feat(desktop): add review platform panel with core service and Tauri API

.github/workflows/ci.yml

@@ -3,8 +3,14 @@ name: CI
 on:
   pull_request:
     branches: [main]
+    paths-ignore:
+      - '**/*.md'
+      - 'png/**'
   push:
     branches: [main]
+    paths-ignore:
+      - '**/*.md'
+      - 'png/**'
 
 # Cancel previous runs on same branch/PR
 concurrency:
@@ -66,20 +72,29 @@ jobs:
             pkg-config \
             libglib2.0-dev \
             libgtk-3-dev \
+            libxdo-dev \
             "$WEBKIT_PKG" \
             "$APPINDICATOR_PKG" \
             librsvg2-dev \
-            patchelf
+            patchelf \
+            libleptonica-dev \
+            libtesseract-dev \
+            tesseract-ocr \
+            tesseract-ocr-eng
 
       - uses: dtolnay/rust-toolchain@stable
 
       - uses: swatinem/rust-cache@v2
         with:
-          shared-key: "ci-check-${{ runner.os }}"
+          shared-key: "ci-check-v2-${{ runner.os }}-no-cargo-bin-v1"
+          cache-bin: false
 
       - name: Check compilation
         run: cargo check --workspace --exclude bitfun-cli
 
+      - name: Run core Rust tests
+        run: cargo test --locked -p bitfun-core
+
   # ── Frontend: build ────────────────────────────────────────────────
   frontend-build:
     name: Frontend Build
@@ -100,8 +115,8 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Type-check web UI
-        run: pnpm run type-check:web
+      - name: Lint web UI
+        run: pnpm run lint:web
 
       - name: Build web UI
         run: pnpm run build:web

.github/workflows/desktop-package.yml

@@ -1,7 +1,9 @@
 name: Desktop Package
 
 on:
-  # Triggered explicitly by release workflows to avoid duplicate packaging.
+  release:
+    types:
+      - published
   workflow_dispatch:
     inputs:
       tag_name:
@@ -17,6 +19,10 @@ on:
 permissions:
   contents: write
 
+concurrency:
+  group: desktop-package-${{ github.event.release.tag_name || inputs.tag_name || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   # ── Resolve version info ───────────────────────────────────────────
   prepare:
@@ -26,21 +32,31 @@ jobs:
       version: ${{ steps.meta.outputs.version }}
       release_tag: ${{ steps.meta.outputs.release_tag }}
       upload_to_release: ${{ steps.meta.outputs.upload_to_release }}
+      checkout_ref: ${{ steps.meta.outputs.checkout_ref }}
     steps:
       - uses: actions/checkout@v4
 
       - name: Resolve version metadata
         id: meta
         shell: bash
         env:
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          GITHUB_SHA: ${{ github.sha }}
+          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
           INPUT_TAG_NAME: ${{ inputs.tag_name }}
           INPUT_UPLOAD_TO_RELEASE: ${{ inputs.upload_to_release }}
         run: |
           set -euo pipefail
 
-          if [[ -n "${INPUT_TAG_NAME}" ]]; then
+          if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
+            TAG="${RELEASE_TAG_NAME}"
+            VERSION="${TAG#v}"
+            UPLOAD="true"
+            CHECKOUT_REF="${TAG}"
+          elif [[ -n "${INPUT_TAG_NAME}" ]]; then
             TAG="${INPUT_TAG_NAME}"
             VERSION="${TAG#v}"
+            CHECKOUT_REF="${TAG}"
             if [[ "${INPUT_UPLOAD_TO_RELEASE}" == "true" ]]; then
               UPLOAD="true"
             else
@@ -50,11 +66,13 @@ jobs:
             VERSION="$(jq -r '.version' package.json)"
             TAG="v${VERSION}"
             UPLOAD="false"
+            CHECKOUT_REF="${GITHUB_SHA}"
           fi
 
-          echo "version=$VERSION"       >> "$GITHUB_OUTPUT"
-          echo "release_tag=$TAG"        >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION"          >> "$GITHUB_OUTPUT"
+          echo "release_tag=$TAG"          >> "$GITHUB_OUTPUT"
           echo "upload_to_release=$UPLOAD" >> "$GITHUB_OUTPUT"
+          echo "checkout_ref=$CHECKOUT_REF" >> "$GITHUB_OUTPUT"
 
