snapshot of https://github.com/tauri-apps/plugins-workspace.git (v2, 2026-09-23; blobs > 131072B omitted)

.github/workflows/audit-javascript.yml

@@ -0,0 +1,49 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: Audit JavaScript
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * *'
+  push:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/audit-javascript.yml'
+      - '**/pnpm-lock.yaml'
+      - '**/package.json'
+  pull_request:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/audit-javascript.yml'
+      - '**/pnpm-lock.yaml'
+      - '**/package.json'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  checks: write
+
+jobs:
+  audit-js:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: true
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
+      - name: audit
+        run: pnpm audit

.github/workflows/audit-rust.yml

@@ -0,0 +1,45 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: Audit Rust
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * *'
+  push:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/audit-rust.yml'
+      - '**/Cargo.lock'
+      - '**/Cargo.toml'
+  pull_request:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/audit-rust.yml'
+      - '**/Cargo.lock'
+      - '**/Cargo.toml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  checks: write
+
+jobs:
+  audit-rust:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: rustsec/audit-check@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # https://github.com/tauri-apps/plugins-workspace/issues/774
+          ignore: ${{ github.event_name != 'schedule' && 'RUSTSEC-2023-0071' || '' }}

.github/workflows/check-change-files.yml

@@ -0,0 +1,47 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: check change files
+
+on:
+  pull_request:
+    paths:
+      - '.changes/*.md'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: check change files end with .md
+        run: |
+          for file in .changes/*
+          do
+            if [[ ! "$file" =~ \.(md|json)$ ]]; then
+              echo ".changes directory should only contain files that end with .md"
+              echo "found an invalid file in .changes directory:"
+              echo "$file"
+              exit 1
+            fi
+          done
+
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          list-files: shell
+          filters: |
+            changes:
+              - added|modified: '.changes/*.md'
+
+      - name: check
+        run: node ./.scripts/ci/check-change-files.js ${{ steps.filter.outputs.changes_files }}
+        if: ${{ steps.filter.outputs.changes == 'true' }}

.github/workflows/check-generated-files.yml

@@ -0,0 +1,175 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: check generated files
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/check-generated-files.yml'
+      - pnpm-lock.yaml
+      - '**/guest-js/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      packages: ${{ steps.filter.outputs.changes }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v2
+        id: filter
+        with:
+          filters: |
+            autostart:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/autostart/guest-js/**
+              - plugins/autostart/src/api-iife.js
+            cli:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/cli/guest-js/**
+              - plugins/cli/src/api-iife.js
+            clipboard-manager:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/clipboard-manager/guest-js/**
+              - plugins/clipboard-manager/src/api-iife.js
+            dialog:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/dialog/guest-js/**
+              - plugins/dialog/src/api-iife.js
+            fs:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/fs/guest-js/**
+              - plugins/fs/src/api-iife.js
+            geolocation:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/geolocation/guest-js/**
+              - plugins/geolocation/src/api-iife.js
+            global-shortcut:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/global-shortcut/guest-js/**
+              - plugins/global-shortcut/src/api-iife.js
+            opener:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/opener/guest-js/**
+              - plugins/opener/src/api-iife.js
+            haptics:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/haptics/guest-js/**
+              - plugins/haptics/src/api-iife.js
+            http:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/http/guest-js/**
+              - plugins/http/src/api-iife.js
+            log:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/log/guest-js/**
+              - plugins/log/src/api-iife.js
+            notification:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/notification/guest-js/**
+              - plugins/notification/src/api-iife.js
+            os:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/os/guest-js/**
+              - plugins/os/src/api-iife.js
+            positioner:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/positioner/guest-js/**
+              - plugins/positioner/src/api-iife.js
+            process:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/process/guest-js/**
+              - plugins/process/src/api-iife.js
+            shell:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/shell/guest-js/**
+              - plugins/shell/src/api-iife.js
+            sql:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/sql/guest-js/**
+              - plugins/sql/src/api-iife.js
+            store:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/store/guest-js/**
+              - plugins/store/src/api-iife.js
+            stronghold:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/stronghold/guest-js/**
+              - plugins/stronghold/src/api-iife.js
+            updater:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/updater/guest-js/**
+              - plugins/updater/src/api-iife.js
+            upload:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/upload/guest-js/**
+              - plugins/upload/src/api-iife.js
+            websocket:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/websocket/guest-js/**
+              - plugins/websocket/src/api-iife.js
+            window-state:
+              - .github/workflows/check-generated-files.yml
+              - pnpm-lock.yaml
+              - plugins/window-state/guest-js/**
+              - plugins/window-state/src/api-iife.js
+
+  test:
+    needs: changes
+    if: ${{ needs.changes.outputs.packages != '[]' && needs.changes.outputs.packages != '' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        package: ${{ fromJSON(needs.changes.outputs.packages) }}
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: true
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
+
+      - name: build api
+        working-directory: plugins/${{ matrix.package }}
+        run: pnpm install && pnpm build
+
+      - name: check diff
+        run: |
+          ./.scripts/ci/has-diff.sh

