snapshot of https://github.com/tauri-apps/tauri.git (dev, 2026-09-23; blobs > 131072B omitted)

.github/workflows/audit.yml

@@ -0,0 +1,55 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: Audit
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * *'
+  pull_request:
+    paths:
+      - '.github/workflows/audit.yml'
+      - '**/Cargo.lock'
+      - '**/Cargo.toml'
+      - '**/package.json'
+      - '**/pnpm-lock.yaml'
+  push:
+    branches:
+      - dev
+    paths:
+      - '.github/workflows/audit.yml'
+      - '**/Cargo.lock'
+      - '**/Cargo.toml'
+      - '**/package.json'
+      - '**/pnpm-lock.yaml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  issues: write
+  checks: write
+
+jobs:
+  audit-rust:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: rust audit
+        uses: rustsec/audit-check@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  audit-js:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm i -g --force corepack
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+      - run: pnpm audit

.github/workflows/bench.yml

@@ -0,0 +1,120 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: bench
+
+on:
+  push:
+    branches:
+      - dev
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - '.github/workflows/bench.yml'
+      - 'bench/**'
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_PROFILE_DEV_DEBUG: 0 # This would add unnecessary bloat to the target folder, decreasing cache efficiency.
+  LC_ALL: en_US.UTF-8 # This prevents strace from changing its number format to use commas.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  bench:
+    strategy:
+      fail-fast: false
+      matrix:
+        rust: [nightly]
+        platform:
+          - {
+              target: x86_64-unknown-linux-gnu,
+              os: ubuntu-latest,
+              runner: 'xvfb-run --auto-servernum '
+            }
+          - { target: x86_64-pc-windows-msvc, os: windows-latest, runner: '' }
+          - { target: aarch64-apple-darwin, os: macos-latest, runner: '' }
+
+    runs-on: ${{ matrix.platform.os }}
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: install Rust ${{ matrix.rust }}
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.rust }}
+          components: rust-src
+          targets: ${{ matrix.platform.target }}
+
+      - name: install webkit2gtk and xvfb (ubuntu only)
+        if: contains(matrix.platform.target, 'gnu')
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            webkit2gtk-4.1 libayatana-appindicator3-dev \
+            xvfb \
+            at-spi2-core
+
+      - name: Setup python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+
+      - name: install memory_profiler
+        run: |
+          python -m pip install --upgrade pip
+          pip install memory_profiler
+
+      - name: Install cargo-binstall
+        uses: cargo-bins/cargo-binstall@v1.19.1
+
+      - name: Install hyperfine
+        run: cargo binstall hyperfine@1.20 --no-confirm
+
+      # No rust-cache on purpose: this job only runs on `dev`, its target dir does not fit the
+      # repository's 10 GB cache limit next to the entries pull requests restore, and an entry
+      # evicted before the next push only costs upload time.
+      - name: build benchmark binaries
+        env:
+          RUSTFLAGS: '-Zunstable-options -Cpanic=immediate-abort'
+        run: |
+          cargo +nightly build --release -Z build-std=std,panic_abort -Z build-std-features= --target ${{ matrix.platform.target }} --manifest-path bench/tests/cpu_intensive/src-tauri/Cargo.toml
+          cargo +nightly build --release -Z build-std=std,panic_abort -Z build-std-features= --target ${{ matrix.platform.target }} --manifest-path bench/tests/files_transfer/src-tauri/Cargo.toml
+          cargo +nightly build --release -Z build-std=std,panic_abort -Z build-std-features= --target ${{ matrix.platform.target }} --manifest-path bench/tests/helloworld/src-tauri/Cargo.toml
+
+      - name: run benchmarks
+        run: ${{ matrix.platform.runner }}cargo run --manifest-path ./bench/Cargo.toml --bin run_benchmark
+
+      - name: clone benchmarks_results
+        if: github.repository == 'tauri-apps/tauri' && github.ref == 'refs/heads/dev'
+        uses: actions/checkout@v7
+        with:
+          token: ${{ secrets.ORG_TAURI_BOT_PAT }}
+          path: gh-pages
+          repository: tauri-apps/benchmark_results
+
+      - name: push new benchmarks
+        if: github.repository == 'tauri-apps/tauri' && github.ref == 'refs/heads/dev'
+        run: |
+          cargo run --manifest-path ./bench/Cargo.toml --bin build_benchmark_jsons
+          cd gh-pages
+          git pull
+          git config user.name "tauri-bot"
+          git config user.email "tauri-bot@tauri.app"
+          git add .
+          git commit --message "Update Tauri benchmarks"
+          git push origin gh-pages
+
+      - name: Print worker info
+        # TODO: How to print this info on macOS and Windows
+        if: contains(matrix.platform.target, 'gnu')
+        run: |
+          cat /proc/cpuinfo
+          cat /proc/meminfo

.github/workflows/check-change-tags.yml

@@ -0,0 +1,47 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: check change tags
+
+on:
+  pull_request:
+    paths:
+      - '.changes/*.md'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: check change files end with .md
+        run: |
+          for file in .changes/*
+          do
+            if [[ ! "$file" =~ \.(md|json)$ ]]; then
+              echo ".changes directory should only contain files that end with .md"
+              echo "found an invalid file in .changes directory:"
+              echo "$file"
+              exit 1
+            fi
+          done
+
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          list-files: shell
+          filters: |
+            changes:
+              - added|modified: '.changes/*.md'
+
+      - name: check
+        run: node ./.scripts/ci/check-change-tags.js ${{ steps.filter.outputs.changes_files }}
+        if: ${{ steps.filter.outputs.changes == 'true' }}

.github/workflows/check-generated-files.yml

@@ -0,0 +1,85 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: check generated files
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/check-generated-files.yml'
+      - 'pnpm-lock.yaml'
+      - 'packages/api/src/**'
+      - 'crates/tauri/scripts/bundle.global.js'
+      - 'crates/tauri-utils/src/config.rs'
+      - 'crates/tauri-cli/config.schema.json'
+      - 'crates/tauri-schema-generator/schemas/*.json'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      api: ${{ steps.filter.outputs.api }}
+      schema: ${{ steps.filter.outputs.schema }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            api:
+              - 'pnpm-lock.yaml'
+              - 'packages/api/src/**'
+              - 'crates/tauri/scripts/bundle.global.js'
+            schema:
+              - 'crates/tauri-utils/src/config.rs'
+              - 'crates/tauri-cli/config.schema.json'
+              - 'crates/tauri-schema-generator/schemas/*.json'
+
+  api:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.api == 'true'
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm i -g --force corepack
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+          cache: 'pnpm'
+
+      - name: install deps
+        run: pnpm i --frozen-lockfile
+      - name: build api
+        run: pnpm build
+        working-directory: packages/api
+      - name: check api
+        run: ./.scripts/ci/has-diff.sh
+
+  schema:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.schema == 'true'
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: install Linux dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev
+
+      - name: generate schemas
+        run: cargo build --manifest-path ./crates/tauri-schema-generator/Cargo.toml
+
+      - name: check schemas
+        run: ./.scripts/ci/has-diff.sh

.github/workflows/check-license-header.yml

@@ -0,0 +1,31 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: check license headers
+
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          list-files: shell
+          filters: |
+            added:
+              - added: '**'
+      - name: check header license on new files
+        if: ${{ steps.filter.outputs.added == 'true' }}
+        run: node ./.scripts/ci/check-license-header.js ${{ steps.filter.outputs.added_files }}

.github/workflows/covector-comment-on-fork.yml

@@ -0,0 +1,30 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: covector comment
+on:
+  workflow_run:
+    workflows: [covector status] # the `name` of the workflow run on `pull_request` running `status` with `comment: true`
+    types:
+      - completed
+
+# note all other permissions are set to none if not specified
+#  and these set the permissions for `secrets.GITHUB_TOKEN`
+permissions:
+  # to read the action artifacts on `covector status` workflows
+  actions: read
+  # to write the comment
+  pull-requests: write
+
+jobs:
+  comment:
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.conclusion == 'success' &&
+      (github.event.workflow_run.head_repository.full_name != github.repository || github.actor == 'dependabot[bot]')
+    steps:
+      - name: covector status
+        uses: jbolda/covector/packages/action@covector-v0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          command: 'status'

