From e0cfeb5e71bbc789ff553154d01b3c79363dc8b8 Mon Sep 17 00:00:00 2001
From: Julian Cuni <julian.cuni@microservices.al>
Date: Wed, 24 Jun 2026 10:24:47 +0200
Subject: [PATCH] fix(ci): unsigned desktop build must disable updater
 artifacts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

createUpdaterArtifacts:true (for release.yml's .sig signing) makes `tauri build`
demand TAURI_SIGNING_PRIVATE_KEY and fail without it — even though the .deb/.AppImage
built fine. Override it off for the unsigned per-commit build via
--config '{"bundle":{"createUpdaterArtifacts":false}}'. release.yml keeps signing.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
---
 .gitea/workflows/build-desktop.yml    | 14 ++++++++++----
 wiki/decisions/desktop-shell-tauri.md |  7 +++++++
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/build-desktop.yml b/.gitea/workflows/build-desktop.yml
index 3146d7e..8c43638 100644
--- a/.gitea/workflows/build-desktop.yml
+++ b/.gitea/workflows/build-desktop.yml
@@ -68,10 +68,16 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Build desktop bundle (.deb + .AppImage)
-        # Unsigned — no TAURI_SIGNING_* needed here (this is a test artifact, not an
-        # updater release). --bundles restricts to the two installers we ship; tauri
-        # builds the web SPA first (beforeBuildCommand), so the desktop UI matches.
-        run: pnpm --filter @parking/desktop bundle --bundles deb,appimage
+        # Unsigned — no TAURI_SIGNING_* here (this is a test artifact, not an updater
+        # release). The config sets createUpdaterArtifacts:true (release.yml signs them),
+        # which makes tauri DEMAND the signing key and fail without it — so override it to
+        # false for this build via --config (a JSON patch merged over tauri.conf.json).
+        # --bundles restricts to the two installers we ship; tauri builds the web SPA
+        # first (beforeBuildCommand), so the desktop UI matches.
+        run: >
+          pnpm --filter @parking/desktop bundle
+          --bundles deb,appimage
+          --config '{"bundle":{"createUpdaterArtifacts":false}}'
 
       - name: Collect installers
         id: collect
diff --git a/wiki/decisions/desktop-shell-tauri.md b/wiki/decisions/desktop-shell-tauri.md
index cf5e02f..a3494d7 100644
--- a/wiki/decisions/desktop-shell-tauri.md
+++ b/wiki/decisions/desktop-shell-tauri.md
@@ -183,3 +183,10 @@ The desktop bundle now runs in CI under **two distinct workflows** — keep the
   testing of the native shell, and catches a broken Tauri/Rust build early. Same system-deps + cargo
   cache as `release.yml`. The container images (`build-images.yml`) and the desktop installers are
   deliberately separate pipelines — the desktop app is **not** containerized ([[container-deployment]]).
+  - **Gotcha (the unsigned build still demands the key).** `tauri.conf.json` sets
+    `bundle.createUpdaterArtifacts: true` (so `release.yml` produces the `.sig` updater signatures).
+    With that on, `tauri build` **fails** if `TAURI_SIGNING_PRIVATE_KEY` is absent — *"A public key
+    has been found, but no private key"* — even though the `.deb`/`.AppImage` themselves built fine.
+    The unsigned CI build therefore overrides it off with
+    `--config '{"bundle":{"createUpdaterArtifacts":false}}'` (a JSON patch merged over the config),
+    so no `.sig` is attempted and no key is required. `release.yml` keeps the config default (signs).