From 217bd62bf7e06dad1ce913b5a7424f2935917a96 Mon Sep 17 00:00:00 2001
From: ApocDev <apocdev@gmail.com>
Date: Tue, 30 Jun 2026 15:21:03 -0400
Subject: [PATCH] ci: name updater artifacts uniquely and pick them explicitly

Two latest.json bugs: both macOS arches emit PyOps.app.tar.gz (no arch) so they
clobber each other on upload, and Linux signs both the AppImage and the deb, so
grabbing the first .sig could pick the wrong one. Add a per-platform `updater`
glob to select the right artifact (AppImage / app.tar.gz / setup.exe), and
arch-suffix the macOS .app.tar.gz (+ .sig) so the two don't collide.
---
 .github/workflows/release.yml | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 09ff9fe4..3fec0260 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,18 +42,25 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # `updater` is the glob for this platform's updater artifact — the one that
+          # goes in latest.json (deb/dmg are install-only and also produce .sig files,
+          # so pick explicitly rather than grab the first .sig).
           - platform: ubuntu-22.04    # Linux x64 (deb + AppImage)
             bundles: 'deb,appimage'
             target: linux-x86_64
+            updater: '*.AppImage'
           - platform: macos-14        # macOS Apple Silicon (app.tar.gz = updater artifact)
             bundles: 'app,dmg'
             target: darwin-aarch64
+            updater: '*.app.tar.gz'
           - platform: macos-13        # macOS Intel
             bundles: 'app,dmg'
             target: darwin-x86_64
+            updater: '*.app.tar.gz'
           - platform: windows-latest  # Windows x64
             bundles: 'nsis'
             target: windows-x86_64
+            updater: '*-setup.exe'
     runs-on: ${{ matrix.platform }}
     steps:
       # On a manual tag build, check out that tag's code so the bundle's version
@@ -114,6 +121,20 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: ./node_modules/.bin/tauri build --bundles ${{ matrix.bundles }}
 
+      # Both macOS arches emit `PyOps.app.tar.gz` (no arch in the name), so they'd
+      # clobber each other on upload. Arch-suffix it (and its .sig) so each is
+      # distinct. The .app.tar.gz is updater-only (users download the .dmg), so this
+      # rename is invisible to them.
+      - name: Disambiguate the macOS updater artifact
+        if: ${{ steps.tag.outputs.tag != '' && startsWith(matrix.target, 'darwin') }}
+        shell: bash
+        run: |
+          f=$(find app/src-tauri/target -path '*/release/bundle/*' -name '*.app.tar.gz' -type f | head -1)
+          if [ -z "$f" ]; then echo "::error::no .app.tar.gz produced"; exit 1; fi
+          base="${f%.app.tar.gz}"
+          mv "$f"     "${base}_${{ matrix.target }}.app.tar.gz"
+          mv "$f.sig" "${base}_${{ matrix.target }}.app.tar.gz.sig"
+
       # Attach the install bundles + updater artifacts (+ their .sig) to the release.
       # `while read` (not mapfile) so it works on the macOS runners' bash 3.2.
       - name: Upload bundles to the release
@@ -136,10 +157,12 @@ jobs:
         if: ${{ steps.tag.outputs.tag != '' }}
         shell: bash
         run: |
-          sig=$(find app/src-tauri/target -path '*/release/bundle/*' -name '*.sig' -type f | head -1)
-          if [ -z "$sig" ]; then echo "::error::no updater .sig found for ${{ matrix.target }}"; exit 1; fi
-          artifact=$(basename "${sig%.sig}")
-          url="https://github.com/${{ github.repository }}/releases/download/${{ steps.tag.outputs.tag }}/${artifact}"
+          art=$(find app/src-tauri/target -path '*/release/bundle/*' -name '${{ matrix.updater }}' -type f | head -1)
+          if [ -z "$art" ]; then echo "::error::no updater artifact (${{ matrix.updater }}) for ${{ matrix.target }}"; exit 1; fi
+          sig="${art}.sig"
+          if [ ! -f "$sig" ]; then echo "::error::no .sig beside $art"; exit 1; fi
+          name=$(basename "$art")
+          url="https://github.com/${{ github.repository }}/releases/download/${{ steps.tag.outputs.tag }}/${name}"
           jq -n --arg t "${{ matrix.target }}" --arg sig "$(cat "$sig")" --arg url "$url" \
             '{($t): {signature: $sig, url: $url}}' > "fragment-${{ matrix.target }}.json"
           cat "fragment-${{ matrix.target }}.json"