.github/workflows/covector-status.yml

@@ -0,0 +1,25 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: covector status
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  covector:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: covector status
+        uses: jbolda/covector/packages/action@covector-v0
+        id: covector
+        with:
+          command: 'status'
+          token: ${{ secrets.GITHUB_TOKEN }}
+          comment: true

.github/workflows/covector-version-or-publish.yml

@@ -0,0 +1,150 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: covector version or publish
+
+on:
+  push:
+    branches:
+      - dev
+
+permissions:
+  contents: read
+
+jobs:
+  run-integration-tests:
+    runs-on: ${{ matrix.platform }}
+    env:
+      CARGO_PROFILE_DEV_DEBUG: 0 # no debuginfo: faster builds and a much smaller target dir
+
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ubuntu-latest, macos-latest, windows-latest]
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - run: npm i -g --force corepack
+      - uses: actions/setup-node@v7
+        with:
+          cache: 'pnpm'
+
+      - name: install stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: install Linux dependencies
+        if: matrix.platform == 'ubuntu-latest'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y webkit2gtk-4.1 libayatana-appindicator3-dev libfuse2 librsvg2-dev
+
+      # No rust-cache on purpose: this job only runs on `dev`, its target dir does not fit the
+      # repository's 10 GB cache limit next to the entries pull requests restore, and an entry
+      # evicted before the next push only costs upload time.
+      - name: build CLI
+        run: cargo build --manifest-path ./crates/tauri-cli/Cargo.toml
+
+      - name: run integration tests
+        run: cargo test --test '*' -- --ignored
+
+      - name: run CLI tests
+        timeout-minutes: 30
+        run: |
+          cd ./packages/cli
+          pnpm i --frozen-lockfile
+          pnpm build
+          pnpm test
+
+  version-or-publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 65
+    permissions:
+      actions: write # required for workflow_dispatch
+      contents: write # required to create new releases
+      pull-requests: write # required to open version update pr
+      id-token: write # pnpm provenance / oidc token
+    outputs:
+      change: ${{ steps.covector.outputs.change }}
+      commandRan: ${{ steps.covector.outputs.commandRan }}
+      successfulPublish: ${{ steps.covector.outputs.successfulPublish }}
+    needs:
+      - run-integration-tests
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: npm i -g --force corepack
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+
+      - name: cargo login
+        run: cargo login ${{ secrets.ORG_CRATES_IO_TOKEN }}
+      - name: git config
+        run: |
+          git config --global user.name "${{ github.event.pusher.name }}"
+          git config --global user.email "${{ github.event.pusher.email }}"
+
+      - name: install Linux dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y webkit2gtk-4.1 libayatana-appindicator3-dev librsvg2-dev
+
+      - name: covector version or publish (publish when no change files present)
+        uses: jbolda/covector/packages/action@covector-v0
+        id: covector
+        env:
+          CARGO_AUDIT_OPTIONS: ${{ secrets.CARGO_AUDIT_OPTIONS }}
+          NPM_CONFIG_PROVENANCE: true
+        with:
+          command: 'version-or-publish'
+          token: ${{ secrets.GITHUB_TOKEN }}
+          createRelease: true
+          recognizeContributors: true
+
+      - name: Sync Cargo.lock
+        if: steps.covector.outputs.commandRan == 'version'
+        run: cargo tree --depth 0
+
+      - name: Create Pull Request With Versions Bumped
+        if: steps.covector.outputs.commandRan == 'version'
+        uses: peter-evans/create-pull-request@v8.1.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: release/version-updates
+          title: Apply Version Updates From Current Changes
+          commit-message: 'apply version updates'
+          labels: 'version updates'
+          body: ${{ steps.covector.outputs.change }}
+          sign-commits: true
+
+      - name: Trigger doc update
+        if: |
+          steps.covector.outputs.successfulPublish == 'true' &&
+          steps.covector.outputs.packagesPublished != ''
+        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # 3.0.0
+        with:
+          token: ${{ secrets.ORG_TAURI_BOT_PAT }}
+          repository: tauri-apps/tauri-docs
+          event-type: update-docs
+
+      - name: Trigger `@tauri-apps/cli` publishing workflow
+        if: |
+          steps.covector.outputs.successfulPublish == 'true' &&
+          contains(steps.covector.outputs.packagesPublished, '@tauri-apps/cli')
+        run: gh workflow run 31554138 -r dev -f releaseId=${{ steps.covector.outputs['-tauri-apps-cli-releaseId'] }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Trigger `tauri-cli` publishing workflow
+        if: |
+          steps.covector.outputs.successfulPublish == 'true' &&
+          contains(steps.covector.outputs.packagesPublished, 'tauri-cli')
+        run: gh workflow run 31554139 -r dev
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/deploy-schema-worker.yml

@@ -0,0 +1,28 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: deploy schema worker
+
+on:
+  push:
+    branches:
+      - dev
+    paths:
+      - '.github/workflows/deploy-schema-worker.yml'
+      - 'crates/tauri-schema-worker/**'
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: cloudflare/wrangler-action@v4
+        with:
+          command: deploy
+          workingDirectory: 'crates/tauri-schema-worker'
+          apiToken: ${{ secrets.SCHEMA_WORKER_CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.SCHEMA_WORKER_CLOUDFLARE_ACCOUNT_ID  }}

.github/workflows/docker.yml

@@ -0,0 +1,133 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: docker
+
+on:
+  workflow_dispatch:
+  #pull_request:
+  #  paths:
+  #    - '.docker/**'
+  #    - '.github/workflows/docker.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  setup:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: install stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: install Linux dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev
+
+      - name: install cross
+        run: cargo install cross --git https://github.com/cross-rs/cross
+
+      - name: Upload cross
+        uses: actions/upload-artifact@v4
+        with:
+          name: cross
+          path: '~/.cargo/bin/cross'
+          if-no-files-found: error
+
+      - name: build CLI
+        run: cargo build --manifest-path ./crates/tauri-cli/Cargo.toml
+
+      - name: Upload CLI
+        uses: actions/upload-artifact@v4
+        with:
+          name: cargo-tauri
+          path: crates/tauri-cli/target/debug/cargo-tauri
+          if-no-files-found: error
+
+  docker:
+    needs: setup
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - { name: 'aarch64-unknown-linux-gnu', filename: 'aarch64' }
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: install stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target.name }}
+
+      - run: npm i -g --force corepack
+      - name: Setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+
+      - name: Download cross
+        uses: actions/download-artifact@v4.1.7
+        with:
+          name: cross
+          path: '~/.cargo/bin'
+
+      - name: Download CLI
+        uses: actions/download-artifact@v4.1.7
+        with:
+          name: cargo-tauri
+          path: 'examples/api'
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and export to Docker
+        uses: docker/build-push-action@v3
+        with:
+          context: .docker/cross
+          file: .docker/cross/${{ matrix.target.filename }}.Dockerfile
+          load: true
+          tags: ${{ matrix.target.name }}:latest
+
+      - name: install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y webkit2gtk-4.1 libayatana-appindicator3-dev
+
+      - name: Test
+        run: |
+          cd packages/api
+          pnpm i --frozen-lockfile && pnpm build
+          cd ../../examples/api
+          pnpm i --frozen-lockfile
+          . .setup-cross.sh
+          chmod +x cargo-tauri
+          chmod +x $HOME/.cargo/bin/cross
+          ./cargo-tauri build --runner cross --bundles deb --target ${{ matrix.target.name }} --verbose
+
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: .docker/cross
+          file: .docker/cross/${{ matrix.target.filename }}.Dockerfile
+          push: true
+          tags: ghcr.io/${{ github.repository }}/${{ matrix.target.name }}:latest

