: ${{ steps.restore.outputs.cache-matched-key != '' && inputs.kind != 'electron' }}
+      shell: bash
+      env:
+        CACHE_KEY: ${{ steps.spec.outputs.key }}
+        CACHE_PATH: ${{ steps.spec.outputs.path }}
+      run: node "$GITHUB_ACTION_PATH/../../scripts/download-cache.cjs" verify "${{ inputs.kind }}"

.github/actions/signpath-sign/action.yml

@@ -0,0 +1,63 @@
+name: SignPath sign
+description: >-
+  Upload one build output as a GitHub Actions artifact, submit it to the
+  CodeNomad SignPath project and download the signed files. SignPath verifies
+  that the artifact was produced by this repository's GitHub-hosted workflow.
+
+inputs:
+  api-token:
+    description: SignPath API token of the CI submitter (repository secret SIGNPATH_API_TOKEN)
+    required: true
+  signing-policy:
+    description: SignPath signing policy slug (test-signing or release-signing)
+    required: true
+  artifact-configuration:
+    description: SignPath artifact configuration slug (sources in .signpath/artifact-configurations)
+    required: true
+  artifact-name:
+    description: Name of the unsigned GitHub Actions artifact
+    required: true
+  path:
+    description: File or glob to submit; it becomes the root of the artifact ZIP
+    required: true
+  parameters:
+    description: 'SignPath user-defined parameters, one `name: "json string"` per line'
+    required: true
+  output-directory:
+    description: Directory that receives the signed files
+    required: true
+
+outputs:
+  signing-request-url:
+    description: SignPath signing request page
+    value: ${{ steps.sign.outputs.signing-request-web-url }}
+
+runs:
+  using: composite
+  steps:
+    - name: Upload unsigned artifact for SignPath
+      id: upload
+      uses: actions/upload-artifact@v7.0.2
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: ${{ inputs.path }}
+        overwrite: true
+        if-no-files-found: error
+        retention-days: 1
+
+    # release-signing waits for a manual approval in SignPath; test-signing
+    # completes without one.
+    - name: Submit SignPath signing request
+      id: sign
+      uses: signpath/github-action-submit-signing-request@v3.0
+      with:
+        api-token: ${{ inputs.api-token }}
+        organization-id: 586d8e7e-ab56-407a-9c5b-832a84bb0670
+        project-slug: CodeNomad
+        signing-policy-slug: ${{ inputs.signing-policy }}
+        artifact-configuration-slug: ${{ inputs.artifact-configuration }}
+        github-artifact-id: ${{ steps.upload.outputs.artifact-id }}
+        wait-for-completion: true
+        wait-for-completion-timeout-in-seconds: ${{ inputs.signing-policy == 'release-signing' && '7200' || '900' }}
+        output-artifact-directory: ${{ inputs.output-directory }}
+        parameters: ${{ inputs.parameters }}

.github/dependabot.yml

@@ -1,8 +1,114 @@
 version: 2
+# Routine version updates are off: every job sets open-pull-requests-limit 0.
+# Dependabot opens security updates only (GitHub's separate fixed limit). The
+# allow rules also filter security updates, so they stay broad; the
+# version-update groups apply again if a limit is raised.
 updates:
+  # All Cargo dependencies, including transitives, from the workspace lockfile.
+  # allow.update-types limits routine updates only; security fixes may cross majors.
+  # Group related Tauri security fixes; unmatched dependencies stay individual.
+  # Explicit security rules override repository/organization grouping here.
+  # Re-qualify local path patches before merging
+  # (packages/tauri-app/vendor/README.md; dev-docs/RUNTIME_MAINTENANCE.md).
+  # Use the default branch (dev) so security updates share this configuration.
+  - package-ecosystem: cargo
+    directory: /packages/tauri-app
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    allow:
+      - dependency-type: all
+        update-types:
+          - version-update:semver-minor
+          - version-update:semver-patch
+    groups:
+      tauri-security:
+        applies-to: security-updates
+        patterns:
+          - tauri
+          - tauri-*
+          - wry
+      tauri:
+        applies-to: version-updates
+        patterns:
+          - tauri
+          - tauri-*
+          - wry
+        update-types:
+          - minor
+          - patch
+
   - package-ecosystem: github-actions
     directory: /
     target-branch: dev
     schedule:
       interval: weekly
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 0
+
+  # Keep root workspaces and the separately deployed worker in independent jobs.
+  # Fastify security fixes share a family PR; unmatched dependencies stay individual.
+  # Routine majors require a maintainer decision, except supported Electron majors.
+  # The all-dependency rule preserves security coverage, including major fixes.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    allow:
+      - dependency-type: all
+        update-types:
+          - version-update:semver-minor
+          - version-update:semver-patch
+      - dependency-name: electron
+        update-types:
+          - version-update:semver-major
+    groups:
+      fastify-security:
+        applies-to: security-updates
+        patterns:
+          - fastify
+          - "@fastify/*"
+      electron-toolchain:
+        applies-to: version-updates
+        patterns:
+          - electron
+          - electron-builder
+          - electron-vite
+        update-types:
+          - minor
+          - patch
+      tauri-js:
+        applies-to: version-updates
+        patterns:
+          - "@tauri-apps/*"
+        update-types:
+          - minor
+          - patch
+      opencode-sdk:
+        applies-to: version-updates
+        patterns:
+          - "@opencode/client"
+          - "@opencode/schema"
+          - "@opencode/plugin"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: npm
+    directory: /packages/cloudflare
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    allow:
+      - dependency-type: all
+        update-types:
+          - version-update:semver-minor
+          - version-update:semver-patch
+    groups:
+      cloudflare-security:
+        applies-to: security-updates
+        patterns:
+          - wrangler
+          - miniflare
+          - workerd
+          - "@cloudflare/*"

