@coreframe/scripts 0.0.0 → 0.1.0

package/deploy/tauri-release.ts

@@ -0,0 +1,816 @@
+import { randomUUID } from "node:crypto"
+import { constants } from "node:fs"
+import { access, cp, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises"
+import { basename, dirname, join, relative, resolve, sep } from "node:path"
+import { setTimeout as delay } from "node:timers/promises"
+
+import nanoSpawn from "nano-spawn"
+import { glob } from "tinyglobby"
+
+import type { TauriReleaseConfig, TauriReleasePlatform } from "./config.ts"
+import { tauriReleasePlatforms } from "./config.ts"
+
+export type TauriReleaseArgs = {
+  tauriLocalPlatforms: TauriReleasePlatform[]
+  tauriWorkflowPlatforms: TauriReleasePlatform[]
+  tauriWorkflowName?: string
+  tauriWorkflowRef?: string
+}
+
+export type TauriReleasePlan = {
+  artifactDownloadDir: string
+  b2ApplicationKey?: string
+  b2ApplicationKeyId?: string
+  b2Bucket?: string
+  enabled: boolean
+  latestManifestPath: string
+  localPlatforms: TauriReleasePlatform[]
+  platform: Record<TauriReleasePlatform, ResolvedTauriReleasePlatformConfig>
+  publicBaseUrl?: string
+  publicPathPrefix: string
+  releaseNotesPath?: string
+  releasePath: string
+  releaseUploadDir: string
+  signingPrivateKey?: string
+  workflowName: string
+  workflowPlatforms: TauriReleasePlatform[]
+  workflowPollIntervalMs: number
+  workflowRef?: string
+  workflowTimeoutMs: number
+}
+
+export type TauriReleaseMetadataSnapshot = {
+  files: { path: string; source: string }[]
+}
+
+export type PreparedTauriRelease = {
+  manifestPath: string
+  uploadDir: string
+}
+
+type ResolvedTauriReleasePlatformConfig = {
+  artifactGlobs: string[]
+  buildArgs: string[]
+  targetTriple: string
+  updatePlatform: string
+}
+
+type TauriUpdateManifest = {
+  notes?: string
+  platforms: Record<string, { signature: string; url: string }>
+  pub_date: string
+  version: string
+}
+
+const defaultWorkflowName = "tauri-release-artifacts.yml"
+const defaultWorkflowPollIntervalMs = 15_000
+const defaultWorkflowTimeoutMs = 60 * 60_000
+
+const defaultPlatformConfig: Record<TauriReleasePlatform, ResolvedTauriReleasePlatformConfig> = {
+  android: {
+    artifactGlobs: ["tauri/src-tauri/target/**/*.sig", "tauri/gen/android/**/*.sig"],
+    buildArgs: ["tauri", "android", "build", "--target", "aarch64-linux-android"],
+    targetTriple: "aarch64-linux-android",
+    updatePlatform: "android-aarch64",
+  },
+  ios: {
+    artifactGlobs: ["tauri/src-tauri/target/**/*.sig", "tauri/gen/apple/**/*.sig"],
+    buildArgs: ["tauri", "ios", "build", "--target", "aarch64-apple-ios"],
+    targetTriple: "aarch64-apple-ios",
+    updatePlatform: "ios-aarch64",
+  },
+  linux: {
+    artifactGlobs: [
+      "tauri/src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/**/*.sig",
+      "tauri/src-tauri/target/release/bundle/**/*.sig",
+      "tauri/src-tauri/target/**/release/bundle/**/*.sig",
+    ],
+    buildArgs: ["tauri", "build", "--target", "x86_64-unknown-linux-gnu", "--", "--locked"],
+    targetTriple: "x86_64-unknown-linux-gnu",
+    updatePlatform: "linux-x86_64",
+  },
+  macos: {
+    artifactGlobs: [
+      "tauri/src-tauri/target/aarch64-apple-darwin/release/bundle/**/*.sig",
+      "tauri/src-tauri/target/release/bundle/**/*.sig",
+      "tauri/src-tauri/target/**/release/bundle/**/*.sig",
