release 1.3.2: update from Gitea, Linux-only CLI, desktop app for Linux and Windows

The updater reads latest.json from Gitea, built by scripts/make-latest-json.py
against the Gitea API (no gh CLI). Release workflow builds the Linux CLI and
the Linux+Windows desktop app, signs the updater artifacts and attaches
everything to the release.

Needs the repo secrets TAURI_SIGNING_PRIVATE_KEY and
TAURI_SIGNING_PRIVATE_KEY_PASSWORD, which I could not set (secret-store writes
are reserved for the user) - set them from ~/.tauri/guara-updater.key and
.pass before pushing a tag.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -1,14 +1,25 @@
 name: Release
 
-# Cria a entrada em "Releases" quando uma tag v* é enviada, com as notas da
-# seção correspondente do CHANGELOG.md (scripts/release-notes.sh).
+# Quando uma tag v* é enviada: cria a entrada em "Releases" com as notas do
+# CHANGELOG.md, compila o CLI (Linux x86_64 e aarch64) e o app desktop (Linux
+# e Windows, este por compilação cruzada com cargo-xwin), e monta o
+# latest.json que o atualizador do app lê.
 #
-# Só as notas: os binários para macOS e Windows exigiam runners que o Gitea daqui
-# não tem (o único runner é Linux arm64), então não são gerados neste fluxo.
+# Sem macOS: o Tauri precisa do SDK e da assinatura da Apple, presos a
+# hardware Apple e a uma conta de desenvolvedor, que este runner não tem.
+#
+# Segredos de usuário necessários: REGISTRY_TOKEN (não usado aqui, fica para o
+# registro de containers de outros projetos), TAURI_SIGNING_PRIVATE_KEY e
+# TAURI_SIGNING_PRIVATE_KEY_PASSWORD (assinam os pacotes para o atualizador).
 on:
   push:
     tags: ['v*']
 
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_HOME: /opt/hostedtoolcache/cargo
+  RUSTUP_HOME: /opt/hostedtoolcache/rustup
+
 jobs:
   release:
     name: Cria a release
@@ -23,9 +34,99 @@ jobs:
           TOKEN: ${{ gitea.token }}
           API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
         run: |
+          # Uma execução repetida não recria a release.
+          if curl -fsS -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" >/dev/null 2>&1; then
+            echo "a release $TAG já existe"; exit 0
+          fi
           scripts/release-notes.sh "$TAG" > notes.md
           pre=false; case "$TAG" in *-*) pre=true ;; esac
           jq -n --arg tag "$TAG" --arg name "Guará ${TAG#v}" --rawfile body notes.md --argjson pre "$pre" \
             '{tag_name:$tag, name:$name, body:$body, prerelease:$pre}' > release.json
           curl -fsS -X POST "$API/releases" -H "Authorization: token $TOKEN" \
-            -H 'Content-Type: application/json' -d @release.json
+            -H 'Content-Type: application/json' -d @release.json >/dev/null
+
+  cli:
+    name: CLI (${{ matrix.platform }})
+    needs: release
+    runs-on: ubuntu-latest
+    env:
+      CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-release-cli
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { platform: linux-aarch64, target: aarch64-unknown-linux-gnu, apt: "" }
+          - { platform: linux-x86_64, target: x86_64-unknown-linux-gnu, apt: "gcc-x86-64-linux-gnu" }
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - name: Linker desta plataforma
+        if: ${{ matrix.apt != '' }}
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq ${{ matrix.apt }}
+      - name: Compila e empacota
+        run: scripts/package-cli.sh "${{ gitea.ref_name }}" "${{ matrix.platform }}" "${{ matrix.target }}" | tee packages.txt
+      - name: Anexa à release
+        env:
+          TOKEN: ${{ gitea.token }}
+          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
+        run: scripts/release-upload.sh "${{ gitea.ref_name }}" $(cat packages.txt)
+
+  gui:
+    name: App desktop (${{ matrix.platform }})
+    needs: release
+    runs-on: ubuntu-latest
+    env:
+      CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-release-gui
+      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [linux, windows]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Dependências do Tauri (Linux)
+        if: matrix.platform == 'linux'
+        timeout-minutes: 25
+        run: scripts/apt-install.sh ~/apt-cache libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
+      - name: Ferramentas para compilação cruzada (Windows)
+        if: matrix.platform == 'windows'
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq nsis lld llvm clang
+          command -v cargo-xwin >/dev/null || cargo install cargo-xwin --locked
+      - name: Compila e empacota
+        run: scripts/build-gui.sh "${{ matrix.platform }}"
+      - name: Anexa à release
+        env:
+          TOKEN: ${{ gitea.token }}
+          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
+        run: scripts/release-upload.sh "${{ gitea.ref_name }}" dist-gui/*
+
+  atualizador:
+    name: Monta o latest.json
+    needs: gui
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: latest.json
+        env:
+          TAG: ${{ gitea.ref_name }}
+          TOKEN: ${{ gitea.token }}
+          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
+        run: |
+          scripts/release-notes.sh "$TAG" > notes.md
+          python3 scripts/make-latest-json.py "$TAG" notes.md latest.json
+      - name: Anexa à release
+        env:
+          TOKEN: ${{ gitea.token }}
+          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
+        run: scripts/release-upload.sh "${{ gitea.ref_name }}" latest.json