.github/scripts/binary-build-order.test.cjs

@@ -32,7 +32,7 @@ test("PR builds and both release channels share the ordering without bypassing P
   assert.equal(workflow("release.yml").jobs.release.uses, "./.github/workflows/reusable-release.yml")
   assert.deepEqual(pr.needs, [
     "authorize", "tests", "tests-browser", "tests-tauri-windows", "tests-opencode-compatibility",
-    "tests-session-pruning-native", "tests-runtime-contracts", "tests-tauri-macos",
+    "tests-session-pruning-native", "tests-runtime-contracts", "tests-tauri-macos", "tests-tauri-webkit",
   ])
   assert.equal(pr.with.upload, false)
   assert.equal(pr.with.set_versions, false)

.github/scripts/dependabot-policy.test.cjs

@@ -0,0 +1,102 @@
+const assert = require("node:assert/strict")
+const fs = require("node:fs")
+const path = require("node:path")
+const test = require("node:test")
+const yaml = require("yaml")
+
+const source = fs.readFileSync(path.join(__dirname, "../dependabot.yml"), "utf8")
+const parse = (text) => yaml.parse(text, { strict: true, uniqueKeys: true })
+const minorPatch = ["version-update:semver-minor", "version-update:semver-patch"]
+const allDependencies = { "dependency-type": "all", "update-types": minorPatch }
+const electronMajor = { "dependency-name": "electron", "update-types": ["version-update:semver-major"] }
+const versionGroup = (patterns) => ({
+  "applies-to": "version-updates", patterns, "update-types": ["minor", "patch"],
+})
+
+// Assert the configuration contract, leaving update resolution to Dependabot.
+// Upstream Job#collect_permitted_update_types unions matching allow rules;
+// Job#ignored_versions_from_allowed_update_types bypasses security updates.
+// GroupUpdateAllVersions#perform runs individual updates after security groups;
+// DependencyGroupEngine keeps unmatched dependencies ungrouped.
+function assertPolicy(config) {
+  assert.equal(config.version, 2)
+  assert.deepEqual(config.updates.map((entry) => [entry["package-ecosystem"], entry.directory ?? entry.directories]), [
+    ["cargo", "/packages/tauri-app"], ["github-actions", "/"], ["npm", "/"], ["npm", "/packages/cloudflare"],
+  ])
+  for (const entry of config.updates) {
+    assert.equal(entry.schedule.interval, "weekly")
+    assert.equal(entry["open-pull-requests-limit"], 0, "routine version updates stay off; security updates are separate")
+    assert.equal(entry.ignore, undefined, "keep security fixes eligible at every version")
+    assert.equal(entry["exclude-paths"], undefined, "cover every workspace manifest")
+    assert.equal(entry.vendor, undefined, "local Cargo patches require manual re-qualification")
+  }
+  const [cargo, actions, npm, cloudflare] = config.updates
+  assert.equal(cargo["target-branch"], undefined, "share default-branch configuration with security updates")
+  assert.equal(npm["target-branch"], undefined, "share default-branch configuration with security updates")
+  assert.equal(cloudflare["target-branch"], undefined, "keep worker security updates on the default branch")
+  assert.equal(actions["target-branch"], "dev")
+  assert.deepEqual(cargo.allow, [allDependencies], "all crates, including transitives; routine minor/patch only")
+  assert.deepEqual(npm.allow, [allDependencies, electronMajor], "all npm names; only Electron adds routine majors")
+  assert.deepEqual(cloudflare.allow, [allDependencies], "worker updates keep independent all-package security coverage")
+  assert.deepEqual(cloudflare.groups, {
+    "cloudflare-security": { "applies-to": "security-updates", patterns: ["wrangler", "miniflare", "workerd", "@cloudflare/*"] },
