V4

.github/workflows/_release-cli.yml

@@ -0,0 +1,99 @@
+name: "[reusable] CLI release"
+
+# Publishes @kyonru/feather to npm. Called by release-cli.yml, which fires on
+# both `cli-v*` (CLI alone) and `v*` (full platform release).
+
+on:
+  workflow_call:
+
+jobs:
+  npm-cli-release:
+    runs-on: ubuntu-latest
+    name: npm CLI publish
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install LÖVE
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y love xvfb
+
+      - name: Resolve version from tag
+        id: get_version
+        run: |
+          VERSION="$(bash scripts/release-tag-version.sh "$GITHUB_REF_NAME" --version)"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Verify CLI package version
+        run: |
+          CLI_VERSION="$(node -p "require('./apps/cli/package.json').version")"
+          if [ "$CLI_VERSION" != "${{ steps.get_version.outputs.version }}" ]; then
+            echo "Tag version ${{ steps.get_version.outputs.version }} does not match cli/package.json version $CLI_VERSION."
+            echo "Fix with: bash scripts/set-version.sh cli ${{ steps.get_version.outputs.version }}"
+            exit 1
+          fi
+
+      - name: Fail if CLI package version already exists
+        run: |
+          if npm view "@kyonru/feather@${{ steps.get_version.outputs.version }}" version --registry https://registry.npmjs.org >/dev/null 2>&1; then
+            echo "@kyonru/feather@${{ steps.get_version.outputs.version }} already exists on npm."
+            exit 1
+          fi
+
+      - name: Build CLI
+        run: pnpm run cli:build
+
+      - name: Run CLI e2e
+        run: pnpm run test:cli:e2e
+
+      - name: Run Lua e2e
+        run: pnpm run test:lua:e2e
+
+      - name: Verify npm package contents
+        run: pnpm --filter @kyonru/feather pack --dry-run
+
+      - name: Publish CLI to npm
+        run: pnpm --filter @kyonru/feather publish --access public --no-git-checks
+
+      # Standalone Bun binaries. These are the hermetic install path: no Node
+      # toolchain, one download, which is what a lean CI runner wants. They are
+      # attached to the CLI's own release so a `cli-v*` patch is pinnable on its
+      # own — publishing them only on platform tags would have made hermetic
+      # users wait for a full platform release to pin a CLI fix.
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Build standalone binaries
+        run: |
+          pnpm --filter @kyonru/feather run bundle:lua
+          pnpm --filter @kyonru/feather run build:binary
+          VERSION="${{ steps.get_version.outputs.version }}"
+          mkdir -p release-assets
+          cp apps/cli/bin/feather "release-assets/feather-cli-darwin-arm64-${VERSION}.bin"
+          cp apps/cli/bin/feather-darwin-x64 "release-assets/feather-cli-darwin-x64-${VERSION}.bin"
+          cp apps/cli/bin/feather-linux-x64 "release-assets/feather-cli-linux-x64-${VERSION}.bin"
+          cp apps/cli/bin/feather-win-x64.exe "release-assets/feather-cli-windows-x64-${VERSION}.exe"
+
+      - name: Attach binaries to the release
+        uses: ncipollo/release-action@v1
+        with:
+          artifacts: release-assets/*
+          allowUpdates: true
+          omitBodyDuringUpdate: true
+          omitNameDuringUpdate: true

.github/workflows/release.yml → .github/workflows/_release-desktop.yml

@@ -1,122 +1,50 @@
-name: Feather release
+name: "[reusable] Desktop release"
+
+# Builds and publishes the signed Tauri desktop app for macOS (arm64 + x64),
+# Linux, and Windows. Called by release-desktop.yml, which fires on both
+# `desktop-v*` (desktop alone) and `v*` (full platform release).
 
 on:
-  push:
-    tags:
-      - "*"
+  workflow_call:
 
 jobs:
-  npm-cli-release:
+  verify:
     runs-on: ubuntu-latest
-    name: npm CLI publish
-    permissions:
-      contents: read
-      id-token: write
+    name: Verify desktop version
+    outputs:
+      version: ${{ steps.get_version.outputs.version }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-          package-manager-cache: false
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Install LÖVE
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y love xvfb
+      - uses: actions/checkout@v4
 