.github/workflows/check-license-header.yml

@@ -0,0 +1,31 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: check license header
+
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v2
+        id: filter
+        with:
+          list-files: shell
+          filters: |
+            added:
+              - added: '**'
+      - name: check header license on new files
+        if: ${{ steps.filter.outputs.added == 'true' }}
+        run: node .scripts/ci/check-license-header.js ${{ steps.filter.outputs.added_files }}

.github/workflows/covector-comment-on-fork.yml

@@ -0,0 +1,30 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: covector comment
+on:
+  workflow_run:
+    workflows: [covector status] # the `name` of the workflow run on `pull_request` running `status` with `comment: true`
+    types:
+      - completed
+
+# note all other permissions are set to none if not specified
+#  and these set the permissions for `secrets.GITHUB_TOKEN`
+permissions:
+  # to read the action artifacts on `covector status` workflows
+  actions: read
+  # to write the comment
+  pull-requests: write
+
+jobs:
+  download:
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.conclusion == 'success' &&
+      (github.event.workflow_run.head_repository.full_name != github.repository || github.actor == 'dependabot[bot]')
+    steps:
+      - name: covector status
+        uses: jbolda/covector/packages/action@covector-v0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          command: 'status'

.github/workflows/covector-status.yml

@@ -0,0 +1,25 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: covector status
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  covector:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0 # required for use of git history
+      - name: covector status
+        uses: jbolda/covector/packages/action@covector-v0
+        id: covector
+        with:
+          command: 'status'
+          token: ${{ secrets.GITHUB_TOKEN }}
+          comment: true

.github/workflows/covector-version-or-publish.yml

@@ -0,0 +1,84 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: version or publish
+
+on:
+  push:
+    branches:
+      - v1
+      - v2
+
+permissions:
+  # required for oidc token
+  id-token: write
+  # required to create the GitHub Release
+  contents: write
+  # required for creating the Version Packages Release
+  pull-requests: write
+
+jobs:
+  version-or-publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 65
+    outputs:
+      change: ${{ steps.covector.outputs.change }}
+      commandRan: ${{ steps.covector.outputs.commandRan }}
+      successfulPublish: ${{ steps.covector.outputs.successfulPublish }}
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0 # required for use of git history
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+          registry-url: 'https://registry.npmjs.org'
+
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: true
+
+      - name: cargo login
+        run: cargo login ${{ secrets.ORG_CRATES_IO_TOKEN }}
+
+      - name: git config
+        run: |
+          git config --global user.name "${{ github.event.pusher.name }}"
+          git config --global user.email "${{ github.event.pusher.email }}"
+
+      - name: Setup target dir on /mnt
+        # This directory has a larger partition size
+        run: |
+          sudo mkdir /mnt/target
+          WORKSPACE_OWNER="$(stat -c '%U:%G' "${GITHUB_WORKSPACE}")"
+          sudo chown -R "${WORKSPACE_OWNER}" /mnt/target
+
+      - name: covector version or publish (publish when no change files present)
+        uses: jbolda/covector/packages/action@covector-v0
+        id: covector
+        env:
+          CARGO_TARGET_DIR: /mnt/target
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          command: 'version-or-publish'
+          createRelease: true
+          recognizeContributors: true
+
+      - name: Sync Cargo.lock
+        if: steps.covector.outputs.commandRan == 'version'
+        run: cargo tree --depth 0
+
+      - name: Create Pull Request With Versions Bumped
+        id: cpr
+        uses: peter-evans/create-pull-request@v8.1.1
+        if: steps.covector.outputs.commandRan == 'version'
+        with:
+          title: 'Publish New Versions (${{ github.ref_name }})'
+          commit-message: 'publish new versions'
+          labels: 'version updates'
+          branch: 'ci/release-${{ github.ref_name }}'
+          body: ${{ steps.covector.outputs.change }}
+          sign-commits: true

.github/workflows/fmt.yml

@@ -0,0 +1,55 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: check formatting
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  rustfmt:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust stable and rustfmt
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+
+      - name: run cargo fmt
+        run: cargo fmt --all -- --check
+
+  prettier:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: true
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
+      - run: pnpm format:check
+
+  taplo:
+    name: taplo (.toml files)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: install taplo-cli
+        uses: taiki-e/install-action@v2
+        with:
+          tool: taplo-cli
+
+      - run: taplo fmt --check --diff

