Add signed cross-platform updater lifecycle

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - switchify-signing

.github/workflows/ci.yml

@@ -13,19 +13,56 @@ jobs:
   frontend:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Reject retired product identity
         run: |
           retired_identity="pre""view"
           if git grep -n -i "$retired_identity" -- ':!src-tauri/Cargo.lock'; then
             exit 1
           fi
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 24
           cache: npm
           cache-dependency-path: package-lock.json
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: 1.97.1
       - run: npm ci
+      - name: Validate release updater configuration
+        shell: bash
+        run: |
+          set -euo pipefail
+          npx tauri signer generate --ci --password validation-only --write-keys "$RUNNER_TEMP/updater.key"
+          SWITCHIFY_UPDATER_PUBLIC_KEY="$(cat "$RUNNER_TEMP/updater.key.pub")" node scripts/render-updater-config.mjs "$RUNNER_TEMP/tauri.release.json"
+          node -e 'const c=require(process.argv[1]); if (!c.bundle.createUpdaterArtifacts || c.plugins.updater.endpoints.length !== 1 || !c.plugins.updater.pubkey) process.exit(1)' "$RUNNER_TEMP/tauri.release.json"
+          cargo build --locked --manifest-path tools/updater-signature-verifier/Cargo.toml
+          verifier="$GITHUB_WORKSPACE/tools/updater-signature-verifier/target/debug/switchify-updater-signature-verifier"
+          mkdir -p "$RUNNER_TEMP/artifacts/macos-release" "$RUNNER_TEMP/artifacts/windows-release"
+          mac_artifact="$RUNNER_TEMP/artifacts/macos-release/Switchify.PC.app.tar.gz"
+          windows_artifact="$RUNNER_TEMP/artifacts/windows-release/Switchify.PC_1.0.0_x64-setup.exe"
+          node -e 'require("fs").writeFileSync(process.argv[1], require("zlib").gzipSync("archive fixture"))' "$mac_artifact"
+          node -e 'const b=Buffer.alloc(128); b.write("MZ"); b.writeUInt32LE(64, 0x3c); b.write("PE\0\0", 64); require("fs").writeFileSync(process.argv[1], b)' "$windows_artifact"
+          npx tauri signer sign --private-key-path "$RUNNER_TEMP/updater.key" --password validation-only "$mac_artifact"
+          npx tauri signer sign --private-key-path "$RUNNER_TEMP/updater.key" --password validation-only "$windows_artifact"
+          export SWITCHIFY_UPDATER_PUBLIC_KEY="$(cat "$RUNNER_TEMP/updater.key.pub")"
+          node scripts/create-update-feed.mjs "$RUNNER_TEMP/artifacts" 1.0.0-beta.1 v1.0.0-beta.1 "$RUNNER_TEMP/latest.json" "$verifier"
+          node -e 'const f=require(process.argv[1]); if (!f.platforms["darwin-aarch64"].signature || !f.platforms["windows-x86_64"].signature) process.exit(1)' "$RUNNER_TEMP/latest.json"
+          if node scripts/create-update-feed.mjs "$RUNNER_TEMP/artifacts" 1.0.0-beta.1 v1.0.0-beta.2 "$RUNNER_TEMP/invalid.json" "$verifier"; then
+            echo 'Mismatched update tag was accepted.' >&2
+            exit 1
+          fi
+          printf 'not-a-tauri-signature' > "$mac_artifact.sig"
+          if node scripts/create-update-feed.mjs "$RUNNER_TEMP/artifacts" 1.0.0-beta.1 v1.0.0-beta.1 "$RUNNER_TEMP/invalid.json" "$verifier"; then
+            echo 'Invalid updater signature was accepted.' >&2
+            exit 1
+          fi
+          printf 'not an updater archive' > "$mac_artifact"
+          npx tauri signer sign --private-key-path "$RUNNER_TEMP/updater.key" --password validation-only "$mac_artifact"
+          if node scripts/create-update-feed.mjs "$RUNNER_TEMP/artifacts" 1.0.0-beta.1 v1.0.0-beta.1 "$RUNNER_TEMP/invalid.json" "$verifier"; then
+            echo 'Wrong-format updater payload was accepted.' >&2
+            exit 1
+          fi
       - run: npm run lint
       - run: npm test
       - run: npm run build
@@ -41,20 +78,23 @@ jobs:
             bundles: app,dmg
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 24
           cache: npm
           cache-dependency-path: package-lock.json
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: 1.97.1
           components: rustfmt, clippy
       - run: npm ci
       - run: cargo fmt --manifest-path src-tauri/Cargo.toml --check
       - run: cargo clippy --locked --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
       - run: cargo test --locked --manifest-path src-tauri/Cargo.toml
+      - run: cargo fmt --manifest-path tools/updater-signature-verifier/Cargo.toml --check
+      - run: cargo clippy --locked --manifest-path tools/updater-signature-verifier/Cargo.toml --all-targets -- -D warnings
+      - run: cargo test --locked --manifest-path tools/updater-signature-verifier/Cargo.toml
       - if: runner.os == 'Windows'
         run: cargo fmt --manifest-path src-tauri/startup-launcher/Cargo.toml --check
       - if: runner.os == 'Windows'