.github/workflows/fmt.yml

@@ -0,0 +1,54 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: check formatting
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  rustfmt:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust stable and rustfmt
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+
+      - name: run cargo fmt
+        run: cargo fmt --all -- --check
+
+  prettier:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm i -g --force corepack
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+          cache: 'pnpm'
+      - run: pnpm i --frozen-lockfile
+      - run: pnpm format:check
+
+  taplo:
+    name: taplo (.toml files)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: install taplo-cli
+        uses: taiki-e/install-action@v2
+        with:
+          tool: taplo-cli
+
+      - run: taplo fmt --check --diff

.github/workflows/lint-js.yml

@@ -0,0 +1,45 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: lint js
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/lint-js.yml'
+      - 'packages/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  eslint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm i -g --force corepack
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+          cache: 'pnpm'
+      - run: pnpm i --frozen-lockfile
+      - run: pnpm eslint:check
+
+  typescript:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm i -g --force corepack
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+          cache: 'pnpm'
+      - run: pnpm i --frozen-lockfile
+      - run: pnpm build
+        working-directory: packages/api
+      - run: pnpm ts:check

.github/workflows/lint-rust.yml

@@ -0,0 +1,89 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: lint rust
+
+on:
+  push:
+    branches:
+      - dev
+  pull_request:
+    paths:
+      - '.github/workflows/lint-rust.yml'
+      - 'crates/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_PROFILE_DEV_DEBUG: 0 # This would add unnecessary bloat to the target folder, decreasing cache efficiency.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  clippy:
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+            cargo: 'cargo'
+            include: ''
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-latest
+            cargo: 'cargo'
+            include: ''
+          - target: aarch64-apple-darwin
+            os: macos-latest
+            cargo: 'cargo'
+            include: ''
+          - target: aarch64-apple-ios
+            os: macos-latest
+            cargo: 'cargo'
+            # api example crate should pull in every dependency we want to lint on mobile
+            include: '--package api '
+          - target: aarch64-linux-android
+            os: ubuntu-latest
+            cargo: 'cross'
+            # api example crate should pull in every dependency we want to lint on mobile
+            include: '--package api '
+
+    runs-on: ${{ matrix.platform.os }}
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install rust stable and clippy
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+          targets: ${{ matrix.platform.target }}
+
+      - name: install Linux dependencies
+        if: contains(matrix.platform.target, 'unknown-linux')
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev webkit2gtk-4.1 libayatana-appindicator3-dev
+
+      - name: Install cross
+        if: ${{ matrix.platform.cargo == 'cross' }}
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cross@0.2.5
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.platform.target }}
+          # Only `dev` writes to the cache: an entry saved from a pull request lives on its
+          # merge ref, where nothing else can restore it, and every write evicts a `dev`
+          # entry that other runs would have hit (10 GB repository limit, LRU eviction).
+          save-if: ${{ github.ref == 'refs/heads/dev' }}
+
+      - run: ${{ matrix.platform.cargo }} clippy --target ${{ matrix.platform.target }} ${{ matrix.platform.include }}--all-targets --all-features -- -D warnings

.github/workflows/publish-cli-js.yml

@@ -0,0 +1,289 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: publish `@tauri-apps/cli`
+env:
+  DEBUG: napi:*
+  APP_NAME: cli
+  MACOSX_DEPLOYMENT_TARGET: '10.13'
+on:
+  workflow_dispatch:
+    inputs:
+      releaseId:
+        description: 'ID of the `@tauri-apps/cli` release'
+        required: true
+  repository_dispatch:
+    types: [publish-js-cli]
+
+defaults:
+  run:
+    working-directory: packages/cli/
+
+permissions:
+  contents: write # update release
+  id-token: write # oidc token
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        settings:
+          - host: macos-latest
+            target: x86_64-apple-darwin
+            build: pnpm build --target=x86_64-apple-darwin
+          - host: macos-latest
+            target: aarch64-apple-darwin
+            build: pnpm build --target=aarch64-apple-darwin
+
+          - host: windows-latest
+            build: pnpm build --target=x86_64-pc-windows-msvc
+            target: x86_64-pc-windows-msvc
+          - host: windows-latest
+            build: pnpm build --target=i686-pc-windows-msvc
+            target: i686-pc-windows-msvc
+          - host: windows-latest
+            target: aarch64-pc-windows-msvc
+            build: pnpm build --target=aarch64-pc-windows-msvc
+
+          - host: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            build: pnpm build --target=x86_64-unknown-linux-gnu --cross-compile
+          - host: ubuntu-latest
+            target: x86_64-unknown-linux-musl
+            build: pnpm build --target=x86_64-unknown-linux-musl --cross-compile
+          - host: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+            build: pnpm build --target=aarch64-unknown-linux-gnu --cross-compile
+            setup: |
+              sudo apt-get update
+              sudo apt-get install gcc-aarch64-linux-gnu g++-aarch64-linux-gnu -y
+          - host: ubuntu-latest
+            target: armv7-unknown-linux-gnueabihf
+            build: pnpm build --target=armv7-unknown-linux-gnueabihf --cross-compile
+          - host: ubuntu-latest
+            target: aarch64-unknown-linux-musl
+            build: pnpm build --target=aarch64-unknown-linux-musl --cross-compile
+          - host: ubuntu-latest
+            target: riscv64gc-unknown-linux-gnu
+            build: pnpm build --target=riscv64gc-unknown-linux-gnu --cross-compile
+            setup: |
+              sudo apt-get update
+              sudo apt-get install gcc-riscv64-linux-gnu g++-riscv64-linux-gnu -y
+    name: stable - ${{ matrix.settings.target }} - node@22
+    runs-on: ${{ matrix.settings.host }}
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm i -g --force corepack
+      - name: Setup node
+        uses: actions/setup-node@v7
+        if: ${{ !matrix.settings.docker }}
+        with:
+          node-version: 22
+          cache: 'pnpm'
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          # CEF helper needs both archs
+          targets: ${{ contains(matrix.settings.target, 'apple-darwin') && 'aarch64-apple-darwin,x86_64-apple-darwin' || matrix.settings.target }}
+      - uses: mlugg/setup-zig@v2
+        if: ${{ contains(matrix.settings.target, 'linux') }}
+        with:
+          version: 0.14.1
+      - name: Install cargo-zigbuild
+        uses: taiki-e/install-action@v2
+        if: ${{ contains(matrix.settings.target, 'linux') }}
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        with:
+          tool: cargo-zigbuild
+
+      - name: Setup toolchain
+        run: ${{ matrix.settings.setup }}
+        if: ${{ matrix.settings.setup }}
+        shell: bash
+
+      - name: Install dependencies
+        run: pnpm i --frozen-lockfile --ignore-scripts
+
+      - name: Build
+        run: ${{ matrix.settings.build }}
+        shell: bash
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: bindings-${{ matrix.settings.target }}
+          path: packages/cli/${{ env.APP_NAME }}.*.node
+          if-no-files-found: error
+
+  test-macOS-windows-binding:
+    name: Test bindings on ${{ matrix.settings.target }} - node@${{ matrix.node }}
+    needs:
+      - build
+    strategy:
+      fail-fast: false
+      matrix:
+        settings:
+          - host: macos-latest
+            target: aarch64-apple-darwin
+            architecture: arm64
+          - host: windows-latest
+            target: x86_64-pc-windows-msvc
+            architecture: x64
+          - host: windows-11-arm
+            target: aarch64-pc-windows-msvc
+            architecture: arm64
+          - host: macos-latest
+            target: x86_64-apple-darwin
+            architecture: x64
+        node:
+          - '22'
+          - '24'
+    runs-on: ${{ matrix.settings.host }}
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm i -g --force corepack
+      - name: Setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+          cache: pnpm
+          architecture: ${{ matrix.settings.architecture }}
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Download artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: bindings-${{ matrix.settings.target }}
+          path: 'packages/cli/'
+      - name: List packages
+        run: ls -R .
+        shell: bash
+      - name: Test bindings
+        run: pnpm test
+  test-linux-binding:
+    name: Test ${{ matrix.target }} - node@${{ matrix.node }}
+    needs:
+      - build
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - x86_64-unknown-linux-gnu
+          - x86_64-unknown-linux-musl
+          - aarch64-unknown-linux-gnu
+          - aarch64-unknown-linux-musl
+          - armv7-unknown-linux-gnueabihf
+        node:
+          - '22'
+          - '24'
+    runs-on: ${{ contains(matrix.target, 'aarch64') && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm i -g --force corepack
+      - name: Setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+          cache: pnpm
+          architecture: ${{ contains(matrix.target, 'aarch64') && 'arm64' || 'x64' }}
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: bindings-${{ matrix.target }}
+          path: 'packages/cli/'
+      - name: List packages
+        run: ls -R .
+        shell: bash
+
+      - name: install system dependencies (gnu)
+        if: ${{ endsWith(matrix.target, 'gnu') }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y webkit2gtk-4.1 libayatana-appindicator3-dev librsvg2-dev
+
+      - name: Setup and run tests (gnu)
+        if: ${{ endsWith(matrix.target, 'gnu') }}
+        run: pnpm test
+
+      # TODO: Actually run tests on musl and armv7
+
+      - name: Output docker params
+        id: docker
+        if: ${{ contains(matrix.target, 'musl') || contains(matrix.target, 'armv7') }}
+        run: |
+          node -e "
+            if ('${{ matrix.target }}'.startsWith('aarch64')) {
+              console.log('PLATFORM=linux/arm64')
+            } else if ('${{ matrix.target }}'.startsWith('armv7')) {
+              console.log('PLATFORM=linux/arm/v7')
+            } else {
+              console.log('PLATFORM=linux/amd64')
+            }
+          " >> $GITHUB_OUTPUT
+          node -e "
+            if ('${{ matrix.target }}'.endsWith('-musl')) {
+              console.log('IMAGE=node:${{ matrix.node }}-alpine')
+            } else {
+              console.log('IMAGE=node:22-slim')
+            }
+          " >> $GITHUB_OUTPUT
+
+      - name: Set up QEMU (armv7)
+        uses: docker/setup-qemu-action@v4
+        if: ${{ contains(matrix.target, 'armv7') }}
+        with:
+          platforms: all
+      - run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+        if: ${{ contains(matrix.target, 'armv7') }}
+
+      - name: Setup and run tests (musl | armv7)
+        uses: addnab/docker-run-action@v3
+        if: ${{ contains(matrix.target, 'musl') || contains(matrix.target, 'armv7') }}
+        with:
+          image: ${{ steps.docker.outputs.IMAGE }}
+          options: --volume ${{ github.workspace }}:${{ github.workspace }} --workdir ${{ github.workspace }}/packages/cli --platform ${{ steps.docker.outputs.PLATFORM }}
+          shell: sh
+          run: |
+            set -e
+            node tauri.js --help
+            ls -la
+
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+    needs:
+      - test-macOS-windows-binding
+      - test-linux-binding
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm i -g --force corepack
+      - name: Setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: 'pnpm'
+      - name: Install dependencies
+        run: pnpm i --frozen-lockfile --ignore-scripts
+      - name: Download all artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: packages/cli/artifacts
+      - name: Move artifacts
+        run: pnpm artifacts
+      - name: List packages
+        run: ls -R ./npm
+        shell: bash
+      - name: Publish
+        run: |
+          npm publish
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ''
+          RELEASE_ID: ${{ github.event.client_payload.releaseId || inputs.releaseId }}