.github/workflows/integration-tests.yml

@@ -0,0 +1,70 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: integration tests
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/integration-tests.yml'
+      - 'plugins/updater/src/**'
+      - 'plugins/updater/tests/**'
+  pull_request:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/integration-tests.yml'
+      - 'plugins/updater/src/**'
+      - 'plugins/updater/tests/**'
+
+permissions:
+  contents: read
+
+env:
+  CARGO_PROFILE_DEV_DEBUG: 0 # no debuginfo: faster builds and a much smaller target dir to cache
+
+jobs:
+  run-integration-tests:
+    runs-on: ${{ matrix.platform }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ubuntu-22.04, macos-latest, windows-latest]
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: install stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: install Linux dependencies
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y webkit2gtk-4.0 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev libfuse2 rpm
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # Only `v2`/`v3` write to the cache: an entry saved from a pull request lives on its
+          # merge ref, where nothing else can restore it, and every write evicts an entry
+          # that other runs would have hit (10 GB repository limit, LRU eviction).
+          save-if: ${{ github.ref == 'refs/heads/v2' || github.ref == 'refs/heads/v3' }}
+
+      - name: install Tauri CLI
+        # `--debug --target-dir target`: a dev-profile build in the workspace target dir reuses
+        # the cached dependencies (shared with the test build below) instead of a from-scratch
+        # release build in a temporary dir. `--locked` keeps the dependency versions stable
+        # between runs, so the cached artifacts stay valid.
+        run: cargo install tauri-cli --git https://github.com/tauri-apps/tauri --branch dev --locked --debug --target-dir target
+
+      - name: run integration tests
+        run: cargo test --test '*' -- --ignored

.github/workflows/lint-javascript.yml

@@ -0,0 +1,59 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: Lint JavaScript
+
+on:
+  push:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/lint-javascript.yml'
+      - 'plugins/*/guest-js/**'
+      - 'packages/**'
+      - '.eslintignore'
+      - '.eslintrc.json'
+      - '.prettierignore'
+      - '**/package.json'
+  pull_request:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/lint-javascript.yml'
+      - 'plugins/*/guest-js/**'
+      - 'packages/**'
+      - '.eslintignore'
+      - '.eslintrc.json'
+      - '.prettierignore'
+      - '**/package.json'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  eslint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: true
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
+      # the type-checked lint rules (and packages/api-e2e) resolve the plugins'
+      # types from their dist-js build output
+      - name: build
+        run: pnpm build
+      - name: eslint
+        run: pnpm lint
+      - name: ts:check
+        run: pnpm ts:check

.github/workflows/lint-rust.yml

@@ -0,0 +1,183 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: Lint Rust
+
+on:
+  push:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/lint-rust.yml'
+      - 'plugins/*/src/**'
+      - '!plugins/*/src/api-iife.js'
+      - '**/Cargo.toml'
+  pull_request:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/lint-rust.yml'
+      - 'plugins/*/src/**'
+      - '!plugins/*/src/api-iife.js'
+      - '**/Cargo.toml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      packages: ${{ steps.filter.outputs.changes }}
+      saver: ${{ steps.saver.outputs.saver }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v2
+        id: filter
+        with:
+          filters: |
+            tauri-plugin-autostart:
+              - .github/workflows/lint-rust.yml
+              - plugins/autostart/**
+            tauri-plugin-cli:
+              - .github/workflows/lint-rust.yml
+              - plugins/cli/**
+            tauri-plugin-clipboard-manager:
+              - .github/workflows/lint-rust.yml
+              - plugins/clipboard-manager/**
+            tauri-plugin-deep-link:
+              - .github/workflows/lint-rust.yml
+              - plugins/deep-link/**
+            tauri-plugin-dialog:
+              - .github/workflows/lint-rust.yml
+              - plugins/dialog/**
+              - plugins/fs/**
+            tauri-plugin-fs:
+              - .github/workflows/lint-rust.yml
+              - plugins/fs/**
+            tauri-plugin-geolocation:
