* ignore build files.
* feat: macOS native app — Tauri shell, runtime pack, MPS, CI pipeline
- Tauri 2 macOS app with setup wizard that downloads and installs a
self-contained Python/backend runtime pack on first launch
- Runtime pack download now streams via reqwest with real-time progress
events (runtime-download-progress) replacing the blocking curl call;
progress bar shown in setup UI with indeterminate fallback
- MPS (Apple Silicon) GPU detection and torch device selection; CUDA
path gated to non-macOS targets
- macOS data dir uses ~/Library/Application Support/StemDeck
- macOS FFmpeg downloaded from evermeet.cx and extracted from zip
- Backend watchdog: Python process exits when parent Tauri PID disappears
- CloseRequested handler stops backend and exits cleanly
- Woodpecker CI pipeline for macOS: arm64 and x64 builds in parallel,
DMG inspection, artifact upload to GitHub releases
- Build scripts: make-runtime-pack.sh, make-app.sh, make-dmg.sh,
make-iconset.sh with LOCAL_DEV_TEST version default
- Version stamped from CI_COMMIT_TAG (or LOCAL_DEV_TEST) at build time
across Cargo.toml, tauri.conf.json, package.json
- SVG logo assets, DMG packaging files, macOS README and notices
- README updated with macOS download and build instructions
- Bump version to 0.4.0-alpha.1
* fix(security): bump urllib3 to 2.7.0, ignore unresolvable torch x86 CVE
- urllib3 2.7.0 fixes CVE-2026-44431 (header forwarding) and
CVE-2026-44432 (decompression-bomb bypass)
- CVE-2025-32434 (torch 2.2.2 RCE via torch.load) added to
.trivyignore: no 2.6.x macOS x86_64 wheels exist; StemDeck
has no untrusted torch.load path
- Wire .trivyignore into the trivy-fs CI step
* ci: trigger macOS and Windows builds on tag push and release
Adds event: tag so that pushing a version tag (e.g. v0.4.0-alpha.1
for a pre-release) triggers the build and inspect pipeline.
Upload steps remain gated on event: release only.
* ci: skip asset upload if already present on pre-release promotion
When a pre-release is promoted to latest, GitHub fires a second
release event. The upload step now checks if assets already exist
for the tag and exits early, preventing --clobber from deleting
and re-uploading artifacts during the promotion window.
Tha.Les
f08b6367b8
