Initial commit of version 0.2.0

app/UPDATES.md

@@ -0,0 +1,82 @@
+# Installer and signed updates
+
+Decky is distributed on Windows as a per-user Tauri NSIS installer. Installed
+copies update from signed Forgejo release assets; they never run `git pull`.
+
+## Trust model
+
+Two signing systems are independent:
+
+- The Tauri updater signature is mandatory. It proves an update was made with
+  Decky's updater private key before the installer is executed.
+- Windows Authenticode signing is optional but recommended for wider
+  distribution because it reduces SmartScreen warnings. It requires a separate
+  code-signing certificate and is not configured yet.
+
+Decky's permanent updater key is stored outside the repository:
+
+```text
+%USERPROFILE%\.tauri\decky.key
+%USERPROFILE%\.tauri\decky.key.password
+```
+
+Back up both files securely. Never regenerate this key after shipping: existing
+installations would reject every artifact signed by a replacement key.
+
+## Forgejo layout
+
+The installed app checks this stable, public HTTPS URL:
+
+```text
+https://git.elijahkuntz.com/Elijah/Decky/raw/branch/main/releases/latest.json
+```
+
+`releases/latest.json` contains the newest semantic version, release notes,
+versioned installer URL, and the contents of its `.sig` file. Installer assets
+are attached to immutable Forgejo releases such as `v0.2.0`.
+
+The repository and release assets must be readable without authentication.
+Tauri cannot attach the user's Forgejo credentials to an updater request.
+
+## Preparing a release locally
+
+Keep all three version fields synchronized with `Set-Version.ps1`, commit the
+release, and tag that exact commit:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\scripts\Set-Version.ps1 -Version 0.2.1
+powershell -ExecutionPolicy Bypass -File .\scripts\Prepare-Release.ps1 -Version 0.2.1 -Notes "Release notes"
+git tag v0.2.1
+git push origin main v0.2.1
+```
+
+The preparation script runs dependency installation, validation, tests, the
+Tauri build, and creates:
+
+```text
+artifacts/release/v0.2.1/
+  Decky_0.2.1_x64-setup.exe
+  Decky_0.2.1_x64-setup.exe.sig
+  latest.json
+```
+
+To publish manually, set `FORGEJO_TOKEN` only in the current process and run:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\scripts\Publish-ForgejoRelease.ps1 -Version 0.2.1 -Notes "Release notes"
+```
+
+The publisher creates the Forgejo release, uploads all three assets, and updates
+the tracked `releases/latest.json` through the Forgejo API.
+
+## Forgejo Actions
+
+`.forgejo/workflows/release.yml` performs the same process when a `v*` tag is
+pushed. Configure a trusted Windows runner whose label matches
+`windows-latest`, then add these repository secrets:
+
+- `TAURI_SIGNING_PRIVATE_KEY`: contents of `decky.key`
+- `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`: contents of `decky.key.password`
+
+The short-lived `${{ forgejo.token }}` publishes only to this repository. The
+workflow intentionally runs only for trusted tags, never pull requests.