+              - .github/workflows/lint-rust.yml
+              - plugins/geolocation/**
+            tauri-plugin-global-shortcut:
+              - .github/workflows/lint-rust.yml
+              - plugins/global-shortcut/**
+            tauri-plugin-opener:
+              - .github/workflows/lint-rust.yml
+              - plugins/opener/**
+            tauri-plugin-haptics:
+              - .github/workflows/lint-rust.yml
+              - plugins/haptics/**
+            tauri-plugin-http:
+              - .github/workflows/lint-rust.yml
+              - plugins/http/**
+              - plugins/fs/**
+            tauri-plugin-localhost:
+              - .github/workflows/lint-rust.yml
+              - plugins/localhost/**
+            tauri-plugin-log:
+              - .github/workflows/lint-rust.yml
+              - plugins/log/**
+            tauri-plugin-notification:
+              - .github/workflows/lint-rust.yml
+              - plugins/notification/**
+            tauri-plugin-os:
+              - .github/workflows/lint-rust.yml
+              - plugins/os/**
+            tauri-plugin-persisted-scope:
+              - .github/workflows/lint-rust.yml
+              - plugins/persisted-scope/**
+              - plugins/fs/**
+            tauri-plugin-positioner:
+              - .github/workflows/lint-rust.yml
+              - plugins/positioner/**
+            tauri-plugin-process:
+              - .github/workflows/lint-rust.yml
+              - plugins/process/**
+            tauri-plugin-shell:
+              - .github/workflows/lint-rust.yml
+              - plugins/shell/**
+            tauri-plugin-single-instance:
+              - .github/workflows/lint-rust.yml
+              - plugins/single-instance/**
+            tauri-plugin-sql:
+              - .github/workflows/lint-rust.yml
+              - plugins/sql/**
+            tauri-plugin-store:
+              - .github/workflows/lint-rust.yml
+              - plugins/store/**
+            tauri-plugin-stronghold:
+              - .github/workflows/lint-rust.yml
+              - plugins/stronghold/**
+            tauri-plugin-updater:
+              - .github/workflows/lint-rust.yml
+              - plugins/updater/**
+            tauri-plugin-upload:
+              - .github/workflows/lint-rust.yml
+              - plugins/upload/**
+            tauri-plugin-websocket:
+              - .github/workflows/lint-rust.yml
+              - plugins/websocket/**
+            tauri-plugin-window-state:
+              - .github/workflows/lint-rust.yml
+              - plugins/window-state/**
+
+      # Every package job for a platform restores the same rust-cache entry, and exactly one
+      # of them saves it (see the `save-if` of the rust-cache step). Prefer the packages whose
+      # dependency tree covers most of the other plugins' dependencies, so the entry is as
+      # useful as possible for the packages that did not save it.
+      - name: pick the package that saves the cache
+        id: saver
+        env:
+          PACKAGES: ${{ steps.filter.outputs.changes }}
+        run: |
+          saver="$(jq -rn --argjson packages "${PACKAGES:-[]}" '
+            ["tauri-plugin-upload", "tauri-plugin-sql", "tauri-plugin-updater", "tauri-plugin-single-instance"]
+            | map(select(. as $p | $packages | index($p) != null))
+            | first // $packages[0] // empty
+          ')"
+          echo "saver=$saver" >> "$GITHUB_OUTPUT"
+
+  clippy:
+    needs: changes
+    if: ${{ needs.changes.outputs.packages != '[]' && needs.changes.outputs.packages != '' }}
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        package: ${{ fromJSON(needs.changes.outputs.packages) }}
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install webkit2gtk
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev
+
+      - name: Install clippy with stable toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # One entry shared by every package job (the default key is per job, not per
+          # matrix entry), only written from `v2`/`v3` and by a single package job; see
+          # test-rust.yml for the reasoning.
+          save-if: ${{ (github.ref == 'refs/heads/v2' || github.ref == 'refs/heads/v3') && matrix.package == needs.changes.outputs.saver }}
+
+      - name: clippy ${{ matrix.package }}
+        run: cargo clippy --package ${{ matrix.package }} --all-targets -- -D warnings
+
+      - name: clippy ${{ matrix.package }} --all-features
+        if: matrix.package != 'tauri-plugin-dialog'
+        run: cargo clippy --package ${{ matrix.package }} --all-targets --all-features -- -D warnings

