ci: name updater artifacts uniquely and pick them explicitly (#46)

Two latest.json bugs: both macOS arches emit PyOps.app.tar.gz (no arch) so they
clobber each other on upload, and Linux signs both the AppImage and the deb, so
grabbing the first .sig could pick the wrong one. Add a per-platform `updater`
glob to select the right artifact (AppImage / app.tar.gz / setup.exe), and
arch-suffix the macOS .app.tar.gz (+ .sig) so the two don't collide.

Author: ApocDev

.github/workflows/release.yml

@@ -42,18 +42,25 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # `updater` is the glob for this platform's updater artifact — the one that
+          # goes in latest.json (deb/dmg are install-only and also produce .sig files,
+          # so pick explicitly rather than grab the first .sig).
           - platform: ubuntu-22.04    # Linux x64 (deb + AppImage)
             bundles: 'deb,appimage'
             target: linux-x86_64
+            updater: '*.AppImage'
           - platform: macos-14        # macOS Apple Silicon (app.tar.gz = updater artifact)
             bundles: 'app,dmg'
             target: darwin-aarch64
+            updater: '*.app.tar.gz'
           - platform: macos-13        # macOS Intel
             bundles: 'app,dmg'
             target: darwin-x86_64
+            updater: '*.app.tar.gz'
           - platform: windows-latest  # Windows x64
             bundles: 'nsis'
             target: windows-x86_64
+            updater: '*-setup.exe'
     runs-on: ${{ matrix.platform }}
     steps:
       # On a manual tag build, check out that tag's code so the bundle's version
@@ -114,6 +121,20 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: ./node_modules/.bin/tauri build --bundles ${{ matrix.bundles }}
 
+      # Both macOS arches emit `PyOps.app.tar.gz` (no arch in the name), so they'd
+      # clobber each other on upload. Arch-suffix it (and its .sig) so each is
+      # distinct. The .app.tar.gz is updater-only (users download the .dmg), so this
+      # rename is invisible to them.
+      - name: Disambiguate the macOS updater artifact
+        if: ${{ steps.tag.outputs.tag != '' && startsWith(matrix.target, 'darwin') }}
+        shell: bash
+        run: |
+          f=$(find app/src-tauri/target -path '*/release/bundle/*' -name '*.app.tar.gz' -type f | head -1)
+          if [ -z "$f" ]; then echo "::error::no .app.tar.gz produced"; exit 1; fi
+          base="${f%.app.tar.gz}"
+          mv "$f"     "${base}_${{ matrix.target }}.app.tar.gz"
+          mv "$f.sig" "${base}_${{ matrix.target }}.app.tar.gz.sig"
+
       # Attach the install bundles + updater artifacts (+ their .sig) to the release.
       # `while read` (not mapfile) so it works on the macOS runners' bash 3.2.
       - name: Upload bundles to the release
@@ -136,10 +157,12 @@ jobs:
         if: ${{ steps.tag.outputs.tag != '' }}
         shell: bash
         run: |
-          sig=$(find app/src-tauri/target -path '*/release/bundle/*' -name '*.sig' -type f | head -1)
-          if [ -z "$sig" ]; then echo "::error::no updater .sig found for ${{ matrix.target }}"; exit 1; fi
-          artifact=$(basename "${sig%.sig}")
-          url="https://github.com/${{ github.repository }}/releases/download/${{ steps.tag.outputs.tag }}/${artifact}"
+          art=$(find app/src-tauri/target -path '*/release/bundle/*' -name '${{ matrix.updater }}' -type f | head -1)
+          if [ -z "$art" ]; then echo "::error::no updater artifact (${{ matrix.updater }}) for ${{ matrix.target }}"; exit 1; fi
+          sig="${art}.sig"
+          if [ ! -f "$sig" ]; then echo "::error::no .sig beside $art"; exit 1; fi
+          name=$(basename "$art")
+          url="https://github.com/${{ github.repository }}/releases/download/${{ steps.tag.outputs.tag }}/${name}"
           jq -n --arg t "${{ matrix.target }}" --arg sig "$(cat "$sig")" --arg url "$url" \
             '{($t): {signature: $sig, url: $url}}' > "fragment-${{ matrix.target }}.json"
           cat "fragment-${{ matrix.target }}.json"