[Feature] Configure Tauri Updater for ODP Desktop Latest Release Tag (#7240)

* configure the updater and some fix some macos tahoe css errors

* enclosure for title_bar_style on Window build

* those should have been added to the commit

* test update to 0.6.0

* allow unused mut

* update version in tauri.conf

* fix versioned release draft

* fix windows beforeBundle script

* force app restart on update

* fix release build

* fix latest tag files

* latest tag title

* try testing for windows ARM

* improve build workflow cleanup for cache

* actually use the windows-11-arm runner

* copy and bundle openssl items directly from runner

* we actually need those files as placeholders for linters and unit tests

* no need to rebuild assets when converting draft to published

* fix verbosity

* fix windows openssl dir

* converting draft release to published should not run the build workflows

* converting draft release to published should not run the build workflows

* separate release draft build from publish

* release dekstop dispatch

* release dekstop dispatch

* fix dylibs

* undo fix_dylib change and attempt to handle restart on update

* move restart exit code up

* bump version to test updater restarting

* windows updater signature

* positional argument..?

* arg is --password

* try this for mac updater

* add message to updater to inform users to start the app manually after update

* add toast message for first API run

* get windows to open the window after updating..?

* cargo clippy

* update package locks for vite

* fix css thing

* version bump for another test

* bump for v 1

---------

Co-authored-by: deeleeramone <>

.github/workflows/build-desktop-osx64.yml

@@ -7,6 +7,13 @@ on:
         required: false
         type: boolean
         default: false
+  workflow_dispatch:
+    inputs:
+      release:
+        description: 'Set to true to create a release build'
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   build-and-sign:
@@ -30,9 +37,6 @@ jobs:
           p12-file-base64: ${{ secrets.MACOS_CERTIFICATE }}
           p12-password: ${{ secrets.MACOS_CERTIFICATE_PWD }}
 
-      - name: Install OpenSSL
-        run: brew install openssl
-
       - name: Setup Cargo Cache
         uses: actions/cache@v4
         with:
@@ -107,6 +111,10 @@ jobs:
             desktop/target/release/bundle/macos/*.app.tar.gz
             desktop/target/release/bundle/macos/*.app.tar.gz.sig
 
-      - name: Cleanup Artifacts
+      - name: Clean old bundle artifacts
         if: always()
-        run: cargo clean
+        run: |
+          bundlePath="${{ github.workspace }}/desktop/target/release/bundle"
+          if [ -d "$bundlePath" ]; then
+            rm -rf "$bundlePath"
+          fi

.github/workflows/build-desktop-osxARM.yml

@@ -7,6 +7,13 @@ on:
         required: false
         type: boolean
         default: false
+  workflow_dispatch:
+    inputs:
+      release:
+        description: 'Set to true to create a release build'
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   build-and-sign:
@@ -20,20 +27,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
-      - name: Debug - List files
-        run: |
-          echo "Current directory:"
-          pwd
-          echo "Files in current directory:"
-          ls -la
-          echo "Files in src-tauri:"
-          ls -la src-tauri/
-          echo "Files in src-tauri/scripts:"
-          ls -la src-tauri/scripts/ || echo "scripts directory does not exist"
-          echo "Looking for fix_dylibs.sh:"
-          find . -name "fix_dylibs.sh" -type f || echo "fix_dylibs.sh not found"
-
-
       - name: Import Code Signing Certificate
         uses: apple-actions/import-codesign-certs@v3
         env:
@@ -44,9 +37,6 @@ jobs:
           p12-file-base64: ${{ secrets.MACOS_CERTIFICATE }}
           p12-password: ${{ secrets.MACOS_CERTIFICATE_PWD }}
 
-      - name: Install OpenSSL
-        run: brew install openssl
-
       - name: Setup Cargo Cache
         uses: actions/cache@v4
         with:
@@ -122,6 +112,10 @@ jobs:
             desktop/target/release/bundle/macos/*.app.tar.gz
             desktop/target/release/bundle/macos/*.app.tar.gz.sig
 