.github/workflows/publish-cli-rs.yml

@@ -0,0 +1,119 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: publish `tauri-cli`
+env:
+  MACOSX_DEPLOYMENT_TARGET: '10.13'
+on:
+  workflow_dispatch:
+  repository_dispatch:
+    types: [publish-clirs]
+
+permissions:
+  contents: write # required to create new releases
+
+jobs:
+  build:
+    runs-on: ${{ matrix.config.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        config:
+          - os: ubuntu-22.04
+            rust_target: x86_64-unknown-linux-gnu
+            ext: ''
+            args: ''
+          - os: macos-latest
+            rust_target: x86_64-apple-darwin
+            ext: ''
+            args: ''
+          - os: macos-latest
+            rust_target: aarch64-apple-darwin
+            ext: ''
+            args: ''
+          - os: windows-latest
+            rust_target: x86_64-pc-windows-msvc
+            ext: '.exe'
+            args: ''
+          - os: windows-latest
+            rust_target: aarch64-pc-windows-msvc
+            ext: '.exe'
+            args: ''
+          - os: ubuntu-22.04
+            rust_target: riscv64gc-unknown-linux-gnu
+            ext: ''
+            args: ''
+            cross: true
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: 'Setup Rust'
+        if: ${{ !matrix.config.cross }}
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.config.rust_target }}
+
+      - name: install Linux dependencies
+        if: ${{ !matrix.config.cross && startsWith(matrix.config.os, 'ubuntu') }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev
+
+      - name: Install cross
+        if: ${{ matrix.config.cross }}
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cross@0.2.5
+
+      - name: Build CLI
+        if: ${{ !matrix.config.cross }}
+        run: >-
+          cargo build --manifest-path ./crates/tauri-cli/Cargo.toml
+          --target ${{ matrix.config.rust_target }}
+          --profile release-size-optimized
+          ${{ matrix.config.args }}
+
+      - name: Build CLI (cross)
+        if: ${{ matrix.config.cross }}
+        run: >-
+          cross build --manifest-path ./crates/tauri-cli/Cargo.toml
+          --target ${{ matrix.config.rust_target }}
+          --profile release-size-optimized
+          ${{ matrix.config.args }}
+
+      - name: Upload CLI
+        uses: actions/upload-artifact@v4
+        with:
+          name: cargo-tauri-${{ matrix.config.rust_target }}${{ matrix.config.ext }}
+          path: target/${{ matrix.config.rust_target }}/release-size-optimized/cargo-tauri${{ matrix.config.ext }}
+          if-no-files-found: error
+
+  upload:
+    needs: build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Download built CLIs
+        uses: actions/download-artifact@v4.1.7
+        with:
+          path: outputs
+
+      - name: Pack archives
+        run: ./.scripts/ci/pack-cli.sh
+
+      - name: Get CLI version
+        run: echo "CLI_VERSION=$(cat crates/tauri-cli/metadata-v2.json | jq '."cli.js".version' -r)" >> $GITHUB_ENV
+
+      - name: Publish release
+        uses: softprops/action-gh-release@50195ba7f6f93d1ac97ba8332a178e008ad176aa
+        with:
+          tag_name: tauri-cli-v${{ env.CLI_VERSION }}
+          files: |
+            outputs/cargo-tauri-*.zip
+            outputs/cargo-tauri-*.tgz

.github/workflows/supply-chain.yml

@@ -0,0 +1,48 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: supply chain health status
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * *'
+  push:
+    branches:
+      - dev
+    paths:
+      - '.github/workflows/supply-chain.yml'
+      - '**/Cargo.lock'
+      - '**/Cargo.toml'
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-vet:
+    name: check rust dependencies with cargo vet
+    runs-on: ubuntu-latest
+    env:
+      CARGO_VET_VERSION: 0.9.1
+    steps:
+      - uses: actions/checkout@master
+      - name: Install Rust
+        run: rustup update stable && rustup default stable
+
+      - uses: actions/cache@v4
+        with:
+          path: ${{ runner.tool_cache }}/cargo-vet
+          key: cargo-vet-bin-${{ env.CARGO_VET_VERSION }}
+
+      - name: Add the tool cache directory to the search path
+        run: echo "${{ runner.tool_cache }}/cargo-vet/bin" >> $GITHUB_PATH
+
+      - name: Ensure that the tool cache is populated with the cargo-vet binary
+        run: cargo install --root ${{ runner.tool_cache }}/cargo-vet --version ${{ env.CARGO_VET_VERSION }} cargo-vet
+
+      # Enable this again to break the workflow once we have a reasonable amount of suggestions to get to a clean base line
+      #      - name: Invoke cargo-vet
+      #        run: cargo vet --locked
+
+      - name: Provide audit suggestions
+        run: cargo vet suggest