   # ── Build per platform ─────────────────────────────────────────────
   package:
@@ -63,11 +81,24 @@ jobs:
     needs: prepare
     env:
       NODE_OPTIONS: --max-old-space-size=6144
+      BITFUN_ENABLE_UPDATER_ARTIFACTS: ${{ needs.prepare.outputs.upload_to_release }}
+      TAURI_UPDATER_ENDPOINT: https://github.com/GCWing/BitFun/releases/latest/download/latest.json
+      TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
+      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
 
     strategy:
       fail-fast: false
       matrix:
         platform:
+          - os: ubuntu-latest
+            name: linux-x64
+            target: x86_64-unknown-linux-gnu
+            build_command: pnpm run desktop:build:linux -- --target x86_64-unknown-linux-gnu --bundles deb,rpm,appimage
+          - os: ubuntu-24.04-arm
+            name: linux-arm64
+            target: aarch64-unknown-linux-gnu
+            build_command: pnpm run desktop:build:linux -- --target aarch64-unknown-linux-gnu --bundles deb,rpm,appimage
           - os: macos-15
             name: macos-arm64
             target: aarch64-apple-darwin
@@ -79,19 +110,86 @@ jobs:
           - os: windows-latest
             name: windows-x64
             target: x86_64-pc-windows-msvc
-            build_command: pnpm run installer:build
+            build_command: |
+              $ErrorActionPreference = 'Stop'
+              pnpm run desktop:build:nsis --target x86_64-pc-windows-msvc --verbose
+              if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+              $desktopExe = "target/x86_64-pc-windows-msvc/release/bitfun-desktop.exe"
+              if (-not (Test-Path $desktopExe)) {
+                throw "Desktop executable was not found after NSIS build: $desktopExe"
+              }
+              pnpm run installer:build:only
+              if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: ${{ needs.prepare.outputs.release_tag }}
+          ref: ${{ needs.prepare.outputs.checkout_ref }}
 
       - name: Setup OpenSSL (Windows, prebuilt)
         if: runner.os == 'Windows'
         shell: pwsh
         run: ./scripts/ci/setup-openssl-windows.ps1
 
+      - name: Install NSIS (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          choco install nsis -y --no-progress
+          $nsisRoot = "${env:ProgramFiles(x86)}\NSIS"
+          $nsisBin = "${env:ProgramFiles(x86)}\NSIS\Bin"
+          if (Test-Path $nsisRoot) {
+            Add-Content $env:GITHUB_PATH $nsisRoot
+          }
+          if (Test-Path $nsisBin) {
+            Add-Content $env:GITHUB_PATH $nsisBin
+          }
+
+      - name: Verify NSIS (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          where.exe makensis
+          makensis /VERSION
+
+      - name: Install Linux system dependencies (Tauri bundler)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo apt-get update
+
+          if apt-cache show libwebkit2gtk-4.1-dev >/dev/null 2>&1; then
+            WEBKIT_PKG=libwebkit2gtk-4.1-dev
+          else
+            WEBKIT_PKG=libwebkit2gtk-4.0-dev
+          fi
+
+          if apt-cache show libappindicator3-dev >/dev/null 2>&1; then
+            APPINDICATOR_PKG=libappindicator3-dev
+          else
+            APPINDICATOR_PKG=libayatana-appindicator3-dev
+          fi
+
+          sudo apt-get install -y --no-install-recommends \
+            pkg-config \
+            xdg-utils \
+            libglib2.0-dev \
+            libgtk-3-dev \
+            libxdo-dev \
+            "$WEBKIT_PKG" \
+            "$APPINDICATOR_PKG" \
+            librsvg2-dev \
+            patchelf \
+            fakeroot \
+            rpm \
+            libleptonica-dev \
+            libtesseract-dev \
+            tesseract-ocr \
+            tesseract-ocr-eng
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
 
@@ -109,7 +207,8 @@ jobs:
       - name: Cache Rust build
         uses: swatinem/rust-cache@v2
         with:
-          shared-key: "package-${{ matrix.platform.name }}"
+          shared-key: "package-v2-${{ matrix.platform.name }}"
+          cache-bin: false
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -137,8 +236,13 @@ jobs:
     needs: [prepare, package]
     if: needs.prepare.outputs.upload_to_release == 'true'
     runs-on: ubuntu-latest
+    env:
+      REQUIRED_UPDATER_PLATFORMS: windows-x86_64,darwin-x86_64,darwin-aarch64,linux-x86_64,linux-aarch64
 