-      - name: Cleanup Artifacts
+      - name: Clean old bundle artifacts
         if: always()
-        run: cargo clean
+        run: |
+          bundlePath="${{ github.workspace }}/desktop/target/release/bundle"
+          if [ -d "$bundlePath" ]; then
+            rm -rf "$bundlePath"
+          fi

.github/workflows/build-desktop-win64.yml

@@ -7,6 +7,13 @@ on:
         required: false
         type: boolean
         default: false
+  workflow_dispatch:
+    inputs:
+      release:
+        description: 'Set to true to create a release build'
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   build-and-sign:
@@ -40,16 +47,75 @@ jobs:
 
       - name: Install OpenSSL using vcpkg
         working-directory: ${{ github.workspace }}
-        run: ${{ env.VCPKG_ROOT }}/vcpkg install openssl:x64-windows-static --vcpkg-root ${{ env.VCPKG_ROOT }}
+        run: ${{ env.VCPKG_ROOT }}/vcpkg install openssl:x64-windows --vcpkg-root ${{ env.VCPKG_ROOT }}
         env:
-          VCPKG_DEFAULT_TRIPLET: x64-windows-static
+          VCPKG_DEFAULT_TRIPLET: x64-windows
 
       - name: Set OpenSSL env
         shell: bash
         run: |
-          echo "OPENSSL_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows-static" >> $GITHUB_ENV
-          echo "OPENSSL_INCLUDE_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows-static/include" >> $GITHUB_ENV
-          echo "OPENSSL_LIB_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows-static/lib" >> $GITHUB_ENV
+          echo "OPENSSL_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows" >> $GITHUB_ENV
+          echo "OPENSSL_INCLUDE_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows/include" >> $GITHUB_ENV
+          echo "OPENSSL_LIB_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows/lib" >> $GITHUB_ENV
+
+      - name: Copy SSL DLLs
+        shell: pwsh
+        run: |
+          # Verify OpenSSL DLLs exist
+          $opensslBinDir = "${{ env.VCPKG_ROOT }}/installed/x64-windows/bin"
+          $libcryptoPath = Join-Path $opensslBinDir "libcrypto-3-x64.dll"
+          $libsslPath = Join-Path $opensslBinDir "libssl-3-x64.dll"
+
+          if (-not (Test-Path $libcryptoPath)) {
+            Write-Error "Error: libcrypto-3-x64.dll not found at $libcryptoPath"
+            exit 1
+          }
+          if (-not (Test-Path $libsslPath)) {
+            Write-Error "Error: libssl-3-x64.dll not found at $libsslPath"
+            exit 1
+          }
+
+          # Copy DLLs to src-tauri folder
+          Copy-Item -Path $libcryptoPath -Destination "src-tauri/" -Force
+          Copy-Item -Path $libsslPath -Destination "src-tauri/" -Force
+          Write-Host "Successfully copied OpenSSL DLLs to src-tauri/"
+          Get-ChildItem -Path "src-tauri/"
+
+      - name: Create temp directory for signing DLLs
+        shell: pwsh
+        run: New-Item -ItemType Directory -Force -Path "${{ github.workspace }}/desktop/temp-sign-dlls"
+
+      - name: Sign libcrypto DLL
+        uses: sslcom/esigner-codesign@develop
+        with:
+          command: sign
+          username: ${{ secrets.ESIGNER_USERNAME }}
+          password: ${{ secrets.ESIGNER_PASSWORD }}
+          credential_id: ${{ secrets.ESIGNER_CREDENTIAL_ID }}
+          totp_secret: ${{ secrets.ESIGNER_TOTP_SECRET }}
+          file_path: ${{ github.workspace }}/desktop/src-tauri/libcrypto-3-x64.dll
+          output_path: ${{ github.workspace }}/desktop/temp-sign-dlls
+          malware_block: false
+
+      - name: Sign libssl DLL
+        uses: sslcom/esigner-codesign@develop
+        with:
+          command: sign
+          username: ${{ secrets.ESIGNER_USERNAME }}
+          password: ${{ secrets.ESIGNER_PASSWORD }}
+          credential_id: ${{ secrets.ESIGNER_CREDENTIAL_ID }}
+          totp_secret: ${{ secrets.ESIGNER_TOTP_SECRET }}
+          file_path: ${{ github.workspace }}/desktop/src-tauri/libssl-3-x64.dll
+          output_path: ${{ github.workspace }}/desktop/temp-sign-dlls
+          malware_block: false
+
+      - name: Replace unsigned DLLs with signed ones
+        shell: pwsh
+        run: |
+          Copy-Item -Path "${{ github.workspace }}/desktop/temp-sign-dlls/libcrypto-3-x64.dll" -Destination "${{ github.workspace }}/desktop/src-tauri/libcrypto-3-x64.dll" -Force
+          Copy-Item -Path "${{ github.workspace }}/desktop/temp-sign-dlls/libssl-3-x64.dll" -Destination "${{ github.workspace }}/desktop/src-tauri/libssl-3-x64.dll" -Force
+          Write-Host "Successfully replaced unsigned DLLs with signed versions"
+          Get-ChildItem -Path "${{ github.workspace }}/desktop/src-tauri/*.dll"
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
@@ -60,10 +126,7 @@ jobs:
         run: npm install -g @cyclonedx/cyclonedx-npm
 
