ci(desktop): full Win/macOS(arm+intel)/Linux matrix + release on tag

Extends the desktop build to all platforms (each freezes its own sidecar and
links its own WebView — neither cross-compiles) and adds a release job that
attaches every platform's installers to a GitHub Release on a `desktop-v*` tag.

The sidecar freeze runs under `shell: bash` (git-bash on Windows) with
PYTHON=python. macOS arm64/x86_64 are native builds on macos-14/macos-13.
Artifacts are unsigned for now (macOS notarization / Windows signing TBD); a
couple of first-party actions still need SHA-pinning (marked TODO). The Linux
path is verified locally (.deb/.rpm); Windows/macOS need a real runner.

Claude-Session: https://claude.ai/code/session_01KZyUSGAzVL9yxpsWWPv6Y2

Author: KylinMountain

.github/workflows/desktop.yml

@@ -1,11 +1,12 @@
 name: Desktop build
 
-# Builds the OpenKB desktop app (Tauri shell + frozen openkb-api sidecar).
+# Builds the OpenKB desktop app (Tauri shell + frozen openkb-api sidecar) for
+# every platform, and — on a `desktop-v*` tag — attaches the installers to a
+# GitHub Release.
 #
 # Neither half cross-compiles — PyInstaller freezes for the host OS/arch and
-# Tauri links the platform WebView — so each target is its own runner. This
-# workflow starts with Linux only; add the Windows / macOS(arm+intel) matrix
-# entries below once the Linux path is proven (see the commented block).
+# Tauri links the platform WebView — so each target is its own runner. macOS
+# arm64/x86_64 are separate runners (native builds; no --target needed).
 #
 # Ordering within a job matters: build the web UI FIRST (npm run build →
 # openkb/web), THEN freeze the sidecar (build_sidecar.sh bundles openkb/web),
@@ -32,21 +33,20 @@ jobs:
         include:
           - os: ubuntu-22.04
             target: linux
-          # Added once Linux is proven (each needs its own sidecar freeze):
-          # - os: windows-latest   # -> .msi / .exe (NSIS)
-          #   target: windows
-          # - os: macos-14         # -> .dmg (aarch64, Apple Silicon)
-          #   target: macos-arm64
-          # - os: macos-13         # -> .dmg (x86_64, Intel)
-          #   target: macos-intel
+          - os: windows-latest
+            target: windows
+          - os: macos-14 # Apple Silicon
+            target: macos-arm64
+          - os: macos-13 # Intel
+            target: macos-intel
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           persist-credentials: false
 
-      # Tauri's Linux WebView + bundler dependencies (webkit2gtk 4.1, appindicator,
-      # rsvg for icon rendering). No-op on non-Linux targets.
+      # Tauri's Linux WebView + bundler dependencies. Windows (WebView2) and
+      # macOS (WebKit) ship theirs with the OS, so this is Linux-only.
       - name: Install Linux WebView deps
         if: matrix.target == 'linux'
         run: |
@@ -55,17 +55,16 @@ jobs:
             libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev \
             build-essential curl wget file libxdo-dev libssl-dev
 
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3  # v5.2.0
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
         with:
           python-version: "3.12"
 
       # openkb.api (the sidecar) + PyInstaller. PyInstaller is a build tool, not
-      # a runtime dep, so it's installed ad-hoc here rather than pinned in
-      # pyproject.
+      # a runtime dep, so it's installed ad-hoc rather than pinned in pyproject.
       - name: Install openkb + build tools
         run: pip install -e ".[api]" pyinstaller
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
 
@@ -76,20 +75,23 @@ jobs:
           npm ci
           npm run build
 
+      # `shell: bash` so the same script runs on Windows (git-bash) too.
+      # PyInstaller emits openkb-api-sidecar(.exe) for the host OS/arch.
       - name: Freeze API sidecar
-        run: PYTHON="$(which python)" bash desktop/packaging/build_sidecar.sh
+        shell: bash
+        run: PYTHON=python bash desktop/packaging/build_sidecar.sh
 
-      # ubuntu runners ship a stable Rust toolchain, so no toolchain action is
-      # needed. tauri-cli is installed from crates.io (locked) rather than via a
-      # third-party action, to keep the supply chain explicit and pin-friendly.
+      # ubuntu/macos/windows runners ship a stable Rust toolchain. tauri-cli is
+      # installed from crates.io (locked) rather than via a third-party action,
+      # to keep the supply chain explicit.
       - name: Install tauri-cli
         run: cargo install tauri-cli --version "^2" --locked
 
       - name: Build Tauri bundle
         working-directory: desktop/src-tauri
         run: cargo tauri build
 
-      # TODO: pin to a SHA to match the repo's action-pinning policy.
+      # TODO: pin actions/upload-artifact to a SHA to match the repo policy.
       - name: Upload installers
         uses: actions/upload-artifact@v4
         with:
@@ -102,3 +104,28 @@ jobs:
             desktop/src-tauri/target/release/bundle/**/*.msi
             desktop/src-tauri/target/release/bundle/**/*.exe
           if-no-files-found: warn
+
+  # Attach every platform's installers to a GitHub Release, but only for a
+  # `desktop-v*` tag. Signing/notarization (macOS Gatekeeper, Windows
+  # SmartScreen) is not configured yet — these are unsigned artifacts.
+  release:
+    if: startsWith(github.ref, 'refs/tags/desktop-v')
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      # TODO: pin actions/download-artifact to a SHA to match the repo policy.
+      - name: Download all installers
+        uses: actions/download-artifact@v4
+        with:
+          path: installers
+          merge-multiple: true
+
+      - name: Create / update the release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
+          generate_release_notes: true
+          files: installers/**/*