-      - name: Get version from tag
+      - name: Resolve version from tag
         id: get_version
         run: |
-          VERSION="${GITHUB_REF_NAME#v}"
+          VERSION="$(bash scripts/release-tag-version.sh "$GITHUB_REF_NAME" --version)"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
-      - name: Verify CLI package version
-        run: |
-          CLI_VERSION="$(node -p "require('./cli/package.json').version")"
-          if [ "$CLI_VERSION" != "${{ steps.get_version.outputs.version }}" ]; then
-            echo "Tag version ${{ steps.get_version.outputs.version }} does not match cli/package.json version $CLI_VERSION."
-            exit 1
-          fi
-
-      - name: Fail if CLI package version already exists
+      - name: Verify the desktop trio agrees with the tag
         run: |
-          if npm view "@kyonru/feather@${{ steps.get_version.outputs.version }}" version --registry https://registry.npmjs.org >/dev/null 2>&1; then
-            echo "@kyonru/feather@${{ steps.get_version.outputs.version }} already exists on npm."
+          VERSION="${{ steps.get_version.outputs.version }}"
+          PKG="$(node -p "require('./package.json').version")"
+          TAURI="$(node -p "require('./apps/inspector/src-tauri/tauri.conf.json').version")"
+          CARGO="$(sed -n '1,/^version = /s/^version = "\(.*\)"/\1/p' apps/inspector/src-tauri/Cargo.toml | head -n 1)"
+          FAIL=0
+          for pair in "package.json:$PKG" "apps/inspector/src-tauri/tauri.conf.json:$TAURI" "apps/inspector/src-tauri/Cargo.toml:$CARGO"; do
+            FILE="${pair%%:*}"
+            FOUND="${pair#*:}"
+            if [ "$FOUND" != "$VERSION" ]; then
+              echo "$FILE is $FOUND, expected $VERSION"
+              FAIL=1
+            fi
+          done
+          if [ "$FAIL" = "1" ]; then
+            echo "Fix with: bash scripts/set-version.sh desktop $VERSION"
             exit 1
           fi
 
-      - name: Build CLI
-        run: npm run cli:build
-
-      - name: Run CLI e2e
-        run: npm run test:cli:e2e
-
-      - name: Run Lua e2e
-        run: npm run test:lua:e2e
-
-      - name: Verify npm package contents
-        run: npm pack --workspace=cli --dry-run
-
-      - name: Publish CLI to npm
-        run: npm publish --workspace=cli --access public
-
-  luarocks-release:
-    runs-on: ubuntu-latest
-    name: LuaRocks upload
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Fail if changelog entry does not exist
-        run: grep -q "${{ github.ref_name }}" CHANGELOG.md
-
-      - name: Get version from tag
-        id: get_version
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: LuaRocks Upload
-        uses: nvim-neorocks/luarocks-tag-release@v7
-        with:
-          license: Feather License
-          labels: |
-            love2d
-            löve
-            debug
-          copy_directories: |
-            src-lua/feather
-          summary: Debug & Inspect Tool for LÖVE (love2d)
-          detailed_description: |
-            Feather is a debugger tool with a plugin system for Love2D projects.
-          fail_on_duplicate: true
-        env:
-          LUAROCKS_API_KEY: ${{ secrets.LUAROCKS_API_KEY }}
-
-      - name: Zip feather folder
-        run: |
-          cd src-lua
-          zip -r ../feather-${{ steps.get_version.outputs.version }}.zip feather/
-
-      - name: GitHub Release
-        uses: ncipollo/release-action@v1
-        with:
-          artifacts: |
-            feather-${{ steps.get_version.outputs.version }}-1.rockspec
-            feather-${{ steps.get_version.outputs.version }}-1.src.rock
-            feather-${{ steps.get_version.outputs.version }}.zip
-          allowUpdates: true
-
   tauri-release:
+    name: Build desktop
+    needs: verify
     permissions:
       contents: write
     strategy:
@@ -136,6 +64,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -155,7 +85,7 @@ jobs:
           sudo apt-get install -y libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
 
       - name: Install frontend dependencies
-        run: npm install
+        run: pnpm install --frozen-lockfile
 
       - name: Import Apple Developer Certificate
         if: matrix.platform == 'macos-latest'
@@ -203,5 +133,6 @@ jobs:
           APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
           APPLE_API_KEY_PATH: ${{ env.APPLE_API_KEY_PATH }}
         with:
+          projectPath: apps/inspector
           tagName: ${{ github.ref_name }}
           args: ${{ matrix.args }}

