feat: add desktop auto-update polling, pill status button, manual check for updates, move updater to AppShell

.changeset/desktop-update-pill.md

@@ -0,0 +1,5 @@
+---
+default: minor
+---
+
+Desktop app now periodically checks for updates, shows an update pill in the titlebar when one is available, and lets you manually check for updates in Settings > About.

.github/actions/prepare-tofu/action.yml

@@ -2,10 +2,6 @@ name: Prepare OpenTofu Deployment
 description: Prepares OpenTofu in infra/web.
 
 inputs:
-  opentofu-version:
-    description: The OpenTofu version to install.
-    required: false
-    default: '1.11.5'
   is_release_tag:
     description: Whether the build is for a release tag. Passed through to VITE_IS_RELEASE_TAG.
     required: false
@@ -27,22 +23,20 @@ runs:
         SENTRY_ORG: ${{ env.SENTRY_ORG }}
         SENTRY_PROJECT: ${{ env.SENTRY_PROJECT }}
 
-    - name: Setup OpenTofu
-      uses: opentofu/setup-opentofu@9d84900f3238fab8cd84ce47d658d25dd008be2f # v1.0.8
-      with:
-        tofu_version: ${{ inputs.opentofu-version }}
+    - name: Setup OpenTofu via mise
+      uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
 
     - name: Check formatting
       shell: bash
       working-directory: ${{ github.workspace }}/infra/web
-      run: tofu fmt -check
+      run: mise run opentofu -- fmt -check
 
     - name: Initialize OpenTofu
       shell: bash
       working-directory: ${{ github.workspace }}/infra/web
-      run: tofu init -input=false -reconfigure
+      run: mise run opentofu -- init -input=false -reconfigure
 
     - name: Validate configuration
       shell: bash
       working-directory: ${{ github.workspace }}/infra/web
-      run: tofu validate -no-color
+      run: mise run opentofu -- validate -no-color

.github/actions/setup/action.yml

@@ -6,6 +6,10 @@ inputs:
     description: Command used to install dependencies.
     required: false
     default: pnpm install --frozen-lockfile
+  tauri:
+    description: Whether to install Tauri build dependencies via mise.
+    required: false
+    default: 'false'
   build:
     description: Whether to build the app after installing dependencies.
     required: false
@@ -18,14 +22,10 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Setup pnpm
-      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
-
-    - name: Setup node
-      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+    - name: Setup tools (mise)
+      uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
       with:
-        node-version-file: '.node-version'
-        cache: 'pnpm'
+        cache: true
 
     - name: Install dependencies
       shell: bash
@@ -34,6 +34,12 @@ runs:
       env:
         INPUTS_INSTALL_COMMAND: ${{ inputs.install-command }}
 
+    - name: Install Tauri build dependencies
+      if: ${{ inputs.tauri == 'true' }}
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      run: mise run tauri:setup
+
     - name: Build app
       if: ${{ inputs.build == 'true' }}
       shell: bash

.github/dependabot.yml

@@ -66,18 +66,6 @@ updates:
     commit-message:
       prefix: chore
     groups:
-      # tauri core + build + plugins are version-coupled; bump together so a
-      # core major bump lands with matching plugin updates in the same PR
-      # rather than as broken intermediate states.
-      tauri-family:
+      docker:
         patterns:
-          - tauri
-          - tauri-build
-          - tauri-plugin-*
-      cargo-major:
-        update-types:
-          - major
-      cargo-non-major:
-        update-types:
-          - minor
-          - patch
+          - '*'

.github/workflows/cloudflare-web-deploy.yml

@@ -55,8 +55,16 @@ jobs:
       - name: Resolve release version
         id: version
         shell: bash
+        env:
+          GIT_TAG: ${{ inputs.git_tag }}
+          REF_NAME: ${{ github.ref_name }}
+          EVENT_NAME: ${{ github.event_name }}
         run: |
-          TAG="${{ github.event_name == 'workflow_dispatch' && inputs.git_tag || github.ref_name }}"
+          if [[ "$EVENT_NAME" == "workflow_dispatch" && -n "$GIT_TAG" ]]; then
+            TAG="$GIT_TAG"
+          else
+            TAG="$REF_NAME"
+          fi
           echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
 
       - name: Prepare OpenTofu deployment
@@ -95,8 +103,16 @@ jobs:
       - name: Resolve release version
         id: version
         shell: bash
+        env:
+          GIT_TAG: ${{ inputs.git_tag }}
+          REF_NAME: ${{ github.ref_name }}
+          EVENT_NAME: ${{ github.event_name }}
         run: |
-          TAG="${{ github.event_name == 'workflow_dispatch' && inputs.git_tag || github.ref_name }}"
+          if [[ "$EVENT_NAME" == "workflow_dispatch" && -n "$GIT_TAG" ]]; then
+            TAG="$GIT_TAG"
+          else
+            TAG="$REF_NAME"
+          fi
           echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
 