+    ],
+    buildArgs: ["tauri", "build", "--target", "aarch64-apple-darwin", "--", "--locked"],
+    targetTriple: "aarch64-apple-darwin",
+    updatePlatform: "darwin-aarch64",
+  },
+  windows: {
+    artifactGlobs: [
+      "tauri/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/**/*.sig",
+      "tauri/src-tauri/target/release/bundle/**/*.sig",
+      "tauri/src-tauri/target/**/release/bundle/**/*.sig",
+    ],
+    buildArgs: ["tauri", "build", "--target", "x86_64-pc-windows-msvc", "--", "--locked"],
+    targetTriple: "x86_64-pc-windows-msvc",
+    updatePlatform: "windows-x86_64",
+  },
+}
+
+export function parseTauriReleasePlatformList(value: string | undefined) {
+  if (!value) {
+    return []
+  }
+
+  return value
+    .split(/[,\s]+/u)
+    .filter(Boolean)
+    .map((platform) => parseTauriReleasePlatform(platform))
+}
+
+export function parseTauriReleasePlatform(value: string): TauriReleasePlatform {
+  if (isTauriReleasePlatform(value)) {
+    return value
+  }
+
+  throw new Error(
+    `Invalid Tauri release platform "${value}". Expected one of: ${tauriReleasePlatforms.join(", ")}.`,
+  )
+}
+
+export function resolveTauriReleasePlan({
+  args,
+  config = {},
+  env,
+}: {
+  args: TauriReleaseArgs
+  config?: TauriReleaseConfig
+  env: NodeJS.ProcessEnv
+}): TauriReleasePlan {
+  const localPlatforms = uniquePlatforms([
+    ...(config.localPlatforms ?? []),
+    ...parseTauriReleasePlatformList(env.TAURI_RELEASE_LOCAL_PLATFORMS),
+    ...args.tauriLocalPlatforms,
+  ])
+  const workflowPlatforms = uniquePlatforms([
+    ...(config.workflowPlatforms ?? []),
+    ...parseTauriReleasePlatformList(env.TAURI_RELEASE_WORKFLOW_PLATFORMS),
+    ...args.tauriWorkflowPlatforms,
+  ])
+  const duplicatedPlatforms = localPlatforms.filter((platform) =>
+    workflowPlatforms.includes(platform),
+  )
+
+  if (duplicatedPlatforms.length > 0) {
+    throw new Error(
+      `Build each Tauri release platform either locally or through the workflow, not both: ${duplicatedPlatforms.join(", ")}.`,
+    )
+  }
+
+  return {
+    artifactDownloadDir:
+      env.TAURI_RELEASE_ARTIFACT_DOWNLOAD_DIR ??
+      config.artifactDownloadDir ??
+      ".coreframe/tauri-artifacts",
+    b2ApplicationKey: env.B2_APPLICATION_KEY ?? env.B2_SECRET_ACCESS_KEY,
+    b2ApplicationKeyId: env.B2_APPLICATION_KEY_ID ?? env.B2_KEY_ID ?? env.B2_ACCESS_KEY_ID,
+    b2Bucket: config.b2Bucket ?? env.B2_BUCKET,
+    enabled: localPlatforms.length > 0 || workflowPlatforms.length > 0,
+    latestManifestPath:
+      env.TAURI_RELEASE_LATEST_MANIFEST_PATH ?? config.latestManifestPath ?? "latest.json",
+    localPlatforms,
+    platform: resolvePlatformConfig(config.platform, env),
+    publicBaseUrl:
+      config.publicBaseUrl ?? env.TAURI_RELEASE_PUBLIC_BASE_URL ?? env.UPDATE_PUBLIC_BASE_URL,
+    publicPathPrefix:
+      env.TAURI_RELEASE_PUBLIC_PATH_PREFIX ??
+      config.publicPathPrefix ??
+      env.UPDATE_PUBLIC_PATH_PREFIX ??
+      "",
+    releaseNotesPath: env.TAURI_RELEASE_NOTES_FILE ?? config.releaseNotesPath,
+    releasePath: env.TAURI_RELEASE_PATH ?? config.releasePath ?? "releases/${version}",
+    releaseUploadDir: env.TAURI_RELEASE_UPLOAD_DIR ?? config.releaseUploadDir ?? "release-upload",
+    signingPrivateKey: env.TAURI_SIGNING_PRIVATE_KEY,
+    workflowName:
+      args.tauriWorkflowName ??