.github/workflows/sync.yml

@@ -0,0 +1,46 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: Sync
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - v1
+      - v2
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync-to-mirrors:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Fetch git tags
+        run: git fetch origin 'refs/tags/*:refs/tags/*'
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: true
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
+
+      - name: Build packages
+        run: pnpm build
+
+      - name: Sync
+        run: .github/sync-to-mirrors.sh
+        env:
+          BUILD_BASE: ${{ github.workspace }}/plugins
+          API_TOKEN_GITHUB: ${{ secrets.ORG_TAURI_BOT_PAT }}

.github/workflows/test-android.yml

@@ -0,0 +1,78 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: test android
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-android.yml'
+      - '**/android/**'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ matrix.platform }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ubuntu-latest, macos-latest, windows-latest]
+
+    # No caches on purpose: this workflow only runs on pull requests, so anything it saved
+    # would live on the merge ref where no other run can restore it, while still counting
+    # against the repository's 10 GB cache limit and evicting entries that `v2`/`v3` saved.
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: dtolnay/rust-toolchain@1.77.2
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: true
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 21
+
+      - name: Setup NDK
+        uses: nttld/setup-ndk@v1
+        id: setup-ndk
+        with:
+          ndk-version: r25
+
+      # TODO check after https://github.com/nttld/setup-ndk/issues/518 is fixed
+      - name: Restore Android Symlinks
+        if: matrix.platform == 'ubuntu-latest' || matrix.platform == 'macos-latest'
+        env:
+          NDK_HOST: ${{ matrix.platform == 'ubuntu-latest' && 'linux-x86_64' || 'darwin-x86_64' }}
+        run: |
+          directory="${{ steps.setup-ndk.outputs.ndk-path }}/toolchains/llvm/prebuilt/$NDK_HOST/bin"
+          find "$directory" -type l | while read link; do
+              current_target=$(readlink "$link")
+              new_target="$directory/$(basename "$current_target")"
+              ln -sf "$new_target" "$link"
+              echo "Changed $(basename "$link") from $current_target to $new_target"
+          done
+
+      - name: build API
+        run: pnpm build
+
+      - name: build APK
+        working-directory: ./examples/api
+        run: pnpm tauri android build
+        env:
+          NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}

