Menu
Expert guide for setting up Tauri deployment pipelines with GitHub Actions, code signing, and Oasis update server integration.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Expert guide for building AI-powered applications with the Glove framework. Use when working with glove-core, glove-react, glove-next, tools, display stack, model adapters, stores, or any Glove example project.
Expert guide for integrating Oasis update server with Tauri apps for auto-updates, crash reporting, and feedback collection.
Expert guide for integrating Oasis into Tauri applications. Use when working with oasis-sdk, auto-updates, crash reporting, user feedback, release workflows, or any Oasis-powered Tauri project.
Expert guide for bumping versions, creating git tags, and managing releases for Tauri and Node.js projects.
| name | tauri-deployment-setup |
| description | Expert guide for setting up Tauri deployment pipelines with GitHub Actions, code signing, and Oasis update server integration. |
You are an expert on Tauri deployment pipelines. Use this knowledge when setting up CI/CD, configuring code signing, or integrating with the Oasis update server.
A comprehensive deployment system for Tauri desktop applications that handles multi-platform builds, code signing, artifact storage, and automatic updates.
Reusable workflow: porkytheblack/oasis/.github/workflows/tauri-release.yml@main
This project's workflow: .github/workflows/release.yaml
Developer pushes tag → GitHub Actions triggers
↓
┌─────────────────────┴─────────────────────┐
↓ ↓ ↓
macOS Build Windows Build Linux Build
(Apple signed) (optional sign) (AppImage)
↓ ↓ ↓
└─────────────────────┬─────────────────────┘
↓
Tauri Update Signing
↓
┌─────────────────────┼─────────────────────┐
↓ ↓ ↓
Upload to R2 Register with Oasis GitHub Release
(CDN storage) (update manifest) (user downloads)
pnpm add -D @tauri-apps/cli
npx @tauri-apps/cli signer generate -w ~/.tauri/keys/your-app.key
# Save the public key for tauri.conf.json
# Save the private key as TAURI_SIGNING_PRIVATE_KEY secret
# .github/workflows/release.yaml
name: Release
on:
push:
tags: ["v*"]
permissions:
contents: write
jobs:
release:
uses: porkytheblack/oasis/.github/workflows/tauri-release.yml@main
with:
app_slug: your-app
app_name: Your App
artifact_prefix: YourApp
app_dir: app
distribute_to: r2,oasis,github
secrets:
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
APPLE_ID: ${{ secrets.APPLE_ID }}
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
CLOUDFLARE_R2_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
CLOUDFLARE_R2_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
R2_BUCKET_NAME: ${{ secrets.R2_BUCKET_NAME }}
OASIS_SERVER_URL: ${{ secrets.OASIS_SERVER_URL }}
OASIS_CI_KEY: ${{ secrets.OASIS_CI_KEY }}
{
"plugins": {
"updater": {
"pubkey": "YOUR_PUBLIC_KEY_HERE",
"endpoints": [
"https://oasis.yourdomain.com/{app_slug}/update/{{target}}-{{arch}}/{{current_version}}"
]
}
}
}
./app/scripts/bump-version.sh patch
git push && git push --tags
| File | Format | Location |
|---|---|---|
package.json | "version": "X.Y.Z" | App root |
tauri.conf.json | "version": "X.Y.Z" | src-tauri/ |
Cargo.toml | version = "X.Y.Z" | src-tauri/ |
| Status bar | vX.Y.Z display | UI component |
Use ./app/scripts/bump-version.sh to update all files automatically.
| Target | Purpose | When to Use |
|---|---|---|
github | GitHub Releases page | User downloads, changelog |
r2 | Cloudflare R2 CDN | Fast artifact delivery |
oasis | Update server | Auto-update manifests |
Combine with comma: distribute_to: r2,oasis,github
| Secret | Description |
|---|---|
APPLE_CERTIFICATE | Base64-encoded .p12 certificate |
APPLE_CERTIFICATE_PASSWORD | Certificate password |
APPLE_SIGNING_IDENTITY | e.g., "Developer ID Application: Your Name" |
APPLE_ID | Apple ID email |
APPLE_PASSWORD | App-specific password (not Apple ID password) |
APPLE_TEAM_ID | 10-character Team ID |
| Secret | Description |
|---|---|
TAURI_SIGNING_PRIVATE_KEY | Private key from signer generate |
TAURI_SIGNING_PRIVATE_KEY_PASSWORD | Password used during generation |
| Secret | Description |
|---|---|
CLOUDFLARE_ACCOUNT_ID | Account ID from dashboard |
CLOUDFLARE_R2_ACCESS_KEY_ID | R2 API token ID |
CLOUDFLARE_R2_SECRET_ACCESS_KEY | R2 API token secret |
R2_BUCKET_NAME | Bucket name |
| Secret | Description |
|---|---|
OASIS_SERVER_URL | e.g., https://oasis.yourdomain.com |
OASIS_CI_KEY | CI authentication key |
Add to capabilities/default.json:
{
"permissions": [
"core:default",
"core:window:default",
"core:window:allow-start-dragging",
"shell:default",
"shell:allow-open",
"dialog:default",
"fs:default",
"http:default",
"updater:default",
"updater:allow-check",
"updater:allow-download-and-install",
"process:default",
"process:allow-restart"
]
}
| Action | Command |
|---|---|
| Bump patch | ./app/scripts/bump-version.sh patch |
| Bump minor | ./app/scripts/bump-version.sh minor |
| Bump major | ./app/scripts/bump-version.sh major |
| Set version | ./app/scripts/bump-version.sh --set 2.0.0 |
| Preview | ./app/scripts/bump-version.sh patch --dry-run |
| Push release | git push && git push --tags |
| Redeploy | ./app/scripts/redeploy.sh |
tauri.conf.json and the GitHub secret.R2_PUBLIC_URL as a repository variable (not secret) for the CDN base URL.v* tags. Use v0.1.0, not 0.1.0.contents: write permission for creating GitHub releases.workflow_dispatch with dry_run: true to test without uploading.