.github/workflows/test-android.yml

@@ -0,0 +1,108 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: test android
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-android.yml'
+      - 'crates/tauri-cli/templates/mobile/android/**'
+      - 'crates/tauri-cli/src/mobile/**'
+      - '!crates/tauri-cli/src/mobile/ios.rs'
+      - '!crates/tauri-cli/src/mobile/ios/**'
+      - 'crates/tauri-build/src/mobile.rs'
+      - 'crates/tauri/mobile/android/**'
+      - 'crates/tauri/mobile/android-codegen/**'
+  workflow_dispatch:
+
+env:
+  RUST_BACKTRACE: 1
+  # Same values as test-cli-rs.yml: rust-cache hashes the CARGO_*/RUST* variables into its key,
+  # and this workflow restores the `tauri-cli` entry saved there.
+  CARGO_PROFILE_DEV_DEBUG: 0
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ matrix.platform }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ubuntu-latest, macos-latest, windows-latest]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust 1.90
+        uses: dtolnay/rust-toolchain@1.90
+
+      - run: npm i -g --force corepack
+      - name: setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: lts/*
+          cache: 'pnpm'
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 25
+          cache: gradle
+
+      - name: Setup NDK
+        uses: nttld/setup-ndk@v1
+        id: setup-ndk
+        with:
+          ndk-version: r29
+          local-cache: true
+
+      # TODO check after https://github.com/nttld/setup-ndk/issues/518 is fixed
+      - name: Restore Android Symlinks
+        if: matrix.platform == 'ubuntu-latest' || matrix.platform == 'macos-latest'
+        env:
+          NDK_HOST: ${{ matrix.platform == 'ubuntu-latest' && 'linux-x86_64' || 'darwin-x86_64' }}
+        run: |
+          directory="${{ steps.setup-ndk.outputs.ndk-path }}/toolchains/llvm/prebuilt/$NDK_HOST/bin"
+          find "$directory" -type l | while read link; do
+              current_target=$(readlink "$link")
+              new_target="$directory/$(basename "$current_target")"
+              ln -sf "$new_target" "$link"
+              echo "Changed $(basename "$link") from $current_target to $new_target"
+          done
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # Restore-only: test-cli-rs saves this entry on `dev`; see test-cli-rs.yml.
+          shared-key: tauri-cli
+          save-if: false
+
+      - name: build and install CLI
+        # `--target-dir` so the build reuses the cached dependencies instead of a temporary dir
+        run: cargo install tauri-cli --path ./crates/tauri-cli/ --locked --debug --target-dir target
+
+      - run: pnpm i --frozen-lockfile
+
+      - name: build Tauri API
+        working-directory: ./packages/api
+        run: pnpm build
+
+      - name: init Android Studio project
+        working-directory: ./examples/api
+        run: cargo tauri android init
+        env:
+          NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
+
+      - name: build APK
+        working-directory: ./examples/api
+        run: cargo tauri android build
+        env:
+          NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}

.github/workflows/test-api-e2e-mobile.yml

@@ -0,0 +1,243 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: test `@tauri-apps/api` e2e (mobile)
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - dev
+  pull_request:
+    paths:
+      - '.github/workflows/test-api-e2e-mobile.yml'
+      - 'packages/api/**'
+      - 'packages/api-e2e/**'
+      - 'examples/api/**'
+      - 'crates/tauri/mobile/**'
+      - 'crates/tauri-cli/templates/mobile/**'
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_PROFILE_DEV_DEBUG: 0 # keeps the target folder small for better cache efficiency
+  # Incremental artifacts are dropped from the cache anyway and only slow the builds down.
+  CARGO_INCREMENTAL: 0
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  android:
+    runs-on: ubuntu-latest
+    env:
+      # The emulator runs the host architecture, so only that target is built.
+      E2E_ANDROID_TARGET: x86_64
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust 1.90
+        # The MSRV, as the other jobs building the CLI use. The compiler version is part of
+        # the rust-cache key, so a floating `stable` would also invalidate the entry below on
+        # every Rust release.
+        uses: dtolnay/rust-toolchain@1.90
+        with:
+          targets: x86_64-linux-android
+
+      - run: npm i -g --force corepack
+      - name: setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+          cache: 'pnpm'
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 25
+          cache: gradle
+
+      - name: use the preinstalled NDK
+        # The runner image ships NDK r29, the release the CLI installs itself when it finds
+        # none. setup-ndk downloaded it again on every run, or kept a 700 MB copy of it in
+        # the cache (per ref, next to the entries that actually save time), and its symlinks
+        # needed patching up.
+        run: echo "NDK_HOME=$ANDROID_NDK_LATEST_HOME" >> "$GITHUB_ENV"
+
+      # Hardware acceleration for the emulator.
+      - name: enable KVM
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # The dependencies of the CLI (host, dev profile) and of the example app (Android
+          # target, dev profile). Only `dev` writes the entry: one saved from a pull request
+          # lives on its merge ref, where nothing else can restore it, and every write evicts
+          # a `dev` entry that other runs would have hit (10 GB repository limit, LRU
+          # eviction). Pull requests restore the `dev` entry, so they get everything but
+          # the workspace crates for free.
+          shared-key: api-e2e-android
+          save-if: ${{ github.ref == 'refs/heads/dev' }}
+          # A flaky spec on `dev` must not throw the build away.
+          cache-on-failure: true
+
+      - name: install dependencies
+        run: pnpm i --frozen-lockfile
+
+      - name: build @tauri-apps/api
+        run: pnpm build:api
+
+      - name: build @tauri-apps/cli
+        # Debug profile: the suite only drives the CLI, and a debug CLI reuses the cached
+        # dependencies instead of a from-scratch LTO build (5 minutes on this runner).
+        run: pnpm build:cli:debug
+
+      # Built before the emulator is up so it does not sit idle (and time out)
+      # during the Rust and Gradle builds; the suite then reuses the APK.
+      - name: build the APK
+        working-directory: ./examples/api
+        run: |
+          pnpm tauri android init --ci --skip-targets-install
+          pnpm tauri android build --debug --apk --target $E2E_ANDROID_TARGET
+
+      - name: run e2e tests
+        uses: reactivecircus/android-emulator-runner@v2
+        timeout-minutes: 60
+        with:
+          api-level: 35
+          arch: x86_64
+          # google_apis images ship an up-to-date Android System WebView.
+          target: google_apis
+          profile: pixel_6
+          emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
+          disable-animations: true
+          script: E2E_SKIP_BUILD=1 E2E_SPEC_RETRIES=1 pnpm test:api-e2e:android
+
+      - name: upload appium logs
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: android-appium-logs
+          path: packages/api-e2e/logs
+          if-no-files-found: ignore
+
+  ios:
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust 1.90
+        # The MSRV, as the other jobs building the CLI use. The compiler version is part of
+        # the rust-cache key, so a floating `stable` would also invalidate the entry below on
+        # every Rust release.
+        uses: dtolnay/rust-toolchain@1.90
+        with:
+          targets: aarch64-apple-ios-sim
+
+      - run: npm i -g --force corepack
+      - name: setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+          cache: 'pnpm'
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # The dependencies of the CLI (host, dev profile) and of the example app (simulator
+          # target, dev profile). Only `dev` writes the entry; see the Android job.
+          shared-key: api-e2e-ios
+          save-if: ${{ github.ref == 'refs/heads/dev' }}
+          cache-on-failure: true
+
+      - name: install dependencies
+        run: pnpm i --frozen-lockfile
+
+      # The simulator the suite runs on: the iPhone on the newest installed iOS runtime, as
+      # wdio.mobile.ts would pick it. Booted now so that it is ready once the app is built:
+      # a cold boot takes over a minute on the runner, and Appium otherwise does it as part
+      # of the first session.
+      - name: boot the iOS simulator
+        run: |
+          udid=$(xcrun simctl list devices available --json | jq -r '
+            .devices
+            | to_entries
+            | map(select(.key | contains(".iOS-")))
+            | sort_by(.key | capture("iOS-(?<major>[0-9]+)-(?<minor>[0-9]+)") | [(.major | tonumber), (.minor | tonumber)])
+            | reverse
+            | map(.value[] | select(.isAvailable and ((.deviceTypeIdentifier // .name) | contains("iPhone"))))
+            | .[0].udid
+          ')
+          echo "booting $udid"
+          xcrun simctl boot "$udid"
+          echo "E2E_IOS_DEVICE=$udid" >> "$GITHUB_ENV"
+
+      # Appium's release build of WebDriverAgent for the simulator. The XCUITest driver
+      # otherwise compiles it with xcodebuild in the first session, which took this runner
+      # 8-10 minutes: longer than the suite waits for a session, so that session always
+      # failed and its spec ran again once WDA was finally up. See E2E_IOS_WDA in
+      # packages/api-e2e/wdio.mobile.ts.
+      - name: download WebDriverAgent
+        working-directory: ./packages/api-e2e
+        env:
+          # where Appium looks for the driver; the suite sets the same
+          APPIUM_HOME: ${{ github.workspace }}/packages/api-e2e
+        run: |
+          pnpm exec appium driver run xcuitest download-wda -- --outdir "$RUNNER_TEMP/wda" --platform iOS --kind sim
+          echo "E2E_IOS_WDA=$RUNNER_TEMP/wda/WebDriverAgentRunner-Runner.app" >> "$GITHUB_ENV"
+
+      - name: build @tauri-apps/api
+        run: pnpm build:api
+
+      - name: build @tauri-apps/cli
+        # Debug profile: the suite only drives the CLI, and a debug CLI reuses the cached
+        # dependencies instead of a from-scratch LTO build (10 minutes on this runner).
+        run: pnpm build:cli:debug
+
+      # Simulator build (`aarch64-sim` on the Apple Silicon runners), unsigned.
+      # Built ahead of the suite for symmetry with the Android job.
+      - name: build the simulator app
+        working-directory: ./examples/api
+        run: |
+          pnpm tauri ios init --ci --skip-targets-install
+          pnpm tauri ios build --debug --target aarch64-sim --no-sign
+
+      - name: wait for the simulator
+        run: xcrun simctl bootstatus "$E2E_IOS_DEVICE" -b
+
+      # wdio.ios.conf runs on the simulator booted above (E2E_IOS_DEVICE) with the
+      # prebuilt WebDriverAgent (E2E_IOS_WDA).
+      - name: run e2e tests
+        timeout-minutes: 60
+        env:
+          E2E_SKIP_BUILD: '1'
+          E2E_SPEC_RETRIES: '1'
+        run: pnpm test:api-e2e:ios
+
+      - name: upload appium logs
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: ios-appium-logs
+          path: packages/api-e2e/logs
+          if-no-files-found: ignore
+
+      - name: collect app crash reports
+        if: failure()
+        run: .scripts/ci/collect-macos-crash-reports.sh "$RUNNER_TEMP/crash-reports"
+
+      - name: upload app crash reports
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: ios-crash-reports
+          path: ${{ runner.temp }}/crash-reports
+          if-no-files-found: ignore