+      env.TAURI_RELEASE_WORKFLOW_NAME ??
+      config.workflowName ??
+      defaultWorkflowName,
+    workflowPlatforms,
+    workflowPollIntervalMs:
+      parsePositiveInteger(
+        env.TAURI_RELEASE_WORKFLOW_POLL_SECONDS,
+        "TAURI_RELEASE_WORKFLOW_POLL_SECONDS",
+      ) * 1000 ||
+      config.workflowPollIntervalMs ||
+      defaultWorkflowPollIntervalMs,
+    workflowRef: args.tauriWorkflowRef ?? env.TAURI_RELEASE_WORKFLOW_REF ?? config.workflowRef,
+    workflowTimeoutMs:
+      parsePositiveInteger(
+        env.TAURI_RELEASE_WORKFLOW_TIMEOUT_MINUTES,
+        "TAURI_RELEASE_WORKFLOW_TIMEOUT_MINUTES",
+      ) * 60_000 ||
+      config.workflowTimeoutMs ||
+      defaultWorkflowTimeoutMs,
+  }
+}
+
+export async function validateTauriReleasePlan(plan: TauriReleasePlan, cwd = process.cwd()) {
+  if (!plan.enabled) {
+    return
+  }
+
+  const missing = [
+    ["TAURI_RELEASE_PUBLIC_BASE_URL", plan.publicBaseUrl],
+    ["B2_APPLICATION_KEY_ID", plan.b2ApplicationKeyId],
+    ["B2_APPLICATION_KEY", plan.b2ApplicationKey],
+    ["B2_BUCKET", plan.b2Bucket],
+  ].flatMap(([name, value]) => (value ? [] : [name]))
+
+  if (missing.length > 0) {
+    throw new Error(`Missing required Tauri release configuration: ${missing.join(", ")}`)
+  }
+
+  try {
+    new URL(plan.publicBaseUrl as string)
+  } catch {
+    throw new Error(`Invalid TAURI_RELEASE_PUBLIC_BASE_URL: ${plan.publicBaseUrl}`)
+  }
+
+  const tauriConfigPath = join(cwd, "tauri/src-tauri/tauri.conf.json")
+
+  if (!(await pathExists(tauriConfigPath))) {
+    throw new Error(
+      "Tauri release platforms were requested, but tauri/src-tauri/tauri.conf.json does not exist.",
+    )
+  }
+
+  if (plan.localPlatforms.length > 0 && !plan.signingPrivateKey) {
+    throw new Error("TAURI_SIGNING_PRIVATE_KEY is required for local Tauri release builds.")
+  }
+
+  if (plan.workflowPlatforms.length > 0) {
+    await nanoSpawn(
+      "gh",
+      ["workflow", "view", plan.workflowName, "--ref", plan.workflowRef ?? (await currentGitRef())],
+      {
+        stdin: "ignore",
+      },
+    )
+  }
+
+  await nanoSpawn("b2", ["version"], { stdin: "ignore" })
+}
+
+export async function writeTauriReleaseMetadata(
+  plan: TauriReleasePlan,
+  version: string,
+  cwd = process.cwd(),
+): Promise<TauriReleaseMetadataSnapshot> {
+  if (!plan.enabled) {
+    return { files: [] }
+  }
+
+  const tauriConfigPath = join(cwd, "tauri/src-tauri/tauri.conf.json")
+  const cargoManifestPath = join(cwd, "tauri/src-tauri/Cargo.toml")
+  const cargoLockPath = join(cwd, "tauri/src-tauri/Cargo.lock")
+  const tauriConfigSource = await readFile(tauriConfigPath, "utf8")
+  const cargoManifestSource = await readFile(cargoManifestPath, "utf8")
+  const packageName = readCargoPackageName(cargoManifestSource, cargoManifestPath)
+  const files = [
+    { path: tauriConfigPath, source: tauriConfigSource },
+    { path: cargoManifestPath, source: cargoManifestSource },
+  ]
+  const nextFiles = []
+
+  const tauriConfig = JSON.parse(tauriConfigSource) as {
+    bundle?: Record<string, unknown>
+    version?: string
+    [key: string]: unknown
+  }
+
+  tauriConfig.version = version
+  tauriConfig.bundle = {
+    ...(tauriConfig.bundle ?? {}),
+    createUpdaterArtifacts: true,
+  }
+
+  nextFiles.push({ path: tauriConfigPath, source: `${JSON.stringify(tauriConfig, null, 2)}\n` })
+  nextFiles.push({
+    path: cargoManifestPath,
+    source: replaceCargoPackageVersion(
+      cargoManifestSource,
+      packageName,
+      version,
+      cargoManifestPath,
+    ),
+  })
+
+  if (await pathExists(cargoLockPath)) {