.github/workflows/test-api-e2e-mobile.yml

@@ -0,0 +1,235 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: test plugins e2e (mobile)
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - v2
+    paths:
+      - '.github/workflows/test-api-e2e-mobile.yml'
+      - 'packages/api-e2e/**'
+      - 'examples/api/**'
+      - 'plugins/*/guest-js/**'
+      - 'plugins/*/src/**'
+      - 'plugins/*/android/**'
+      - 'plugins/*/ios/**'
+      - 'plugins/*/permissions/**'
+      - 'plugins/*/build.rs'
+  pull_request:
+    branches:
+      - v2
+    paths:
+      - '.github/workflows/test-api-e2e-mobile.yml'
+      - 'packages/api-e2e/**'
+      - 'examples/api/**'
+      - 'plugins/*/guest-js/**'
+      - 'plugins/*/src/**'
+      - 'plugins/*/android/**'
+      - 'plugins/*/ios/**'
+      - 'plugins/*/permissions/**'
+      - 'plugins/*/build.rs'
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_PROFILE_DEV_DEBUG: 0 # keeps the target folder small for better cache efficiency
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  android:
+    runs-on: ubuntu-latest
+    env:
+      # The emulator runs the host architecture, so only that target is built.
+      E2E_ANDROID_TARGET: x86_64
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-linux-android
+
+      - name: setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 21
+
+      # Same rule as the rust-cache step below: every run restores the Gradle cache and only
+      # `v2`/`v3` save it. setup-java's own `cache: gradle` has no such switch, so the restore
+      # and save steps are spelled out here (same paths and key inputs as setup-java uses).
+      - name: restore gradle cache
+        id: gradle-cache
+        uses: actions/cache/restore@v6
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: gradle-${{ runner.os }}-
+
+      - name: Setup NDK
+        uses: nttld/setup-ndk@v1
+        id: setup-ndk
+        with:
+          ndk-version: r25
+          local-cache: true
+
+      # TODO check after https://github.com/nttld/setup-ndk/issues/518 is fixed
+      - name: Restore Android Symlinks
+        run: |
+          directory="${{ steps.setup-ndk.outputs.ndk-path }}/toolchains/llvm/prebuilt/linux-x86_64/bin"
+          find "$directory" -type l | while read link; do
+              current_target=$(readlink "$link")
+              new_target="$directory/$(basename "$current_target")"
+              ln -sf "$new_target" "$link"
+              echo "Changed $(basename "$link") from $current_target to $new_target"
+          done
+
+      # Hardware acceleration for the emulator.
+      - name: enable KVM
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: android
+          # Only `v2`/`v3` write to the cache: an entry saved from a pull request lives on its
+          # merge ref, where nothing else can restore it, and every write evicts an entry
+          # that other runs would have hit (10 GB repository limit, LRU eviction).
+          save-if: ${{ github.ref == 'refs/heads/v2' || github.ref == 'refs/heads/v3' }}
+
+      - name: install dependencies
+        run: pnpm i --frozen-lockfile
+
+      - name: build plugins
+        run: pnpm build
+
+      # Built before the emulator is up so it does not sit idle (and time out)
+      # during the Rust and Gradle builds; the suite then reuses the APK.
+      - name: build the APK
+        working-directory: ./examples/api
+        env:
+          NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
+          # a debug build without debug info, which would otherwise grow the APK
+          # past what the emulator can install (see androidBuildEnv in wdio.mobile.ts)
+          CARGO_PROFILE_DEV_DEBUG: '0'
+        run: pnpm tauri android build --debug --apk --target $E2E_ANDROID_TARGET
+
+      - name: save gradle cache
+        if: ${{ (github.ref == 'refs/heads/v2' || github.ref == 'refs/heads/v3') && steps.gradle-cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v6
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ steps.gradle-cache.outputs.cache-primary-key }}
+
+      - name: run e2e tests
+        uses: reactivecircus/android-emulator-runner@v2
+        timeout-minutes: 60
+        with:
+          api-level: 35
+          arch: x86_64
+          # google_apis images ship an up-to-date Android System WebView.
+          target: google_apis
+          profile: pixel_6
+          emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
+          disable-animations: true
+          script: E2E_SKIP_BUILD=1 E2E_SPEC_RETRIES=1 pnpm test:api-e2e:android
+
+      - name: upload appium logs
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: android-appium-logs
+          path: packages/api-e2e/logs
+          if-no-files-found: ignore
+
+  ios:
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-ios-sim
+
+      - name: setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ios
+          # Only `v2`/`v3` write to the cache: an entry saved from a pull request lives on its
+          # merge ref, where nothing else can restore it, and every write evicts an entry
+          # that other runs would have hit (10 GB repository limit, LRU eviction).
+          save-if: ${{ github.ref == 'refs/heads/v2' || github.ref == 'refs/heads/v3' }}
+
+      - name: install dependencies
+        run: pnpm i --frozen-lockfile
+
+      - name: build plugins
+        run: pnpm build
+
+      # Simulator build (`aarch64-sim` on the Apple Silicon runners), unsigned.
+      # Built ahead of the suite for symmetry with the Android job.
+      - name: build the simulator app
+        working-directory: ./examples/api
+        run: pnpm tauri ios build --debug --target aarch64-sim --no-sign
+
+      # wdio.ios.conf picks the iPhone simulator on the newest installed runtime
+      # (no device name is hardcoded) and Appium boots it; the XCUITest driver
+      # compiles WebDriverAgent on the first session.
+      - name: run e2e tests
+        timeout-minutes: 60
+        env:
+          E2E_SKIP_BUILD: '1'
+          E2E_SPEC_RETRIES: '1'
+        run: pnpm test:api-e2e:ios
+
+      - name: upload appium logs
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: ios-appium-logs
+          path: packages/api-e2e/logs
+          if-no-files-found: ignore
+
+      - name: collect app crash reports
+        if: failure()
+        run: .scripts/ci/collect-macos-crash-reports.sh "$RUNNER_TEMP/crash-reports"
+
+      - name: upload app crash reports
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: ios-crash-reports
+          path: ${{ runner.temp }}/crash-reports
+          if-no-files-found: ignore