       - name: Set up Rust
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          profile: minimal
+        uses: dtolnay/rust-toolchain@stable
 
       - name: Cache cargo registry
         uses: actions/cache@v4
@@ -97,6 +160,14 @@ jobs:
             Move-Item "src-tauri/openbb-platform.cdx.xml" "src-tauri/open-data-platform-SBOM-cargo.cdx.xml" -Force
           }
 
+      - name: Clean old bundle artifacts
+        shell: pwsh
+        run: |
+          $bundlePath = "${{ github.workspace }}/desktop/target/x86_64-pc-windows-msvc/release/bundle"
+          if (Test-Path $bundlePath) {
+            Remove-Item -Path $bundlePath -Recurse -Force
+          }
+
       - name: Build Tauri App (without bundling)
         run: npm run tauri build -- --target x86_64-pc-windows-msvc --no-bundle
         env:
@@ -112,7 +183,7 @@ jobs:
         run: New-Item -ItemType Directory -Force -Path "${{ github.workspace }}/desktop/temp-sign"
 
       - name: Sign the executable
-        uses: sslcom/esigner-codesign@v1.3.1
+        uses: sslcom/esigner-codesign@develop
         with:
           command: sign
           username: ${{ secrets.ESIGNER_USERNAME }}
@@ -162,11 +233,21 @@ jobs:
         shell: pwsh
         run: |
           $version = (Get-Content src-tauri/tauri.conf.json | ConvertFrom-Json).version
-          $sigFile = (Get-ChildItem -Path "${{ github.workspace }}/desktop/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.sig").FullName
-          Copy-Item -Path $sigFile -Destination "${{ github.workspace }}/desktop/signed-installer/"
-          cd ${{ github.workspace }}/desktop/signed-installer
-          Get-ChildItem -Path "*.exe" | Rename-Item -NewName "Open-Data-Platform_${version}_x86_64.exe"
-          Get-ChildItem -Path "*.sig" | Rename-Item -NewName "Open-Data-Platform_${version}_x86_64.exe.sig"
+          $signedInstaller = Get-ChildItem -Path "${{ github.workspace }}/desktop/signed-installer/*.exe" | Select-Object -First 1
+          Rename-Item -Path $signedInstaller.FullName -NewName "Open-Data-Platform_${version}_x86_64.exe"
+
+      - name: Regenerate updater signature
+        shell: pwsh
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          $version = (Get-Content src-tauri/tauri.conf.json | ConvertFrom-Json).version
+          $installerPath = Join-Path "${{ github.workspace }}/desktop/signed-installer" "Open-Data-Platform_${version}_x86_64.exe"
+          npm exec -- tauri signer sign `
+            $installerPath `
+            --private-key $env:TAURI_SIGNING_PRIVATE_KEY `
+            --password $env:TAURI_SIGNING_PRIVATE_KEY_PASSWORD
 