+    const cargoLockSource = await readFile(cargoLockPath, "utf8")
+
+    files.push({ path: cargoLockPath, source: cargoLockSource })
+    nextFiles.push({
+      path: cargoLockPath,
+      source: replaceCargoLockPackageVersion(cargoLockSource, packageName, version, cargoLockPath),
+    })
+  }
+
+  for (const file of nextFiles) {
+    await writeFile(file.path, file.source)
+  }
+
+  return { files }
+}
+
+export async function restoreTauriReleaseMetadata(snapshot: TauriReleaseMetadataSnapshot) {
+  for (const file of snapshot.files) {
+    await writeFile(file.path, file.source)
+  }
+}
+
+export async function prepareTauriRelease({
+  env,
+  plan,
+  releaseName,
+  version,
+}: {
+  env: NodeJS.ProcessEnv
+  plan: TauriReleasePlan
+  releaseName: string
+  version: string
+}): Promise<PreparedTauriRelease | undefined> {
+  if (!plan.enabled) {
+    return undefined
+  }
+
+  await resetGeneratedDirectory(plan.artifactDownloadDir)
+  await resetGeneratedDirectory(plan.releaseUploadDir)
+
+  const workflowRun =
+    plan.workflowPlatforms.length > 0
+      ? await startTauriWorkflowBuild({ plan, releaseName, version })
+      : undefined
+
+  for (const platform of plan.localPlatforms) {
+    await buildLocalTauriPlatform(platform, plan, env)
+  }
+
+  if (workflowRun) {
+    const runId = await waitForTauriWorkflowBuild(plan, workflowRun.runNameMarker)
+    await nanoSpawn("gh", ["run", "download", String(runId), "--dir", plan.artifactDownloadDir], {
+      stdio: "inherit",
+    })
+  }
+
+  return createTauriReleaseUpload({ plan, version })
+}
+
+export async function uploadTauriReleaseToB2(
+  plan: TauriReleasePlan,
+  release: PreparedTauriRelease,
+) {
+  await nanoSpawn(
+    "b2",
+    ["account", "authorize", plan.b2ApplicationKeyId as string, plan.b2ApplicationKey as string],
+    { stdin: "ignore" },
+  )
+
+  const files = await glob("**/*", { cwd: release.uploadDir, onlyFiles: true })
+  const sortedFiles = files.sort((left, right) => {
+    if (left === release.manifestPath) {
+      return 1
+    }
+
+    if (right === release.manifestPath) {
+      return -1
+    }
+
+    return left.localeCompare(right)
+  })
+
+  for (const file of sortedFiles) {
+    await nanoSpawn(
+      "b2",
+      ["file", "upload", plan.b2Bucket as string, join(release.uploadDir, file), file],
+      { stdin: "ignore" },
+    )
+    console.log(`Uploaded ${file}`)
+  }
+}
+
+export function createTauriUpdateManifest({
+  artifacts,
+  notes,
+  pubDate = new Date(),
+  version,
+}: {
+  artifacts: { signature: string; updatePlatform: string; url: string }[]
+  notes?: string
+  pubDate?: Date
+  version: string
+}): TauriUpdateManifest {
+  return {
+    ...(notes ? { notes } : {}),
+    platforms: Object.fromEntries(
+      artifacts.map((artifact) => [
+        artifact.updatePlatform,
+        { signature: artifact.signature, url: artifact.url },
+      ]),
+    ),
+    pub_date: pubDate.toISOString(),
+    version,
+  }
+}
+
+export async function createTauriReleaseUpload({
+  plan,
+  version,
+}: {
+  plan: TauriReleasePlan
+  version: string
+}): Promise<PreparedTauriRelease> {
+  const releasePath = joinRemotePath(
+    plan.publicPathPrefix,
+    formatReleasePath(plan.releasePath, version),
+  )
+  const latestManifestPath = joinRemotePath(plan.publicPathPrefix, plan.latestManifestPath)
+  const selectedPlatforms = [...plan.localPlatforms, ...plan.workflowPlatforms]
+  const manifestArtifacts = []
+
+  for (const platform of selectedPlatforms) {
+    const platformConfig = plan.platform[platform]
+    const sourceRoot = plan.localPlatforms.includes(platform)
+      ? "."