.github/workflows/test-api-e2e.yml

@@ -0,0 +1,176 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: test plugins e2e
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - v2
+    paths:
+      - '.github/workflows/test-api-e2e.yml'
+      - 'packages/api-e2e/**'
+      - 'examples/api/**'
+      - 'plugins/*/guest-js/**'
+      - 'plugins/*/src/**'
+      - 'plugins/*/permissions/**'
+      - 'plugins/*/build.rs'
+  pull_request:
+    branches:
+      - v2
+    paths:
+      - '.github/workflows/test-api-e2e.yml'
+      - 'packages/api-e2e/**'
+      - 'examples/api/**'
+      - 'plugins/*/guest-js/**'
+      - 'plugins/*/src/**'
+      - 'plugins/*/permissions/**'
+      - 'plugins/*/build.rs'
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_PROFILE_DEV_DEBUG: 0 # keeps the target folder small for better cache efficiency
+  MSEDGEDRIVER_TOOL_REV: 8c4b34f51b45f5cf08013366d703de464ab871d1
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ matrix.platform.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - { name: Linux, os: ubuntu-latest }
+          - { name: Windows, os: windows-latest }
+          - { name: macOS, os: macos-latest }
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+      - uses: pnpm/action-setup@v6
+        with:
+          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
+
+      - name: install Linux dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            webkit2gtk-driver \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            dbus \
+            xvfb \
+            fluxbox \
+            desktop-file-utils \
+            xdg-utils
+
+      # msedgedriver has to match the installed WebView2 runtime, so msedgedriver-tool
+      # downloads the right version at run time. The tool itself is built from a pinned git
+      # revision and kept in its own small cache entry (accessed by every Windows run, so it
+      # stays hot) instead of being rebuilt from source on every run.
+      - name: restore msedgedriver-tool (Windows)
+        if: runner.os == 'Windows'
+        id: msedgedriver-tool-cache
+        uses: actions/cache@v6
+        with:
+          path: ${{ runner.tool_cache }}/msedgedriver-tool
+          key: msedgedriver-tool-${{ runner.os }}-${{ env.MSEDGEDRIVER_TOOL_REV }}
+
+      - name: install msedgedriver-tool (Windows)
+        if: runner.os == 'Windows' && steps.msedgedriver-tool-cache.outputs.cache-hit != 'true'
+        run: cargo install --git https://github.com/chippers/msedgedriver-tool --rev ${{ env.MSEDGEDRIVER_TOOL_REV }} --locked --root ${{ runner.tool_cache }}/msedgedriver-tool
+
+      - name: install msedgedriver (Windows)
+        if: runner.os == 'Windows'
+        run: |
+          & "${{ runner.tool_cache }}/msedgedriver-tool/bin/msedgedriver-tool.exe"
+          $PWD.Path >> $env:GITHUB_PATH
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.platform.os }}
+          # Only `v2`/`v3` write to the cache: an entry saved from a pull request lives on its
+          # merge ref, where nothing else can restore it, and every write evicts an entry
+          # that other runs would have hit (10 GB repository limit, LRU eviction).
+          save-if: ${{ github.ref == 'refs/heads/v2' || github.ref == 'refs/heads/v3' }}
+
+      - name: install dependencies
+        run: pnpm i --frozen-lockfile
+
+      - name: build plugins
+        run: pnpm build
+
+      - name: run e2e tests (Linux)
+        if: runner.os == 'Linux'
+        timeout-minutes: 45
+        # A real window manager (fluxbox) is started so that window-state tests
+        # (size restore) behave, and a session D-Bus so the notification and
+        # clipboard plugins can reach their desktop services.
+        env:
+          E2E_SPEC_RETRIES: '1'
+        run: |
+          xvfb-run --auto-servernum -- dbus-run-session -- bash -c '
+            fluxbox >/dev/null 2>&1 &
+            sleep 1
+            pnpm test:api-e2e
+          '
+
+      - name: run e2e tests (Windows)
+        if: runner.os == 'Windows'
+        timeout-minutes: 45
+        shell: pwsh
+        # msedgedriver hands the app the `--remote-debugging-port` it attaches to through
+        # `WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS`, and WebView2 ignores that variable in an
+        # elevated process, which is what the runner gives us. gsudo runs the suite at medium
+        # integrity instead, and the workspace is opened up so the de-elevated process can use it.
+        # See https://github.com/tauri-apps/wry/issues/1782 and
+        # https://github.com/MicrosoftEdge/WebView2Feedback/issues/5645.
+        env:
+          E2E_SPEC_RETRIES: '1'
+        run: |
+          winget install gerardog.gsudo --accept-source-agreements --accept-package-agreements
+          icacls "$env:GITHUB_WORKSPACE" /grant "Everyone:(OI)(CI)F"
+          sudo --integrity Medium pnpm test:api-e2e
+
+      - name: run e2e tests (macOS)
+        if: runner.os == 'macOS' && env.CN_API_KEY != ''
+        timeout-minutes: 45
+        env:
+          CN_API_KEY: ${{ secrets.TAURI_E2E_CN_API_KEY }}
+          E2E_SPEC_RETRIES: '1'
+        # macOS has no native WebDriver for WKWebView, so the app is driven through the
+        # CrabNebula Webdriver (tauri-plugin-automation + test-runner-backend), which
+        # authenticates with CN_API_KEY. wdio.conf enables it automatically on darwin and
+        # builds the `.app` bundle it needs.
+        run: pnpm test:api-e2e
+
+      - name: collect app crash reports (macOS)
+        if: runner.os == 'macOS' && failure()
+        run: .scripts/ci/collect-macos-crash-reports.sh "$RUNNER_TEMP/crash-reports"
+
+      - name: upload app crash reports (macOS)
+        if: runner.os == 'macOS' && failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: macos-crash-reports
+          path: ${{ runner.temp }}/crash-reports
+          if-no-files-found: ignore