       - name: Upload Artifacts
         uses: actions/upload-artifact@v4

.github/workflows/draft-release.yml

@@ -1,54 +1,76 @@
-name: 📝 Draft release changelog
+name: Build Desktop Draft Release
 
 on:
   workflow_dispatch:
     inputs:
-      release_pr_number:
-        description: "Previous Release PR Number"
-        required: true
-        default: ""
-      tag:
-        description: "Tag for release (manual input)"
-        required: true
-        default: ""
+      draft:
+        description: "Create as draft release"
+        required: false
+        default: true
+        type: boolean
 
 jobs:
-  update_release_draft:
+  build-windows:
+    uses: ./.github/workflows/build-desktop-win64.yml
+    with:
+      release: true
+    secrets: inherit
+    permissions:
+      contents: write
+
+  build-macos-arm:
+    uses: ./.github/workflows/build-desktop-osxARM.yml
+    with:
+      release: true
+    secrets: inherit
+    permissions:
+      contents: write
+
+  build-macos-x64:
+    uses: ./.github/workflows/build-desktop-osx64.yml
+    with:
+      release: true
+    secrets: inherit
+    permissions:
+      contents: write
+
+  publish:
+    needs: [build-windows, build-macos-arm, build-macos-x64]
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      pull-requests: read
     steps:
-      - name: 📟 Checkout code
-        uses: actions/checkout@v4
-
-      - name: 📝 Release Drafter
-        id: release-drafter
-        uses: release-drafter/release-drafter@v6.0.0
-        # with:
-        #   config-name: platform-drafter.yml
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: 💾 Save Changelog
-        run: |
-          cat << 'EOF' > CHANGELOG.md
-          ${{ steps.release-drafter.outputs.body }}
-          EOF
-
-      - name: 🧬 Process Changelog
-        run: |
-          pip install requests openai
-          python .github/scripts/process_changelog.py CHANGELOG.md ${{ github.event.inputs.release_pr_number }}
-          python .github/scripts/summarize_changelog.py ${{ secrets.GITHUB_TOKEN }} ${{ secrets.OPENAI_API_KEY }}
-          cat CHANGELOG.md
-
-      - name: 🛫 Create Release
-        uses: mikepenz/action-gh-release@v1
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
         with:
-          body_path: "CHANGELOG.md"
-          tag_name: ${{ github.event.inputs.tag }}
-          prerelease: false
+          path: artifacts
+
+      - name: Sanitize artifact filenames
+        run: |
+          find ./artifacts -depth -name "* *" | while read -r file; do mv "$file" "$(echo "$file" | tr ' ' '-')"; done
+
+      - name: Extract Version and Tag
+        id: extract_version
+        run: |
+          INSTALLER_FILE=$(find ./artifacts -name "*.exe" -o -name "*.dmg" | head -n 1)
+          VERSION=$(basename "$INSTALLER_FILE" | sed -n 's/.*_\([0-9]\+\.[0-9]\+\.[0-9]\+\)_.*/\1/p')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "release_name=ODP Desktop v$VERSION" >> $GITHUB_OUTPUT
+          echo "versioned_tag=Open-Data-Platform-v$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Prepare assets
+        id: prep_assets
+        run: |
+          mkdir ./release_assets
+          find ./artifacts -type f -print -exec cp {} ./release_assets/ \;
+          echo "assets_path=./release_assets" >> $GITHUB_OUTPUT
+
+      - name: Create VERSIONED release
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ steps.extract_version.outputs.versioned_tag }}
+          name: ${{ steps.extract_version.outputs.release_name }}
+          files: ${{ steps.prep_assets.outputs.assets_path }}/*
           draft: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          prerelease: false
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-desktop.yml