+      : join(plan.artifactDownloadDir, `tauri-${platform}-${version}`)
+    const artifactPair = await findTauriUpdateArtifact({
+      globs: plan.localPlatforms.includes(platform) ? platformConfig.artifactGlobs : ["**/*.sig"],
+      sourceRoot,
+      version,
+    })
+    const remoteDir = joinRemotePath(releasePath, platformConfig.updatePlatform)
+    const artifactRemotePath = joinRemotePath(remoteDir, basename(artifactPair.artifactPath))
+    const signatureRemotePath = joinRemotePath(remoteDir, basename(artifactPair.signaturePath))
+    const uploadArtifactPath = join(plan.releaseUploadDir, ...artifactRemotePath.split("/"))
+    const uploadSignaturePath = join(plan.releaseUploadDir, ...signatureRemotePath.split("/"))
+    const signature = (await readFile(artifactPair.signaturePath, "utf8")).trim()
+
+    await mkdir(dirname(uploadArtifactPath), { recursive: true })
+    await cp(artifactPair.artifactPath, uploadArtifactPath)
+    await cp(artifactPair.signaturePath, uploadSignaturePath)
+    manifestArtifacts.push({
+      signature,
+      updatePlatform: platformConfig.updatePlatform,
+      url: joinPublicUrl(plan.publicBaseUrl as string, artifactRemotePath),
+    })
+  }
+
+  const notes = plan.releaseNotesPath ? await readFile(plan.releaseNotesPath, "utf8") : undefined
+  const manifest = createTauriUpdateManifest({ artifacts: manifestArtifacts, notes, version })
+  const manifestPath = join(plan.releaseUploadDir, ...latestManifestPath.split("/"))
+
+  await mkdir(dirname(manifestPath), { recursive: true })
+  await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`)
+
+  return {
+    manifestPath: latestManifestPath,
+    uploadDir: plan.releaseUploadDir,
+  }
+}
+
+async function startTauriWorkflowBuild({
+  plan,
+  releaseName,
+  version,
+}: {
+  plan: TauriReleasePlan
+  releaseName: string
+  version: string
+}) {
+  const ref = plan.workflowRef ?? (await currentGitRef())
+  const runNameMarker = `coreframe-${Date.now()}-${randomUUID().slice(0, 8)}`
+
+  await nanoSpawn(
+    "gh",
+    [
+      "workflow",
+      "run",
+      plan.workflowName,
+      "--ref",
+      ref,
+      "-f",
+      `release_name=${releaseName}`,
+      "-f",
+      `run_id=${runNameMarker}`,
+      "-f",
+      `version=${version}`,
+      ...tauriReleasePlatforms.flatMap((platform) => [
+        "-f",
+        `${platform}=${plan.workflowPlatforms.includes(platform) ? "true" : "false"}`,
+      ]),
+    ],
+    { stdin: "ignore" },
+  )
+
+  return { runNameMarker }
+}
+
+async function waitForTauriWorkflowBuild(plan: TauriReleasePlan, runNameMarker: string) {
+  const deadline = Date.now() + plan.workflowTimeoutMs
+
+  while (Date.now() < deadline) {
+    const run = await findTauriWorkflowRun(plan, runNameMarker)
+
+    if (run?.status === "completed") {
+      if (run.conclusion === "success") {
+        return run.databaseId
+      }
+
+      throw new Error(`Tauri release workflow ${run.databaseId} finished with ${run.conclusion}.`)
+    }
+
+    await delay(plan.workflowPollIntervalMs)
+  }
+
+  throw new Error(
+    `Timed out waiting for Tauri release workflow after ${Math.round(plan.workflowTimeoutMs / 60_000)} minutes.`,
+  )
+}
+
+async function findTauriWorkflowRun(plan: TauriReleasePlan, runNameMarker: string) {
+  const { stdout } = await nanoSpawn(
+    "gh",
+    [
+      "run",
+      "list",
+      "--workflow",
+      plan.workflowName,
+      "--event",
+      "workflow_dispatch",
+      "--json",
+      "conclusion,databaseId,displayTitle,status",
+      "--limit",
+      "50",
+    ],