.github/workflows/test-rust.yml

@@ -0,0 +1,311 @@
+# Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: Test Rust
+
+on:
+  push:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/test-rust.yml'
+      - 'plugins/*/src/**'
+      - '!plugins/*/src/api-iife.js'
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+  pull_request:
+    branches:
+      - v1
+      - v2
+    paths:
+      - '.github/workflows/test-rust.yml'
+      - 'plugins/*/src/**'
+      - '!plugins/*/src/api-iife.js'
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+
+env:
+  CARGO_PROFILE_DEV_DEBUG: 0 # no debuginfo: faster builds and a much smaller target dir to cache
+  CROSS_REV: 51f46f296253d8122c927c5bb933e3c4f27cc317
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      packages: ${{ steps.filter.outputs.changes }}
+      saver: ${{ steps.saver.outputs.saver }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v2
+        id: filter
+        with:
+          base: v2
+          filters: |
+            tauri-plugin-autostart:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/autostart/**
+            tauri-plugin-cli:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/cli/**
+            tauri-plugin-clipboard-manager:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/clipboard-manager/**
+            tauri-plugin-deep-link:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/deep-link/**
+            tauri-plugin-dialog:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/dialog/**
+              - plugins/fs/**
+            tauri-plugin-fs:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/fs/**
+            tauri-plugin-geolocation:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/geolocation/**
+            tauri-plugin-global-shortcut:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/global-shortcut/**
+            tauri-plugin-opener:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/opener/**
+            tauri-plugin-haptics:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/haptics/**
+            tauri-plugin-http:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/http/**
+              - plugins/fs/**
+            tauri-plugin-localhost:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/localhost/**
+            tauri-plugin-log:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/log/**
+            tauri-plugin-notification:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/notification/**
+            tauri-plugin-os:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/os/**
+            tauri-plugin-persisted-scope:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/persisted-scope/**
+              - plugins/fs/**
+            tauri-plugin-positioner:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/positioner/**
+            tauri-plugin-process:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/process/**
+            tauri-plugin-shell:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/shell/**
+            tauri-plugin-single-instance:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/single-instance/**
+            tauri-plugin-sql:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/sql/**
+            tauri-plugin-store:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/store/**
+            tauri-plugin-stronghold:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/stronghold/**
+            tauri-plugin-updater:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/updater/**
+            tauri-plugin-upload:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/upload/**
+            tauri-plugin-websocket:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/websocket/**
+            tauri-plugin-window-state:
+              - .github/workflows/test-rust.yml
+              - Cargo.toml
+              - Cargo.lock
+              - plugins/window-state/**
+
+      # Every package job for a platform restores the same rust-cache entry, and exactly one
+      # of them saves it (see the `save-if` of the rust-cache step). Prefer the packages whose
+      # dependency tree covers most of the other plugins' dependencies, so the entry is as
+      # useful as possible for the packages that did not save it.
+      - name: pick the package that saves the cache
+        id: saver
+        env:
+          PACKAGES: ${{ steps.filter.outputs.changes }}
+        run: |
+          saver="$(jq -rn --argjson packages "${PACKAGES:-[]}" '
+            ["tauri-plugin-upload", "tauri-plugin-sql", "tauri-plugin-updater", "tauri-plugin-single-instance"]
+            | map(select(. as $p | $packages | index($p) != null))
+            | first // $packages[0] // empty
+          ')"
+          echo "saver=$saver" >> "$GITHUB_OUTPUT"
+
+  test:
+    needs: changes
+    if: ${{ needs.changes.outputs.packages != '[]' && needs.changes.outputs.packages != '' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        package: ${{ fromJSON(needs.changes.outputs.packages) }}
+        platform:
+          - {
+              target: x86_64-pc-windows-msvc,
+              os: windows-latest,
+              runner: 'cargo',
+              command: 'test'
+            }
+          - {
+              target: x86_64-unknown-linux-gnu,
+              os: ubuntu-22.04,
+              runner: 'cargo',
+              command: 'test'
+            }
+          - {
+              target: aarch64-apple-darwin,
+              os: macos-latest,
+              runner: 'cargo',
+              command: 'test'
+            }
+          - {
+              target: aarch64-apple-ios,
+              os: macos-latest,
+              runner: 'cargo',
+              command: 'build'
+            }
+          - {
+              target: aarch64-linux-android,
+              os: ubuntu-latest,
+              runner: 'cross',
+              command: 'build'
+            }
+
+    runs-on: ${{ matrix.platform.os }}
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install webkit2gtk
+        if: contains(matrix.platform.target, 'unknown-linux')
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev
+
+      - uses: dtolnay/rust-toolchain@1.77.2
+        with:
+          targets: ${{ matrix.platform.target }}
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # One entry per platform, shared by every package job: the plugins share most of
+          # their dependency tree (tauri, wry, tao...), and an entry per package and platform
+          # (26 × 5 entries of 500-800 MB each) never fits the repository's 10 GB cache limit.
+          key: ${{ matrix.platform.target }}
+          # Only `v2`/`v3` write to the cache: an entry saved from a pull request lives on its
+          # merge ref, where nothing else can restore it, and every write evicts an entry
+          # that other runs would have hit (10 GB repository limit, LRU eviction).
+          # A single package job saves the shared entry, so the jobs don't race for the key.
+          save-if: ${{ (github.ref == 'refs/heads/v2' || github.ref == 'refs/heads/v3') && matrix.package == needs.changes.outputs.saver }}
+
+      # `cross` is built from a pinned git revision (its latest release predates the Android
+      # targets we need). Keep the binary in its own small cache entry (accessed by every run,
+      # so it stays hot) instead of rebuilding it from source on every run.
+      - name: restore cross
+        if: ${{ matrix.platform.runner == 'cross' }}
+        id: cross-cache
+        uses: actions/cache@v6
+        with:
+          path: ${{ runner.tool_cache }}/cross
+          key: cross-${{ runner.os }}-${{ env.CROSS_REV }}
+
+      - name: install cross
+        if: ${{ matrix.platform.runner == 'cross' && steps.cross-cache.outputs.cache-hit != 'true' }}
+        run: cargo +stable install cross --git https://github.com/cross-rs/cross --rev ${{ env.CROSS_REV }} --locked --root ${{ runner.tool_cache }}/cross
+
+      - name: add cross to PATH
+        if: ${{ matrix.platform.runner == 'cross' }}
+        run: echo "${{ runner.tool_cache }}/cross/bin" >> $GITHUB_PATH
+
+      - name: test ${{ matrix.package }}
+        if: ${{ matrix.package != 'tauri-plugin-http' && matrix.package != 'tauri-plugin-dialog' }}
+        run: ${{ matrix.platform.runner }} ${{ matrix.platform.command }} --package ${{ matrix.package }} --target ${{ matrix.platform.target }} --all-targets --all-features
+
+      - name: test ${{ matrix.package }}
+        if: ${{ matrix.package == 'tauri-plugin-http' || matrix.package == 'tauri-plugin-dialog' }}
+        run: ${{ matrix.platform.runner }} ${{ matrix.platform.command }} --package ${{ matrix.package }} --target ${{ matrix.platform.target }} --all-targets
+
+      # `--all-targets` above does not include doc tests, so they are run separately.
+      # Only on the platforms we actually test on, since cargo skips doc tests when cross compiling.
+      - name: doc test ${{ matrix.package }}
+        if: ${{ matrix.platform.command == 'test' && matrix.package != 'tauri-plugin-http' && matrix.package != 'tauri-plugin-dialog' }}
+        run: ${{ matrix.platform.runner }} test --doc --package ${{ matrix.package }} --target ${{ matrix.platform.target }} --all-features
+
+      - name: doc test ${{ matrix.package }}
+        if: ${{ matrix.platform.command == 'test' && (matrix.package == 'tauri-plugin-http' || matrix.package == 'tauri-plugin-dialog') }}
+        run: ${{ matrix.platform.runner }} test --doc --package ${{ matrix.package }} --target ${{ matrix.platform.target }}