.github/workflows/test-api-e2e.yml

@@ -0,0 +1,189 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: test `@tauri-apps/api` e2e
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - dev
+  pull_request:
+    paths:
+      - '.github/workflows/test-api-e2e.yml'
+      - 'packages/api/**'
+      - 'packages/api-e2e/**'
+      - 'examples/api/**'
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_PROFILE_DEV_DEBUG: 0 # keeps the target folder small for better cache efficiency
+  # Incremental artifacts are dropped from the cache anyway and only slow the builds down.
+  CARGO_INCREMENTAL: 0
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ matrix.platform.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - { name: Linux, os: ubuntu-latest }
+          - { name: Windows, os: windows-latest }
+          - { name: macOS, os: macos-latest }
+
+    env:
+      # macOS has no native WebDriver for WKWebView, so the app is driven through the
+      # CrabNebula Webdriver (tauri-plugin-automation + test-runner-backend), which
+      # authenticates with this key. Pull requests from forks do not get it, and the macOS
+      # job then has nothing to test: the steps below skip the builds there rather than
+      # occupy a macOS runner for them.
+      HAS_CN_API_KEY: ${{ secrets.TAURI_E2E_CN_API_KEY != '' }}
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust 1.90
+        # The MSRV, as the other jobs building the CLI use. The compiler version is part of
+        # the rust-cache key, so a floating `stable` would also invalidate the entry below on
+        # every Rust release.
+        uses: dtolnay/rust-toolchain@1.90
+
+      - run: npm i -g --force corepack
+      - name: setup node
+        if: runner.os != 'macOS' || env.HAS_CN_API_KEY == 'true'
+        uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+          cache: 'pnpm'
+
+      - name: install Linux dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            webkit2gtk-driver \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            xvfb \
+            fluxbox
+          # WebKitGTK reads the color scheme and tao the theme from the desktop portal when a
+          # window is created. On the runner that portal is registered with D-Bus but never
+          # comes up (there is no desktop session for it), so both calls only return on their
+          # timeouts, 25s and 5s: about 30s per app start, and every spec starts the app.
+          # Without a service file the name is unknown and both calls fail at once.
+          sudo rm -f /usr/share/dbus-1/services/org.freedesktop.portal.Desktop.service
+
+      - name: install msedgedriver (Windows)
+        if: runner.os == 'Windows'
+        # The driver has to match the WebView2 runtime, which registers its version with
+        # EdgeUpdate under the client id below. This is what msedgedriver-tool does, minus
+        # compiling the tool from source on every run (a minute).
+        run: |
+          $ProgressPreference = 'SilentlyContinue'
+          $client = 'Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}'
+          $version = @(
+            "HKLM:\SOFTWARE\WOW6432Node\$client",
+            "HKLM:\SOFTWARE\$client",
+            "HKCU:\SOFTWARE\WOW6432Node\$client",
+            "HKCU:\SOFTWARE\$client"
+          ) | ForEach-Object { (Get-ItemProperty -Path $_ -ErrorAction SilentlyContinue).pv } | Where-Object { $_ } | Select-Object -First 1
+          if (-not $version) { throw 'no WebView2 runtime found in the registry' }
+          $dir = Join-Path $env:RUNNER_TEMP 'msedgedriver'
+          New-Item -ItemType Directory -Force -Path $dir | Out-Null
+          Invoke-WebRequest "https://msedgedriver.microsoft.com/$version/edgedriver_win64.zip" -OutFile "$dir\edgedriver.zip"
+          Expand-Archive "$dir\edgedriver.zip" -DestinationPath $dir -Force
+          Write-Host "WebView2 $version; $(& "$dir\msedgedriver.exe" --version)"
+          $dir >> $env:GITHUB_PATH
+
+      - uses: Swatinem/rust-cache@v2
+        if: runner.os != 'macOS' || env.HAS_CN_API_KEY == 'true'
+        with:
+          # The dependencies of the CLI and of the example app, both in the dev profile.
+          # Only `dev` writes the entry: one saved from a pull request lives on its merge
+          # ref, where nothing else can restore it, and every write evicts a `dev` entry
+          # that other runs would have hit (10 GB repository limit, LRU eviction). Pull
+          # requests restore the `dev` entry, so they get everything but the workspace
+          # crates for free.
+          shared-key: api-e2e
+          save-if: ${{ github.ref == 'refs/heads/dev' }}
+          # A flaky spec on `dev` must not throw the build away.
+          cache-on-failure: true
+
+      - name: install dependencies
+        if: runner.os != 'macOS' || env.HAS_CN_API_KEY == 'true'
+        run: pnpm i --frozen-lockfile
+
+      - name: build @tauri-apps/api
+        if: runner.os != 'macOS' || env.HAS_CN_API_KEY == 'true'
+        run: pnpm build:api
+
+      - name: build @tauri-apps/cli
+        if: runner.os != 'macOS' || env.HAS_CN_API_KEY == 'true'
+        # Debug profile: the suite builds the example app with `tauri build --debug` anyway, and
+        # a debug CLI reuses the cached dependencies instead of a from-scratch LTO build.
+        run: pnpm build:cli:debug
+
+      - name: run e2e tests (Linux)
+        if: runner.os == 'Linux'
+        timeout-minutes: 45
+        # A real window manager (fluxbox) is started so that window-state tests
+        # (minimize/maximize/fullscreen/position) behave.
+        env:
+          E2E_SPEC_RETRIES: '1'
+        run: |
+          xvfb-run --auto-servernum -- bash -c '
+            fluxbox >/dev/null 2>&1 &
+            sleep 1
+            pnpm test:api-e2e
+          '
+
+      - name: run e2e tests (Windows)
+        if: runner.os == 'Windows'
+        timeout-minutes: 45
+        shell: pwsh
+        # msedgedriver hands the app the `--remote-debugging-port` it attaches to through
+        # `WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS`, and WebView2 ignores that variable in an
+        # elevated process, which is what the runner gives us. gsudo runs the suite at medium
+        # integrity instead, and the workspace is opened up so the de-elevated process can use it.
+        # See https://github.com/tauri-apps/wry/issues/1782 and
+        # https://github.com/MicrosoftEdge/WebView2Feedback/issues/5645.
+        env:
+          E2E_SPEC_RETRIES: '1'
+        run: |
+          winget install gerardog.gsudo --accept-source-agreements --accept-package-agreements
+          icacls "$env:GITHUB_WORKSPACE" /grant "Everyone:(OI)(CI)F"
+          sudo --integrity Medium pnpm test:api-e2e
+
+      - name: run e2e tests (macOS)
+        if: runner.os == 'macOS' && env.HAS_CN_API_KEY == 'true'
+        timeout-minutes: 45
+        env:
+          CN_API_KEY: ${{ secrets.TAURI_E2E_CN_API_KEY }}
+          E2E_SPEC_RETRIES: '1'
+        # wdio.conf enables the CrabNebula Webdriver automatically on darwin and builds
+        # the `.app` bundle it needs.
+        run: pnpm test:api-e2e
+
+      - name: collect app crash reports (macOS)
+        if: runner.os == 'macOS' && failure()
+        run: .scripts/ci/collect-macos-crash-reports.sh "$RUNNER_TEMP/crash-reports"
+
+      - name: upload app crash reports (macOS)
+        if: runner.os == 'macOS' && failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: macos-crash-reports
+          path: ${{ runner.temp }}/crash-reports
+          if-no-files-found: ignore