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Download bundled artifacts
         uses: actions/download-artifact@v4
         with:
@@ -151,11 +255,51 @@ jobs:
           echo "Release assets:"
           find release-assets -type f | sort
 
+      - name: Collect updater assets
+        run: |
+          node scripts/collect-tauri-updater-assets.mjs \
+            --assets-dir release-assets \
+            --version "${{ needs.prepare.outputs.version }}" \
+            --out-dir release-updater-assets \
+            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"
+
+      - name: Generate updater manifest
+        run: |
+          node scripts/generate-tauri-latest-json.mjs \
+            --assets-dir release-updater-assets \
+            --version "${{ needs.prepare.outputs.version }}" \
+            --tag "${{ needs.prepare.outputs.release_tag }}" \
+            --repo "GCWing/BitFun" \
+            --out release-updater-assets/latest.json \
+            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"
+
+      - name: Verify updater manifest
+        run: |
+          node scripts/verify-tauri-latest-json.mjs \
+            --manifest release-updater-assets/latest.json \
+            --version "${{ needs.prepare.outputs.version }}" \
+            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"
+
       - name: Upload to release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ needs.prepare.outputs.release_tag }}
           files: |
+            release-updater-assets/*
+            release-assets/**/*.AppImage
+            release-assets/**/*.deb
             release-assets/**/*.dmg
+            release-assets/**/*.rpm
             release-assets/**/*bitfun-installer.exe
           fail_on_unmatched_files: true
+
+      - name: Verify published updater manifest
+        run: |
+          curl -fsSL --retry 5 --retry-delay 3 \
+            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/latest.json" \
+            -o latest.published.json
+          node scripts/verify-tauri-latest-json.mjs \
+            --manifest latest.published.json \
+            --version "${{ needs.prepare.outputs.version }}" \
+            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}" \
+            --check-urls true

.github/workflows/nightly.yml

@@ -72,6 +72,14 @@ jobs:
       fail-fast: false
       matrix:
         platform:
+          - os: ubuntu-latest
+            name: linux-x64
+            target: x86_64-unknown-linux-gnu
+            build_command: pnpm run desktop:build:linux -- --target x86_64-unknown-linux-gnu --bundles deb,rpm,appimage
+          - os: ubuntu-24.04-arm
+            name: linux-arm64
+            target: aarch64-unknown-linux-gnu
+            build_command: pnpm run desktop:build:linux -- --target aarch64-unknown-linux-gnu --bundles deb,rpm,appimage
           - os: macos-15
             name: macos-arm64
             target: aarch64-apple-darwin
@@ -93,6 +101,41 @@ jobs:
         shell: pwsh
         run: ./scripts/ci/setup-openssl-windows.ps1
 
+      - name: Install Linux system dependencies (Tauri bundler)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo apt-get update
+
+          if apt-cache show libwebkit2gtk-4.1-dev >/dev/null 2>&1; then
+            WEBKIT_PKG=libwebkit2gtk-4.1-dev
+          else
+            WEBKIT_PKG=libwebkit2gtk-4.0-dev
+          fi
+
+          if apt-cache show libappindicator3-dev >/dev/null 2>&1; then
+            APPINDICATOR_PKG=libappindicator3-dev
+          else
+            APPINDICATOR_PKG=libayatana-appindicator3-dev
+          fi
+
+          sudo apt-get install -y --no-install-recommends \
+            pkg-config \
+            xdg-utils \
+            libglib2.0-dev \
+            libgtk-3-dev \
+            libxdo-dev \
+            "$WEBKIT_PKG" \
+            "$APPINDICATOR_PKG" \
+            librsvg2-dev \
+            patchelf \
+            fakeroot \
+            rpm \
+            libleptonica-dev \
+            libtesseract-dev \
+            tesseract-ocr \
+            tesseract-ocr-eng
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
 
@@ -110,7 +153,8 @@ jobs:
       - name: Cache Rust build
         uses: swatinem/rust-cache@v2
         with:
-          shared-key: "nightly-${{ matrix.platform.name }}"
+          shared-key: "nightly-v2-${{ matrix.platform.name }}"
+          cache-bin: false
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -202,5 +246,8 @@ jobs:
             > **Warning**: Nightly builds are untested and may be unstable.
           prerelease: true
           files: |
+            release-assets/**/*.AppImage
+            release-assets/**/*.deb
             release-assets/**/*.dmg
+            release-assets/**/*.rpm
             release-assets/**/*bitfun-installer.exe