       - name: Prepare OpenTofu deployment
@@ -112,7 +128,7 @@ jobs:
           SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
 
       - name: Plan infrastructure
-        run: tofu plan -input=false -no-color
+        run: mise run opentofu -- plan -input=false -no-color
 
       - name: Apply infrastructure
-        run: tofu apply -input=false -auto-approve
+        run: mise run opentofu -- apply -input=false -auto-approve

.github/workflows/cloudflare-web-dev.yml

@@ -62,7 +62,7 @@ jobs:
           SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
 
       - name: Plan infrastructure
-        run: tofu plan -input=false -no-color
+        run: mise run opentofu -- plan -input=false -no-color
 
       - name: Apply infrastructure
-        run: tofu apply -input=false -auto-approve
+        run: mise run opentofu -- apply -input=false -auto-approve

.github/workflows/codeql.yml

@@ -58,6 +58,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       # Add any setup steps before running the `github/codeql-action/init` action.
       # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/docker-publish.yml

@@ -49,8 +49,8 @@ jobs:
         id: release_tag
         shell: bash
         run: |
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${{ inputs.git_tag }}" ]]; then
-            TAG="${{ inputs.git_tag }}"
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${INPUTS_GIT_TAG}" ]]; then
+            TAG="${INPUTS_GIT_TAG}"
           else
             TAG="${GITHUB_REF#refs/tags/}"
           fi
@@ -65,6 +65,8 @@ jobs:
             echo "value=" >> "$GITHUB_OUTPUT"
             echo "is_release=false" >> "$GITHUB_OUTPUT"
           fi
+        env:
+          INPUTS_GIT_TAG: ${{ inputs.git_tag }}
 
       - name: Extract metadata
         id: meta

.github/workflows/flake-lock-fix.yml

@@ -42,17 +42,20 @@ jobs:
 
       - name: Get GitHub App User ID
         id: get-user-id
-        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
+        run: echo "user-id=$(gh api "/users/${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          STEPS_APP_TOKEN_OUTPUTS_APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
 
       - name: Configure bot git identity
         run: |
-          git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
-          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com'
+          git config --global user.name '${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]'
+          git config --global user.email '${STEPS_GET_USER_ID_OUTPUTS_USER_ID}+${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]@users.noreply.github.com'
           gh auth setup-git
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          STEPS_APP_TOKEN_OUTPUTS_APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+          STEPS_GET_USER_ID_OUTPUTS_USER_ID: ${{ steps.get-user-id.outputs.user-id }}
 
       - name: Commit and push if changed
         if: steps.check.outcome == 'failure'

.github/workflows/prepare-release.yml

@@ -20,6 +20,8 @@ jobs:
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -29,12 +31,8 @@ jobs:
 
       - uses: fregante/setup-git-user@024bc0b8e177d7e77203b48dab6fb45666854b35 # v2.0.2
 
-      - uses: knope-dev/action@19617851f9f13ab2f27a05989c55efb18aca3675 # v2.1.2
-        with:
-          version: 0.22.3
-
       - name: Prepare Release
-        run: knope prepare-release --verbose
+        run: mise run knope -- prepare-release --verbose
         env:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
 

.github/workflows/quality-checks.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Setup app
         uses: ./.github/actions/setup
 
-      - name: Run ESLint
+      - name: Run Lint
         run: pnpm run lint
 
   typecheck:

.github/workflows/release.yml

@@ -20,18 +20,15 @@ jobs:
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: true
           token: ${{ steps.generate-token.outputs.token }}
 
-      - uses: knope-dev/action@19617851f9f13ab2f27a05989c55efb18aca3675 # v2.1.2
-        with:
-          version: 0.22.3
-
       - name: Create Release
-        run: knope release --verbose
+        run: mise run knope -- release --verbose
         env:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}

.github/workflows/rust-quality.yml

@@ -20,17 +20,19 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    env:
+      CARGO_INCREMENTAL: 0
+      CARGO_TERM_COLOR: always
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # 2c7215f132e9ebf062739d9130488b56d53c060c
+      - name: Setup mise
+        uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          toolchain: stable
-          components: rustfmt
+          cache: true
 
       - name: Check Rust formatting
         run: cargo fmt --manifest-path src-tauri/Cargo.toml -- --check
@@ -40,6 +42,9 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       contents: read
+    env:
+      CARGO_INCREMENTAL: 0
+      CARGO_TERM_COLOR: always
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -60,11 +65,10 @@ jobs:
             libxdo-dev \
             pkg-config
 
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # 2c7215f132e9ebf062739d9130488b56d53c060c
+      - name: Setup mise
+        uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          toolchain: stable
-          components: clippy
+          cache: true
 
       - name: Cache Rust build
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1