.github/workflows/test-cli-js.yml

@@ -0,0 +1,72 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: test `@tauri-apps/cli`
+
+on:
+  push:
+    branches:
+      - dev
+  pull_request:
+    paths:
+      - '.github/workflows/test-cli-js.yml'
+      - 'packages/cli/**'
+      # currently` @tauri-apps/cli` only tests the template
+      - 'crates/tauri-cli/templates/app/**'
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_PROFILE_DEV_DEBUG: 0 # This would add unnecessary bloat to the target folder, decreasing cache efficiency.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ matrix.platform }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ubuntu-latest, macos-latest, windows-latest]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust 1.90
+        # the MSRV, so this job restores the `tauri-cli` cache entry saved by test-cli-rs
+        uses: dtolnay/rust-toolchain@1.90
+
+      - run: npm i -g --force corepack
+      - name: setup node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 'lts/*'
+          cache: 'pnpm'
+
+      - name: install Linux dependencies
+        if: matrix.platform == 'ubuntu-latest'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y webkit2gtk-4.1 libayatana-appindicator3-dev librsvg2-dev
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # Restore-only: test-cli-rs saves this entry on `dev`; see test-cli-rs.yml.
+          shared-key: tauri-cli
+          save-if: false
+
+      - name: test
+        timeout-minutes: 30
+        # The template test exercises the CLI, not its release profile. A debug build reuses
+        # the cached dependencies instead of a from-scratch LTO build (5-8 minutes per platform).
+        run: |
+          cd ./packages/cli
+          pnpm i --frozen-lockfile
+          pnpm build:debug
+          pnpm test

.github/workflows/test-cli-rs.yml

@@ -0,0 +1,78 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: test `tauri-cli`
+
+on:
+  push:
+    branches:
+      - dev
+  pull_request:
+    paths:
+      - '.github/workflows/test-cli-rs.yml'
+      - 'crates/tauri-utils/**'
+      - 'crates/tauri-bundler/**'
+      - 'crates/tauri-cli/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_PROFILE_DEV_DEBUG: 0 # This would add unnecessary bloat to the target folder, decreasing cache efficiency.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ matrix.platform.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - { target: x86_64-pc-windows-msvc, os: windows-latest }
+          # Same host build as the x86_64 job with the TLS features the aarch64 release uses.
+          # It restores that job's cache and only rebuilds the difference, and never saves
+          # (both jobs would otherwise race for the same cache key).
+          - {
+              target: aarch64-pc-windows-msvc,
+              os: windows-latest,
+              args: --no-default-features --features native-tls-vendored,
+              restore-only: true
+            }
+          - { target: x86_64-unknown-linux-gnu, os: ubuntu-latest }
+          - { target: x86_64-apple-darwin, os: macos-latest }
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: 'Setup Rust'
+        uses: dtolnay/rust-toolchain@1.90
+        with:
+          targets: ${{ matrix.platform.target }}
+
+      - name: install Linux dependencies
+        if: matrix.platform.os == 'ubuntu-latest'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev webkit2gtk-4.1 libayatana-appindicator3-dev librsvg2-dev
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # One entry per platform with tauri-cli's dependencies built in the dev profile on
+          # the 1.90 toolchain. This job saves it; test-cli-js and test-android restore it
+          # (same shared-key, same CARGO_*/RUST* env, same toolchain).
+          shared-key: tauri-cli
+          # Only `dev` writes to the cache: an entry saved from a pull request lives on its
+          # merge ref, where nothing else can restore it, and every write evicts a `dev`
+          # entry that other runs would have hit (10 GB repository limit, LRU eviction).
+          save-if: ${{ github.ref == 'refs/heads/dev' && !matrix.platform.restore-only }}
+
+      - name: test CLI
+        run: cargo test --manifest-path ./crates/tauri-cli/Cargo.toml ${{ matrix.platform.args }}