.github/workflows/_release-runtime.yml

@@ -0,0 +1,119 @@
+name: "[reusable] Lua runtime release"
+
+# Publishes the Lua runtime to LuaRocks and attaches a zip to the GitHub release.
+# Called by release-runtime.yml, which fires on both `runtime-v*` (runtime alone)
+# and `v*` (full platform release).
+#
+# LuaRocks uploads are permanent and `fail_on_duplicate` is on, so a version
+# burned here cannot be reused. The guard job below skips publishing entirely
+# when packages/runtime-lua/feather is byte-identical to the previous runtime release, which
+# is what makes it safe for a platform tag to fire this workflow unconditionally.
+
+on:
+  workflow_call:
+    inputs:
+      force:
+        description: "Publish even when the runtime is unchanged"
+        type: boolean
+        default: false
+
+jobs:
+  guard:
+    runs-on: ubuntu-latest
+    name: Check whether the runtime actually changed
+    outputs:
+      should_publish: ${{ steps.check.outputs.should_publish }}
+      version: ${{ steps.get_version.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Resolve version from tag
+        id: get_version
+        run: |
+          VERSION="$(bash scripts/release-tag-version.sh "$GITHUB_REF_NAME" --version)"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Compare runtime against the previous runtime release
+        id: check
+        run: |
+          if [ "${{ inputs.force }}" = "true" ]; then
+            echo "Forced publish requested."
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          PREV="$(git tag --list 'runtime-v*' 'v*' --sort=-creatordate \
+            | grep -vxF "$GITHUB_REF_NAME" | head -n 1)"
+
+          if [ -z "$PREV" ]; then
+            echo "No previous runtime release found; publishing."
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if git diff --quiet "$PREV" HEAD -- packages/runtime-lua/feather; then
+            echo "packages/runtime-lua/feather is unchanged since $PREV — skipping LuaRocks publish."
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "packages/runtime-lua/feather changed since $PREV — publishing."
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  luarocks-release:
+    runs-on: ubuntu-latest
+    name: LuaRocks upload
+    needs: guard
+    if: needs.guard.outputs.should_publish == 'true'
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Fail if changelog entry does not exist
+        run: grep -q "${{ github.ref_name }}" CHANGELOG.md
+
+      - name: Verify runtime version
+        run: |
+          RUNTIME_VERSION="$(sed -n 's/^local FEATHER_VERSION_NAME = "\([^"]*\)".*/\1/p' packages/runtime-lua/feather/init.lua | head -n 1)"
+          if [ "$RUNTIME_VERSION" != "${{ needs.guard.outputs.version }}" ]; then
+            echo "Tag version ${{ needs.guard.outputs.version }} does not match packages/runtime-lua/feather/init.lua version $RUNTIME_VERSION."
+            echo "Fix with: bash scripts/set-version.sh runtime ${{ needs.guard.outputs.version }}"
+            exit 1
+          fi
+
+      - name: LuaRocks Upload
+        uses: nvim-neorocks/luarocks-tag-release@v7
+        with:
+          version: ${{ needs.guard.outputs.version }}
+          license: Feather License
+          labels: |
+            love2d
+            löve
+            debug
+          copy_directories: |
+            packages/runtime-lua/feather
+          summary: Debug & Inspect Tool for LÖVE (love2d)
+          detailed_description: |
+            Feather is a debugger tool with a plugin system for Love2D projects.
+          fail_on_duplicate: true
+        env:
+          LUAROCKS_API_KEY: ${{ secrets.LUAROCKS_API_KEY }}
+
+      - name: Zip feather folder
+        run: |
+          # Two levels up: the release step below looks for the zip at the repo root.
+          cd packages/runtime-lua
+          zip -r ../../feather-${{ needs.guard.outputs.version }}.zip feather/
+
+      - name: GitHub Release
+        uses: ncipollo/release-action@v1
+        with:
+          artifacts: |
+            feather-${{ needs.guard.outputs.version }}-1.rockspec
+            feather-${{ needs.guard.outputs.version }}-1.src.rock
+            feather-${{ needs.guard.outputs.version }}.zip
+          allowUpdates: true