+    { stdin: "ignore" },
+  )
+  const runs = JSON.parse(stdout) as {
+    conclusion: string | null
+    databaseId: number
+    displayTitle: string
+    status: string
+  }[]
+
+  return runs.find((run) => run.displayTitle.includes(runNameMarker))
+}
+
+async function buildLocalTauriPlatform(
+  platform: TauriReleasePlatform,
+  plan: TauriReleasePlan,
+  env: NodeJS.ProcessEnv,
+) {
+  await nanoSpawn("pnpm", plan.platform[platform].buildArgs, {
+    env,
+    stdio: "inherit",
+  })
+}
+
+async function findTauriUpdateArtifact({
+  globs,
+  sourceRoot,
+  version,
+}: {
+  globs: string[]
+  sourceRoot: string
+  version: string
+}) {
+  const signaturePaths = await glob(globs, { cwd: sourceRoot, absolute: true, onlyFiles: true })
+  const candidatePairs = []
+
+  for (const signaturePath of signaturePaths) {
+    const artifactPath = signaturePath.replace(/\.sig$/u, "")
+
+    if (await isFile(artifactPath)) {
+      candidatePairs.push({ artifactPath, signaturePath })
+    }
+  }
+
+  if (candidatePairs.length === 0) {
+    throw new Error(`Could not find a Tauri updater artifact and .sig pair under ${sourceRoot}.`)
+  }
+
+  return candidatePairs.sort((left, right) => {
+    const leftScore = artifactScore(left.artifactPath, version)
+    const rightScore = artifactScore(right.artifactPath, version)
+
+    return rightScore - leftScore || left.artifactPath.localeCompare(right.artifactPath)
+  })[0]
+}
+
+function artifactScore(path: string, version: string) {
+  let score = 0
+
+  if (path.includes(version)) {
+    score += 100
+  }
+
+  if (/\.(app\.tar\.gz|AppImage\.tar\.gz|zip)$/u.test(path)) {
+    score += 10
+  }
+
+  if (/\.(exe|msi|dmg|AppImage|deb|rpm|apk|aab|ipa)$/u.test(path)) {
+    score += 5
+  }
+
+  return score
+}
+
+function resolvePlatformConfig(
+  config: TauriReleaseConfig["platform"] = {},
+  env: NodeJS.ProcessEnv,
+): Record<TauriReleasePlatform, ResolvedTauriReleasePlatformConfig> {
+  return Object.fromEntries(
+    tauriReleasePlatforms.map((platform) => {
+      const override = config[platform] ?? {}
+      const platformConfig = {
+        ...defaultPlatformConfig[platform],
+        ...override,
+      }
+      const envTargetTriple = env[`TAURI_RELEASE_${platform.toUpperCase()}_TARGET_TRIPLE`]
+      const envUpdatePlatform = env[`TAURI_RELEASE_${platform.toUpperCase()}_UPDATE_PLATFORM`]
+      const targetTriple = envTargetTriple ?? platformConfig.targetTriple
+      const buildArgs = override.buildArgs
+        ? override.buildArgs
+        : defaultBuildArgs(platform, targetTriple)
+
+      return [
+        platform,
+        {
+          ...platformConfig,
+          artifactGlobs:
+            platformConfig.artifactGlobs ?? defaultPlatformConfig[platform].artifactGlobs,
+          buildArgs,
+          targetTriple,
+          updatePlatform: envUpdatePlatform ?? platformConfig.updatePlatform,
+        },
+      ]
+    }),
+  ) as Record<TauriReleasePlatform, ResolvedTauriReleasePlatformConfig>
+}
+
+function defaultBuildArgs(platform: TauriReleasePlatform, targetTriple: string) {
+  if (platform === "android") {
+    return ["tauri", "android", "build", "--target", targetTriple]
+  }
+
+  if (platform === "ios") {
+    return ["tauri", "ios", "build", "--target", targetTriple]
+  }
+
+  return ["tauri", "build", "--target", targetTriple, "--", "--locked"]
+}
+
+function readCargoPackageName(source: string, path: string) {
+  const match = /^\[package\][\s\S]*?^name = "(?<name>[^"]+)"/mu.exec(source)
+
+  if (!match?.groups?.name) {
+    throw new Error(`${path} is missing a [package] name.`)