+  }, "only the related worker toolchain shares a security group")
+  assert.equal(actions.allow, undefined)
+  assert.equal(actions.groups, undefined)
+  assert.deepEqual(Object.keys(cargo.groups), ["tauri-security", "tauri"],
+    "only related Tauri updates share a group")
+  assert.deepEqual(cargo.groups, {
+    "tauri-security": { "applies-to": "security-updates", patterns: ["tauri", "tauri-*", "wry"] },
+    tauri: versionGroup(["tauri", "tauri-*", "wry"]),
+  })
+  assert.deepEqual(Object.keys(npm.groups), ["fastify-security", "electron-toolchain", "tauri-js", "opencode-sdk"],
+    "only related families share a group; Electron majors stay individual")
+  assert.deepEqual(npm.groups, {
+    "fastify-security": { "applies-to": "security-updates", patterns: ["fastify", "@fastify/*"] },
+    "electron-toolchain": versionGroup(["electron", "electron-builder", "electron-vite"]),
+    "tauri-js": versionGroup(["@tauri-apps/*"]),
+    "opencode-sdk": versionGroup(["@opencode/client", "@opencode/schema", "@opencode/plugin"]),
+  })
+}
+
+test("Dependabot keeps broad security coverage and bounded routine updates", () => {
+  assertPolicy(parse(source))
+})
+
+test("policy check rejects security restrictions, broad majors and incorrect grouping", () => {
+  const mutations = [
+    ...[0, 1, 2, 3].map(index => (config) => { config.updates[index]["open-pull-requests-limit"] = 1 }),
+    (config) => { config.updates[0].allow[0]["dependency-name"] = "tauri*" },
+    (config) => { config.updates[0].allow[0]["dependency-type"] = "direct" },
+    (config) => { config.updates[0]["target-branch"] = "other-branch" },
+    (config) => { config.updates[2].allow[0]["update-types"].push("version-update:semver-major") },
+    (config) => { delete config.updates[2].allow[0]["update-types"] },
+    (config) => { config.updates[2].allow.pop() },
+    (config) => { config.updates[2].ignore = [{ "dependency-name": "*" }] },
+    (config) => { config.updates[0].groups.catchall = versionGroup(["*"]) },
+    (config) => { config.updates[0].groups["tauri-security"].patterns.push("*") },
+    (config) => { config.updates[2].groups["fastify-security"].patterns = ["*"] },
+    (config) => { config.updates[0].groups["tauri-security"]["update-types"] = ["minor", "patch"] },
+    (config) => { config.updates[2].groups["fastify-security"]["update-types"] = ["minor", "patch"] },
+    (config) => { delete config.updates[0].groups["tauri-security"] },
+    (config) => { delete config.updates[2].groups["fastify-security"] },
+    (config) => { config.updates.pop() },
+    (config) => { config.updates[2].directories = ["/", "/packages/cloudflare"]; delete config.updates[2].directory },
+    (config) => { config.updates[2].groups.catchall = versionGroup(["*"]) },
+    (config) => { config.updates[2].groups["opencode-sdk"]["update-types"].push("major") },
+    (config) => { config.updates[3].allow[0]["dependency-name"] = "wrangler" },
+    (config) => { config.updates[3].allow.push(electronMajor) },
+    (config) => { config.updates[3]["target-branch"] = "other-branch" },
+    (config) => { config.updates[3].groups = { catchall: versionGroup(["*"]) } },
+    (config) => { config.updates[0].groups = Object.fromEntries(Object.entries(config.updates[0].groups).reverse()) },
+  ]
+  for (const mutate of mutations) {
+    const config = parse(source)
+    mutate(config)
+    assert.throws(() => assertPolicy(config), assert.AssertionError)
+  }
+})
+
+test("policy YAML rejects duplicate keys", () => {
+  assert.throws(() => parse(`${source}\nversion: 2\n`), { code: "DUPLICATE_KEY" })
+})