Add board and stack management for 0.3.0

app/UPDATES.md

@@ -38,45 +38,54 @@ are attached to immutable Forgejo releases such as `v0.2.0`.
 The repository and release assets must be readable without authentication.
 Tauri cannot attach the user's Forgejo credentials to an updater request.
 
-## Preparing a release locally
+## Hybrid Windows + Forgejo release flow
 
-Keep all three version fields synchronized with `Set-Version.ps1`, commit the
-release, and tag that exact commit:
+The Unraid Forgejo runner is a Linux container. It validates the Svelte and
+TypeScript client on every push, but it does not build the native Windows/MSVC
+installer. Build and sign Windows releases on this trusted Windows machine.
+
+Keep all three version fields synchronized, commit and push the source, then
+prepare the installer from that same commit:
 
 ```powershell
-powershell -ExecutionPolicy Bypass -File .\scripts\Set-Version.ps1 -Version 0.2.1
-powershell -ExecutionPolicy Bypass -File .\scripts\Prepare-Release.ps1 -Version 0.2.1 -Notes "Release notes"
-git tag v0.2.1
-git push origin main v0.2.1
+powershell -ExecutionPolicy Bypass -File .\scripts\Set-Version.ps1 -Version 0.3.0
+git add app/package.json app/package-lock.json app/src-tauri/Cargo.toml app/src-tauri/tauri.conf.json
+git commit -m "release: Decky 0.3.0"
+git push origin main
+powershell -ExecutionPolicy Bypass -File .\scripts\Prepare-Release.ps1 -Version 0.3.0 -Notes "Board and stack management"
 ```
 
 The preparation script runs dependency installation, validation, tests, the
 Tauri build, and creates:
 
 ```text
-artifacts/release/v0.2.1/
-  Decky_0.2.1_x64-setup.exe
-  Decky_0.2.1_x64-setup.exe.sig
+artifacts/release/v0.3.0/
+  Decky_0.3.0_x64-setup.exe
+  Decky_0.3.0_x64-setup.exe.sig
   latest.json
 ```
 
-To publish manually, set `FORGEJO_TOKEN` only in the current process and run:
+Installer files do not belong in Git. To publish them, set the same personal
+access token value used for the `FORGEJO_PAT` repository secret only in the
+current PowerShell process and run:
 
 ```powershell
-powershell -ExecutionPolicy Bypass -File .\scripts\Publish-ForgejoRelease.ps1 -Version 0.2.1 -Notes "Release notes"
+$env:FORGEJO_PAT = 'paste-token-for-this-session'
+powershell -ExecutionPolicy Bypass -File .\scripts\Publish-ForgejoRelease.ps1 -Version 0.3.0 -Notes "Board and stack management"
+Remove-Item Env:FORGEJO_PAT
+git pull --ff-only
 ```
 
-The publisher creates the Forgejo release, uploads all three assets, and updates
-the tracked `releases/latest.json` through the Forgejo API.
+The publisher creates the `v0.3.0` Forgejo release/tag at `main`, uploads the
+installer, signature, and metadata, then commits the tracked
+`releases/latest.json` through the Forgejo API. The final pull synchronizes that
+small metadata commit locally. Existing Decky installations then discover the
+release through Settings.
 
 ## Forgejo Actions
 
-`.forgejo/workflows/release.yml` performs the same process when a `v*` tag is
-pushed. Configure a trusted Windows runner whose label matches
-`windows-latest`, then add these repository secrets:
-
-- `TAURI_SIGNING_PRIVATE_KEY`: contents of `decky.key`
-- `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`: contents of `decky.key.password`
-
-The short-lived `${{ forgejo.token }}` publishes only to this repository. The
-workflow intentionally runs only for trusted tags, never pull requests.
+`.forgejo/workflows/validate.yml` uses the existing Docker runner to install
+locked dependencies, type-check, test, and build the web client. The repository
+secret is intentionally not exposed to validation jobs. If the runner uses a
+custom label instead of `docker`, update the workflow's `runs-on` value to the
+label shown on Forgejo's runner page.