ci(release): publish Tauri updater latest.json on tag releases

[0xbrayo]

Summary

Adds support for publishing a Tauri updater latest.json manifest (and signed updater artifacts) on tag releases from the unified release.yml workflow.

• Pass TAURI_SIGNING_PRIVATE_KEY into the Tauri build so bundles emit .sig files when createUpdaterArtifacts is enabled in aw-tauri
• Collect per-platform updater artifacts as activitywatch-tauri-<version>-<platform>.<ext>[.sig]
• Generate latest.json via scripts/package/generate_latest_json.py during the draft release job
• Upload latest.json and updater assets alongside existing release files

Download URLs are built from ${{ github.repository }} / ${{ github.ref_name }}, so on upstream they point at:

https://github.com/ActivityWatch/activitywatch/releases/latest/download/latest.json

Prerequisites (org secrets / aw-tauri)

This CI path is ready, but end-to-end updates also need:

1. Repo secrets (ActivityWatch org): TAURI_SIGNING_PRIVATE_KEY (and optional TAURI_SIGNING_PRIVATE_KEY_PASSWORD)
2. aw-tauri config with createUpdaterArtifacts: true, the matching public key, and endpoint:
   https://github.com/ActivityWatch/activitywatch/releases/latest/download/latest.json

Without signing / updater artifacts, the generate step fails intentionally (no empty manifest).

Test plan

• Confirm workflow YAML parses (CI on this PR)
• On a test tag (or dry-run of the generate script with staged .sig files), verify latest.json platform keys and asset URLs
• After secrets + aw-tauri updater config land, cut a prerelease tag and confirm latest.json + .sig assets appear on the draft release

[greptile-apps]

Greptile Summary

Adds generation and publication of signed Tauri updater metadata during tag releases.

• Supplies Tauri updater-signing credentials to build jobs.
• Collects signed updater bundles under normalized per-platform names.
• Generates latest.json from collected signatures and publishes it with updater assets.

Confidence Score: 3/5

This PR should not merge until tag metadata is moved out of executable shell source; the checkout action should also be pinned for release-path hardening.

Any repository writer can push a matching tag, and the release job substitutes that tag directly into shell commands running in a contents-write workflow, making command execution reachable before draft release publication.

Files Needing Attention: .github/workflows/release.yml

Security Review

The changed release shell embeds a tag name directly into executable shell source, allowing a specially named v* tag pushed by a repository writer to run commands in a contents-write job. The newly added checkout also uses a mutable action tag in that privileged release path.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds updater signing, artifact collection, manifest generation, and release upload, but directly embeds tag-controlled text into a privileged shell step and adds a mutable checkout dependency.
scripts/package/generate_latest_json.py	Builds a Tauri updater manifest from staged signature files and rejects empty manifests; no independently publishable defect was established in the configured release path.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  T["Push v* tag"] --> B["Build Tauri matrix"]
  B --> S["Sign updater bundles"]
  S --> P["Normalize updater artifacts"]
  P --> D["Download build artifacts"]
  T --> M["Interpolate tag metadata"]
  M --> G["Generate latest.json"]
  D --> G
  G --> R["Create draft GitHub release"]

Loading

_{Reviews (1): Last reviewed commit: "ci(release): publish Tauri updater lates..." | Re-trigger Greptile}

[greptile-apps]

Tag name enables shell injection

When a repository writer pushes a v* tag containing shell syntax, github.ref_name is substituted directly into this script before shell parsing, causing embedded commands to execute in a release job with contents-write access. Pass the values through environment variables rather than embedding expressions in shell source.

How this was verified: The tag trigger accepts any v* name, the release condition only checks that prefix, and this step directly interpolates the resulting name into shell commands.

Knowledge Base Used: Packaging and release pipeline

[greptile-apps]

Checkout uses a mutable tag

The new checkout step executes a mutable v7 action reference in a contents-write release job. Pinning it to a reviewed commit SHA prevents a subsequently moved tag from changing executable release automation.

How this was verified: This action runs before release generation and inherits the workflow's contents-write permission.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[0xbrayo]

This is a prerequisite for ActivityWatch/aw-tauri#68.