+  }
+
+  return match.groups.name
+}
+
+function replaceCargoPackageVersion(
+  source: string,
+  packageName: string,
+  version: string,
+  path: string,
+) {
+  const pattern = new RegExp(
+    `(^\\[package\\][\\s\\S]*?^name = "${escapeRegExp(packageName)}"[\\s\\S]*?^version = ")[^"]+(")`,
+    "mu",
+  )
+  const nextSource = source.replace(pattern, `$1${version}$2`)
+
+  if (nextSource === source) {
+    throw new Error(`${path} is missing a package version for ${packageName}.`)
+  }
+
+  return nextSource
+}
+
+function replaceCargoLockPackageVersion(
+  source: string,
+  packageName: string,
+  version: string,
+  path: string,
+) {
+  const pattern = new RegExp(
+    `(\\[\\[package\\]\\]\\nname = "${escapeRegExp(packageName)}"\\nversion = ")[^"]+(")`,
+    "u",
+  )
+  const nextSource = source.replace(pattern, `$1${version}$2`)
+
+  if (nextSource === source) {
+    throw new Error(`${path} is missing a package lock entry for ${packageName}.`)
+  }
+
+  return nextSource
+}
+
+async function currentGitRef() {
+  const { stdout: branch } = await nanoSpawn("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    stdin: "ignore",
+  })
+  const trimmedBranch = branch.trim()
+
+  if (trimmedBranch !== "HEAD") {
+    return trimmedBranch
+  }
+
+  const { stdout: commit } = await nanoSpawn("git", ["rev-parse", "HEAD"], {
+    stdin: "ignore",
+  })
+
+  return commit.trim()
+}
+
+async function resetGeneratedDirectory(path: string) {
+  assertSafeGeneratedDirectory(path)
+  await rm(path, { force: true, recursive: true })
+  await mkdir(path, { recursive: true })
+}
+
+function assertSafeGeneratedDirectory(path: string) {
+  const resolvedPath = resolve(path)
+  const relativePath = relative(process.cwd(), resolvedPath).split(sep).join("/")
+
+  if (
+    relativePath === "" ||
+    relativePath === "." ||
+    relativePath.startsWith("../") ||
+    relativePath === "tauri" ||
+    relativePath.startsWith("tauri/")
+  ) {
+    throw new Error(`Refusing to reset unsafe Tauri release directory: ${path}`)
+  }
+}
+
+function formatReleasePath(template: string, version: string) {
+  return template.replaceAll("${version}", version)
+}
+
+function joinPublicUrl(baseUrl: string, remotePath: string) {
+  const url = new URL(baseUrl)
+  const basePath = url.pathname.replace(/\/+$/u, "")
+  const nextPath = joinRemotePath(basePath, remotePath)
+
+  url.pathname = nextPath.startsWith("/") ? nextPath : `/${nextPath}`
+
+  return url.toString()
+}
+
+function joinRemotePath(...parts: string[]) {
+  return parts
+    .flatMap((part) => part.split("/"))
+    .map((part) => part.trim())
+    .filter(Boolean)
+    .join("/")
+}
+
+function parsePositiveInteger(value: string | undefined, name: string) {
+  if (!value) {
+    return 0
+  }
+
+  const parsed = Number(value)
+
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`${name} must be a positive integer.`)
+  }
+
+  return parsed
+}
+
+function uniquePlatforms(platforms: TauriReleasePlatform[]) {
+  return [...new Set(platforms)]
+}
+
+function isTauriReleasePlatform(value: string): value is TauriReleasePlatform {
+  return (tauriReleasePlatforms as readonly string[]).includes(value)
+}
+
+async function pathExists(path: string) {
+  try {
+    await access(path, constants.F_OK)
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function isFile(path: string) {
+  try {
+    return (await stat(path)).isFile()
+  } catch {
+    return false
+  }
+}
+
+function escapeRegExp(value: string) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")
+}