@@ -1,180 +1,17 @@
-name: Release ODP Desktop
+name: Update ODP Tag Release
 
 on:
-  workflow_call:
-    inputs:
-      tag:
-        required: true
-        type: string
-      draft:
-        required: true
-        type: boolean
   release:
     types: [published]
   workflow_dispatch:
     inputs:
-      tag:
-        description: "Tag for release"
-        required: false
-        default: ""
-      draft:
-        description: "Create as draft release"
-        required: false
-        default: "false"
+      tag_name:
+        description: "Tag name of the release to process (e.g., Open-Data-Platform-v0.6.0)"
+        required: true
+        type: string
 
 jobs:
-  build-windows:
-    uses: ./.github/workflows/build-desktop-win64.yml
-    with:
-      release: true
-    secrets: inherit
-    permissions:
-      contents: write
-
-  build-macos-arm:
-    uses: ./.github/workflows/build-desktop-osxARM.yml
-    with:
-      release: true
-    secrets: inherit
-    permissions:
-      contents: write
-
-  build-macos-x64:
-    uses: ./.github/workflows/build-desktop-osx64.yml
-    with:
-      release: true
-    secrets: inherit
-    permissions:
-      contents: write
-
-  publish:
-    needs: [build-windows, build-macos-arm, build-macos-x64]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    outputs:
-      version: ${{ steps.extract_version.outputs.version }}
-      tag: ${{ steps.extract_version.outputs.tag }}
-    steps:
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
-      - name: Sanitize artifact filenames
-        run: |
-          find ./artifacts -depth -name "* *" | while read -r file; do mv "$file" "$(echo "$file" | tr ' ' '-')"; done
-
-      - name: Extract Version and Tag
-        id: extract_version
-        run: |
-          # Use input tag if provided, otherwise extract from artifacts
-          if [ -n "${{ github.event.inputs.tag }}" ]; then
-            TAG="${{ github.event.inputs.tag }}"
-            VERSION=$(echo "$TAG" | sed 's/^[^0-9]*//')
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "release_name=Open Data Platform $TAG" >> $GITHUB_OUTPUT
-            echo "tag=$TAG" >> $GITHUB_OUTPUT
-          else
-            INSTALLER_FILE=$(find ./artifacts -name "*.exe" -o -name "*.dmg" | head -n 1)
-            if [ -z "$INSTALLER_FILE" ]; then
-              echo "::error::No installer file found in artifacts."
-              exit 1
-            fi
-            VERSION=$(basename "$INSTALLER_FILE" | sed -n 's/.*_\([0-9]\+\.[0-9]\+\.[0-9]\+\)_.*/\1/p')
-            if [ -z "$VERSION" ]; then
-              echo "::error::Could not extract version from filename: $(basename "$INSTALLER_FILE")"
-              exit 1
-            fi
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "release_name=Open Data Platform v$VERSION" >> $GITHUB_OUTPUT
-            echo "tag=Open-Data-Platform-v$VERSION" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Prepare assets and generate release.json
-        id: prep_assets
-        run: |
-          mkdir ./release_assets
-          find ./artifacts -type f -print -exec cp {} ./release_assets/ \;
-          cd ./release_assets
-          VERSION="${{ steps.extract_version.outputs.version }}"
-          RELEASE_NAME="${{ steps.extract_version.outputs.release_name }}"
-          TAG="${{ steps.extract_version.outputs.tag }}"
-          cat << EOF > release.json
-          {
-            "version": "$VERSION",
-            "notes": "Release for $RELEASE_NAME",
-            "pub_date": "$(date -u +'%Y-%m-%dT%H:%M:%SZ')",
-            "platforms": {
-          EOF
-          WIN_EXE=$(find . -name "*_x86_64.exe" | head -n 1)
-          if [ -n "$WIN_EXE" ]; then
-            WIN_SIG_FILE="${WIN_EXE}.sig"
-            WIN_SIG=$(cat "$WIN_SIG_FILE")
-            WIN_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/$(basename "$WIN_EXE")"
-            cat << EOF >> release.json
-              "windows-x86_64": {
-                "signature": "$WIN_SIG",
-                "url": "$WIN_URL"
-              }
-          EOF
-          fi
-          MAC_ARM_TAR=$(find . -name "*_aarch64.app.tar.gz" | head -n 1)
-          if [ -n "$MAC_ARM_TAR" ]; then
-            if [ -n "$WIN_EXE" ]; then
-              echo "," >> release.json
-            fi
-            MAC_ARM_SIG=$(cat "${MAC_ARM_TAR}.sig")
-            MAC_ARM_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/$(basename "$MAC_ARM_TAR")"
-            cat << EOF >> release.json
-              "darwin-aarch64": {
-                "signature": "$MAC_ARM_SIG",
-                "url": "$MAC_ARM_URL"
-              }
-          EOF
-          fi
-          MAC_X64_TAR=$(find . -name "*_x86_64.app.tar.gz" | head -n 1)
-          if [ -n "$MAC_X64_TAR" ]; then
-            if [ -n "$WIN_EXE" ] || [ -n "$MAC_ARM_TAR" ]; then
-              echo "," >> release.json
-            fi
-            MAC_X64_SIG=$(cat "${MAC_X64_TAR}.sig")
-            MAC_X64_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/$(basename "$MAC_X64_TAR")"
-            cat << EOF >> release.json
-              "darwin-x86_64": {