.github/workflows/test-core.yml

@@ -0,0 +1,139 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: test core
+
+on:
+  push:
+    branches:
+      - dev
+  pull_request:
+    paths:
+      - '.github/workflows/test-core.yml'
+      - 'crates/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '!crates/tauri/scripts/**'
+      - '!crates/tauri-cli/**'
+      - '!crates/tauri-bundler/**'
+      - '!crates/tauri-macos-sign/**'
+      - '!crates/tauri-schema-generator/**'
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_PROFILE_DEV_DEBUG: 0 # This would add unnecessary bloat to the target folder, decreasing cache efficiency.
+  CROSS_REV: 51f46f296253d8122c927c5bb933e3c4f27cc317
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ matrix.platform.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - {
+              target: x86_64-pc-windows-msvc,
+              os: windows-latest,
+              toolchain: '1.90',
+              cargo: cargo,
+              command: 'test'
+            }
+          - {
+              target: x86_64-unknown-linux-gnu,
+              os: ubuntu-latest,
+              toolchain: '1.90',
+              cargo: cargo,
+              command: 'test'
+            }
+          - {
+              target: aarch64-apple-darwin,
+              os: macos-14,
+              toolchain: '1.90',
+              cargo: cargo,
+              command: 'test'
+            }
+          - {
+              target: aarch64-apple-ios,
+              os: macos-latest,
+              toolchain: '1.90',
+              cargo: cargo,
+              command: 'build'
+            }
+          - {
+              target: aarch64-linux-android,
+              os: ubuntu-latest,
+              toolchain: '1.90',
+              cargo: cross,
+              command: 'build'
+            }
+        features:
+          - { args: --no-default-features, key: no-default }
+          - { args: --all-features, key: all }
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: install Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.platform.toolchain }}
+          targets: ${{ matrix.platform.target }}
+
+      - name: install Linux dependencies
+        if: contains(matrix.platform.target, 'unknown-linux')
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y webkit2gtk-4.1 libxdo-dev libayatana-appindicator3-dev
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.platform.target }}
+          # Only `dev` writes to the cache: an entry saved from a pull request lives on its
+          # merge ref, where nothing else can restore it, and every write evicts a `dev`
+          # entry that other runs would have hit (10 GB repository limit, LRU eviction).
+          save-if: ${{ github.ref == 'refs/heads/dev' && matrix.features.key == 'all' }}
+
+      # `cross` is built from a pinned git revision. Keep the binary in its own small cache
+      # entry (accessed by every run, so it stays hot) instead of rebuilding it whenever the
+      # much bigger rust-cache entry has been evicted.
+      - name: restore cross
+        if: ${{ matrix.platform.cargo == 'cross' }}
+        id: cross-cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.tool_cache }}/cross
+          key: cross-${{ runner.os }}-${{ env.CROSS_REV }}
+
+      - name: install cross
+        if: ${{ matrix.platform.cargo == 'cross' && steps.cross-cache.outputs.cache-hit != 'true' }}
+        run: cargo install cross --git https://github.com/cross-rs/cross --rev ${{ env.CROSS_REV }} --locked --root ${{ runner.tool_cache }}/cross
+
+      - name: add cross to PATH
+        if: ${{ matrix.platform.cargo == 'cross' }}
+        run: echo "${{ runner.tool_cache }}/cross/bin" >> $GITHUB_PATH
+
+      - name: test tauri-utils
+        # Using --lib --bins --tests to skip doc tests
+        run: ${{ matrix.platform.cargo }} ${{ matrix.platform.command }} --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --lib --bins --tests --manifest-path crates/tauri-utils/Cargo.toml
+
+      - name: run acl-tests
+        if: ${{ matrix.features.key != 'no-default' && matrix.platform.command == 'test' }}
+        run: ${{ matrix.platform.cargo }} test --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --manifest-path crates/tests/acl/Cargo.toml
+
+      - name: test tauri
+        run: ${{ matrix.platform.cargo }} ${{ matrix.features.key == 'no-default' && 'check' || matrix.platform.command }} --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --manifest-path crates/tauri/Cargo.toml
+
+      - name: test tauri examples
+        if: ${{ matrix.features.key != 'no-default' && matrix.platform.command == 'test' }}
+        run: |
+          ${{ matrix.platform.cargo }} test --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --examples --manifest-path crates/tauri/Cargo.toml
+          ${{ matrix.platform.cargo }} test --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --manifest-path examples/api/src-tauri/Cargo.toml

.github/workflows/udeps.yml

@@ -0,0 +1,140 @@
+# Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT
+
+name: Udeps
+
+on:
+  push:
+    branches:
+      - dev
+
+env:
+  RUST_BACKTRACE: 1
+  CARGO_PROFILE_DEV_DEBUG: 0 # This would add unnecessary bloat to the target folder, decreasing cache efficiency.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      tauri: ${{ steps.filter.outputs.tauri }}
+      build: ${{ steps.filter.outputs.build }}
+      codegen: ${{ steps.filter.outputs.codegen }}
+      macros: ${{ steps.filter.outputs.macros }}
+      runtime: ${{ steps.filter.outputs.runtime }}
+      wry: ${{ steps.filter.outputs.wry }}
+      utils: ${{ steps.filter.outputs.utils }}
+      bundler: ${{ steps.filter.outputs.bundler }}
+      cli: ${{ steps.filter.outputs.cli }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            tauri:
+              - 'crates/tauri/**'
+              - '!crates/tauri/scripts/**'
+            build:
+              - 'crates/tauri-build/**'
+            codegen:
+              - 'crates/tauri-codegen/**'
+            macros:
+              - 'crates/tauri-macros/**'
+            runtime:
+              - 'crates/tauri-runtime/**'
+            wry:
+              - 'crates/tauri-runtime-wry/**'
+            utils:
+              - 'crates/tauri-utils/**'
+            bundler:
+              - 'crates/tauri-bundler/**'
+            cli:
+              - 'crates/tauri-cli/**'
+            macossign:
+              - 'crates/tauri-macos-sign/**'
+
+  setup:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: |
+      needs.changes.outputs.tauri == 'true' ||
+      needs.changes.outputs.build == 'true' ||
+      needs.changes.outputs.codegen == 'true' ||
+      needs.changes.outputs.macros == 'true' ||
+      needs.changes.outputs.runtime == 'true' ||
+      needs.changes.outputs.wry == 'true' ||
+      needs.changes.outputs.utils == 'true' ||
+      needs.changes.outputs.bundler == 'true' ||
+      needs.changes.outputs.cli == 'true' ||
+      needs.changes.outputs.macossign == 'true'
+
+    steps:
+      - name: Create udeps matrix
+        id: create-matrix
+        env:
+          TAURI: ${{ needs.changes.outputs.tauri == 'true' }}
+          BUILD: ${{ needs.changes.outputs.build == 'true' }}
+          CODEGEN: ${{ needs.changes.outputs.codegen == 'true' }}
+          MACROS: ${{ needs.changes.outputs.macros == 'true' }}
+          RUNTIME: ${{ needs.changes.outputs.runtime == 'true' }}
+          WRY: ${{ needs.changes.outputs.wry == 'true' }}
+          UTILS: ${{ needs.changes.outputs.utils == 'true' }}
+          BUNDLER: ${{ needs.changes.outputs.bundler == 'true' }}
+          CLI: ${{ needs.changes.outputs.cli == 'true' }}
+          MACOSSIGN: ${{ needs.changes.outputs.macossign == 'true' }}
+        run: |
+          crates=()
+          if [ "${TAURI}" == "true" ]; then crates[${#crates[@]}]="\"./crates/tauri\""; fi
+          if [ "${BUILD}" == "true" ]; then crates[${#crates[@]}]="\"./crates/tauri-build\""; fi
+          if [ "${CODEGEN}" == "true" ]; then crates[${#crates[@]}]="\"./crates/tauri-codegen\""; fi
+          if [ "${MACROS}" == "true" ]; then crates[${#crates[@]}]="\"./crates/tauri-macros\""; fi
+          if [ "${RUNTIME}" == "true" ]; then crates[${#crates[@]}]="\"./crates/tauri-runtime\""; fi
+          if [ "${WRY}" == "true" ]; then crates[${#crates[@]}]="\"./crates/tauri-runtime-wry\""; fi
+          if [ "${UTILS}" == "true" ]; then crates[${#crates[@]}]="\"./crates/tauri-utils\""; fi
+          if [ "${BUNDLER}" == "true" ]; then crates[${#crates[@]}]="\"./crates/tauri-bundler\""; fi
+          if [ "${CLI}" == "true" ]; then crates[${#crates[@]}]="\"./crates/tauri-cli\""; fi
+          if [ "${MACOSSIGN}" == "true" ]; then crates[${#crates[@]}]="\"./crates/tauri-macos-sign\""; fi
+          echo "matrix=[$crates]" >> "$GITHUB_OUTPUT"
+    outputs:
+      matrix: ${{ steps.create-matrix.outputs.matrix }}
+
+  udeps:
+    runs-on: ubuntu-latest
+    needs: setup
+    strategy:
+      matrix:
+        path: ${{ fromJson(needs.setup.outputs.matrix) }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust nightly
+        uses: dtolnay/rust-toolchain@nightly
+
+      - name: install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev
+
+      # No rust-cache on purpose: this job only runs on `dev`, its target dir does not fit the
+      # repository's 10 GB cache limit next to the entries pull requests restore, and an entry
+      # evicted before the next push only costs upload time.
+      - name: Install udeps
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-udeps
+
+      - name: Install required packages
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y webkit2gtk-4.1 libayatana-appindicator3-dev
+
+      - name: Run udeps
+        run: cargo udeps --manifest-path ${{ matrix.path }}/Cargo.toml --all-targets --all-features