feat(update): self-update via suprim-server feed

.cargo/config.toml.example

@@ -0,0 +1,22 @@
+# SuprimSQL Cargo config — build-time env var overrides.
+#
+# Copy this file to `.cargo/config.toml` (gitignored) to apply these
+# values to every `cargo build` / `cargo run` in the workspace without
+# typing them every time. Prefer `.env` + `set -a; source .env; set +a`
+# if you hop between overrides a lot.
+#
+# See `.env.example` in the repo root for the full list + semantics of
+# each variable.
+
+[env]
+
+# Update feed endpoint. Leave commented out to use the production default
+# (https://api.suprim.dev/suprim/update/latest).
+#
+# SUPRIM_UPDATE_ENDPOINT = "https://staging.api.suprim.dev/suprim/update/latest"
+# SUPRIM_UPDATE_ENDPOINT = "http://localhost:8888/update/latest"
+
+# Apple Developer ID Team ID for self-update signature verification.
+# Leave commented out for unsigned dev builds.
+#
+# SUPRIM_TEAM_ID = "ABCDE12345"

.env.example

@@ -0,0 +1,33 @@
+# SuprimSQL build-time environment overrides.
+#
+# Copy this file to `.env` (gitignored) and tweak for your local setup, or
+# set the variables in your shell / CI pipeline before `cargo build`.
+#
+# These are read by `option_env!` at *compile time*, not runtime — bump any
+# value and you must rebuild for it to take effect. `cargo clean` first if
+# the value seems stuck.
+#
+# Load into your shell before building:
+#
+#   set -a && source .env && set +a
+#   cargo build --release
+
+# ─── Update feed ────────────────────────────────────────────────────────────
+# Endpoint the running app polls to discover new releases.
+#
+# Leave unset to use the production default
+# (https://api.suprim.dev/suprim/update/latest). Override for staging /
+# beta / local mock servers.
+#
+# SUPRIM_UPDATE_ENDPOINT=https://staging.api.suprim.dev/suprim/update/latest
+# SUPRIM_UPDATE_ENDPOINT=http://localhost:8888/update/latest
+
+# ─── Code-signature verification ────────────────────────────────────────────
+# Apple Developer ID Team ID (10 characters, upper-case letters + digits).
+# Baked into the binary; the self-updater rejects any DMG signed by a
+# different identity after install.
+#
+# Leave unset for dev builds / unsigned CI artifacts — the check is skipped
+# with a `tracing::warn` so the pipeline still exercises.
+#
+# SUPRIM_TEAM_ID=ABCDE12345

.github/workflows/ci.yml

@@ -21,6 +21,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  CARGO_BUILD_JOBS: 4
 
 jobs:
   check:
@@ -32,16 +33,18 @@ jobs:
       github.event_name == 'push' ||
       github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Checkout extensions submodule
         run: |
           git config --global url."https://x-access-token:${{ secrets.EXTENSIONS_TOKEN }}@github.com/".insteadOf "git@github.com:"
           git submodule update --init --recursive
 
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry

.gitignore

@@ -24,7 +24,7 @@ target
 # Added by cargo
 
 /target
-Cargo.lock
+# Cargo.lock is committed for reproducible builds (binary application)
 
 build_rs_cov.profraw
 
@@ -37,4 +37,11 @@ AGENTS.md
 release-manifest.json
 
 # Local test scripts & generated certs
-scripts/docker-ssl/
+scripts/docker-ssl/
+
+# Build-time env overrides (see .env.example / .cargo/config.toml.example)
+.env
+.env.local
+!.env.example
+.cargo/config.toml
+!.cargo/config.toml.example