-                "signature": "$MAC_X64_SIG",
-                "url": "$MAC_X64_URL"
-              }
-          EOF
-          fi
-          cat << EOF >> release.json
-            }
-          }
-          EOF
-          echo "Generated release.json:"
-          cat release.json
-          cd ..
-          echo "assets_path=./release_assets" >> $GITHUB_OUTPUT
-
-      - name: Upload release assets
-        uses: softprops/action-gh-release@v1
-        with:
-          tag_name: ${{ steps.extract_version.outputs.tag }}
-          name: ${{ steps.extract_version.outputs.release_name }}
-          files: ${{ steps.prep_assets.outputs.assets_path }}/*
-          draft: ${{ github.event.inputs.draft == 'true' }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload release.json as artifact for odp job
-        uses: actions/upload-artifact@v4
-        with:
-          name: release-json
-          path: ./release_assets/release.json
-
-  update-latest-tag:
-    needs: publish
-    # Only run this job if not a draft release
-    if: github.event.inputs.draft != 'true'
+  update-odp-release:
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -182,36 +19,144 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Download release artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
-      - name: Delete existing odp tag and release
-        continue-on-error: true
+      - name: Set release tag
+        id: set_tag
         run: |
-          gh release delete odp --yes || true
-          git push origin :refs/tags/odp || true
+          if [ "${{ github.event_name }}" == "release" ]; then
+            echo "tag=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
+          else
+            echo "tag=${{ github.event.inputs.tag_name }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Download release artifacts from published release
+        run: |
+          mkdir -p artifacts
+          gh release download "${{ steps.set_tag.outputs.tag }}" --dir artifacts --repo ${{ github.repository }} --pattern "*"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Prepare latest assets
+      - name: Extract Version and Tag from release
+        id: extract_version
+        run: |
+          INSTALLER_FILE=$(find ./artifacts -name "*.exe" -o -name "*.dmg" | head -n 1)
+          if [ -z "$INSTALLER_FILE" ]; then
+            echo "::error::No installer file found in artifacts."
+            exit 1
+          fi
+          VERSION=$(basename "$INSTALLER_FILE" | sed -n 's/.*_\([0-9]\+\.[0-9]\+\.[0-9]\+\)_.*/\1/p')
+          if [ -z "$VERSION" ]; then
+            echo "::error::Could not extract version from filename: $(basename "$INSTALLER_FILE")"
+            exit 1
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "release_name=ODP Desktop v$VERSION" >> $GITHUB_OUTPUT
+          echo "versioned_tag=${{ steps.set_tag.outputs.tag }}" >> $GITHUB_OUTPUT
+
+      - name: Delete existing ODP tag and release
+        continue-on-error: true
+        run: |
+          gh release delete ODP --yes || true
+          git push origin :refs/tags/ODP || true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Prepare ODP assets and generate latest.json for ODP release
         run: |
           mkdir ./odp_assets
-          find ./artifacts -name "*.exe" -exec cp {} ./odp_assets/ \;
-          find ./artifacts -name "*.dmg" -exec cp {} ./odp_assets/ \;
-          if [ -f ./artifacts/release-json/release.json ]; then
-            cp ./artifacts/release-json/release.json ./odp_assets/latest.json
+
+          for file in $(find ./artifacts -name "*.exe"); do
+            BASENAME=$(basename "$file")
+            NEW_NAME=$(echo "$BASENAME" | sed -E 's/_[0-9]+\.[0-9]+\.[0-9]+_/_latest_/')
+            cp "$file" "./odp_assets/$NEW_NAME"
+          done
+
+          for file in $(find ./artifacts -name "*.dmg"); do
+            BASENAME=$(basename "$file")
+            NEW_NAME=$(echo "$BASENAME" | sed -E 's/_[0-9]+\.[0-9]+\.[0-9]+_/_latest_/')
+            cp "$file" "./odp_assets/$NEW_NAME"
+          done
+
+          VERSION="${{ steps.extract_version.outputs.version }}"
+          RELEASE_NAME="${{ steps.extract_version.outputs.release_name }}"
+          VERSIONED_TAG="${{ steps.extract_version.outputs.versioned_tag }}"
+
+          cd ./odp_assets
+
+          cat << EOF > latest.json
+          {
+            "version": "$VERSION",
+            "notes": "Latest stable release - $RELEASE_NAME",
+            "pub_date": "$(date -u +'%Y-%m-%dT%H:%M:%SZ')",
+            "platforms": {
+          EOF
+
+          FIRST_PLATFORM=true
+
+          WIN_EXE=$(find ../artifacts -name "*_x86_64.exe" | head -n 1)
+          if [ -n "$WIN_EXE" ]; then
+            WIN_SIG_FILE="${WIN_EXE}.sig"
+            WIN_SIG=$(cat "$WIN_SIG_FILE")
+            WIN_URL="https://github.com/${{ github.repository }}/releases/download/${VERSIONED_TAG}/$(basename "$WIN_EXE")"
+            cat << EOF >> latest.json
+              "windows-x86_64": {
+                "signature": "$WIN_SIG",
+                "url": "$WIN_URL"
+              }
+          EOF
+            FIRST_PLATFORM=false
           fi
 
-      - name: Create latest release
+          MAC_ARM_TAR=$(find ../artifacts -name "*_aarch64.app.tar.gz" | head -n 1)
+          if [ -n "$MAC_ARM_TAR" ]; then
+            if [ "$FIRST_PLATFORM" = false ]; then
+              echo "," >> latest.json
+            fi
+            MAC_ARM_SIG=$(cat "${MAC_ARM_TAR}.sig")
+            MAC_ARM_URL="https://github.com/${{ github.repository }}/releases/download/${VERSIONED_TAG}/$(basename "$MAC_ARM_TAR")"
+            cat << EOF >> latest.json
+              "darwin-aarch64": {
+                "signature": "$MAC_ARM_SIG",
+                "url": "$MAC_ARM_URL"
+              }
+          EOF
+            FIRST_PLATFORM=false
+          fi
+
+          MAC_X64_TAR=$(find ../artifacts -name "*_x86_64.app.tar.gz" | head -n 1)
+          if [ -n "$MAC_X64_TAR" ]; then
+            if [ "$FIRST_PLATFORM" = false ]; then
+              echo "," >> latest.json
+            fi
+            MAC_X64_SIG=$(cat "${MAC_X64_TAR}.sig")
+            MAC_X64_URL="https://github.com/${{ github.repository }}/releases/download/${VERSIONED_TAG}/$(basename "$MAC_X64_TAR")"
+            cat << EOF >> latest.json
+              "darwin-x86_64": {
+                "signature": "$MAC_X64_SIG",
+                "url": "$MAC_X64_URL"
+              }
+          EOF
+          fi
+
+          cat << EOF >> latest.json
+            }
+          }
+          EOF
+
+          echo "Generated latest.json for ODP release:"
+          cat latest.json
+
+      - name: Create ODP release
         uses: softprops/action-gh-release@v1
         with:
-          tag_name: odp
-          name: Latest Release
+          tag_name: ODP
+          name: ODP Desktop (Latest Stable)
           body: |
-            This is the latest stable release.
-            For version-specific details, see the corresponding versioned release.
+            **This is the latest stable release (v${{ steps.extract_version.outputs.version }})**
+
+            This release always points to the most recent stable version.
+            For version-specific details and release notes, see: [${{ steps.extract_version.outputs.release_name }}](https://github.com/${{ github.repository }}/releases/tag/${{ steps.extract_version.outputs.versioned_tag }})
+
+            The `latest.json` file in this release is used by the auto-updater to check for new versions.
           files: ./odp_assets/*
           prerelease: false
           draft: false

.github/workflows/test-unit-desktop-winARM.yml

@@ -0,0 +1,116 @@
+name: Test Windows ARM64
+
+on:
+  pull_request:
+    branches:
+      - develop
+    paths:
+      - 'desktop/**'
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+    cancel-in-progress: true
+
+jobs:
+  test-windows-arm64:
+    runs-on: windows-11-arm
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: desktop
+    env:
+      VCPKG_ROOT: ${{ github.workspace }}/vcpkg
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Cache vcpkg
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.VCPKG_ROOT }}
+          key: ${{ runner.os }}-vcpkg-arm64-${{ hashFiles('desktop/**/vcpkg.json') }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-arm64-
+
+      - name: Bootstrap vcpkg
+        working-directory: ${{ github.workspace }}
+        run: |
+          if (-not (Test-Path ${{ env.VCPKG_ROOT }})) {
+            git clone https://github.com/microsoft/vcpkg.git ${{ env.VCPKG_ROOT }}
+          }
+          ${{ env.VCPKG_ROOT }}/bootstrap-vcpkg.bat
+        shell: pwsh
+
+      - name: Install OpenSSL using vcpkg
+        working-directory: ${{ github.workspace }}
+        run: ${{ env.VCPKG_ROOT }}/vcpkg install openssl:arm64-windows-static --vcpkg-root ${{ env.VCPKG_ROOT }}
+        env:
+          VCPKG_DEFAULT_TRIPLET: arm64-windows-static
+
+      - name: Set OpenSSL env
+        shell: bash
+        run: |
+          echo "OPENSSL_DIR=${{ env.VCPKG_ROOT }}/installed/arm64-windows-static" >> $GITHUB_ENV
+          echo "OPENSSL_INCLUDE_DIR=${{ env.VCPKG_ROOT }}/installed/arm64-windows-static/include" >> $GITHUB_ENV
+          echo "OPENSSL_LIB_DIR=${{ env.VCPKG_ROOT }}/installed/arm64-windows-static/lib" >> $GITHUB_ENV
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - name: Set up Rust
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+          profile: minimal
+          components: clippy, rustfmt
+          override: true
+          target: aarch64-pc-windows-msvc
+
+      - name: Cache cargo registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: windows-arm64-cargo-registry-${{ hashFiles('desktop/**/Cargo.lock') }}
+          restore-keys: |
+            windows-arm64-cargo-registry-
+
+      - name: Cache cargo build
+        uses: actions/cache@v4
+        with:
+          path: desktop/target
+          key: windows-arm64-cargo-build-${{ hashFiles('desktop/**/Cargo.lock') }}
+          restore-keys: |
+            windows-arm64-cargo-build-
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Run clippy linter
+        run: cargo clippy --all-targets --all-features --target aarch64-pc-windows-msvc -- -D warnings
+
+      - name: Run tests
+        run: cargo test --all --target aarch64-pc-windows-msvc
+
+      - name: Cache node_modules
+        uses: actions/cache@v4
+        with:
+          path: desktop/node_modules
+          key: windows-arm64-node-modules-${{ hashFiles('desktop/**/package-lock.json') }}
+          restore-keys: |
+            windows-arm64-node-modules-
+
+      - name: Install frontend dependencies
+        run: npm ci
+
+      - name: Lint frontend code
+        run: npm run lint
+
+      - name: Type check
+        run: ./node_modules/.bin/tsc --noEmit
+
+      - name: Run frontend tests
+        run: npm run test -- --watch=false