From 43f439038c8511b71747ff3d721b75b015c7cc4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Erik=20Bj=C3=A4reholt?= <erik@bjareho.lt>
Date: Sat, 22 Aug 2026 22:02:22 +0200
Subject: [PATCH] feat(updater): add updater signing pubkey, build updater
 artifacts when key present

- Set the updater plugin pubkey (private key + password live in CI secrets
  TAURI_SIGNING_PRIVATE_KEY / TAURI_SIGNING_PRIVATE_KEY_PASSWORD on
  ActivityWatch/activitywatch)
- Enable bundle.createUpdaterArtifacts via --config only when
  TAURI_SIGNING_PRIVATE_KEY is set, so local builds and fork PRs (no
  secrets) still build plain bundles instead of failing on a missing key
---
 Makefile                  | 10 +++++++++-
 src-tauri/tauri.conf.json |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index ae31259b..bd7967e2 100644
--- a/Makefile
+++ b/Makefile
@@ -5,8 +5,16 @@ else
 endif
 OS := $(shell uname -s)
 
+# Updater artifacts (.tar.gz/.zip + .sig) require the signing key, so only
+# enable them when TAURI_SIGNING_PRIVATE_KEY is set (release CI). Without it,
+# plain bundles are built and local/fork-PR builds keep working.
+TAURI_BUILD_ARGS :=
+ifdef TAURI_SIGNING_PRIVATE_KEY
+TAURI_BUILD_ARGS += --config '{"bundle":{"createUpdaterArtifacts":true}}'
+endif
+
 build: prebuild
-	npm run tauri build
+	npm run tauri build -- $(TAURI_BUILD_ARGS)
 
 dev: prebuild
 	npm run tauri dev
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index b5b9ab8d..5ee2e3dc 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -22,7 +22,7 @@
   },
   "plugins": {
     "updater": {
-      "pubkey": "",
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IERDOEZGQzlEN0NERDlGQjAKUldTd245MThuZnlQM0Q1Z0JuT0RZU0JEVUxlT0x5TGc0Q09YbVZadHFwRllsRDFRMFJ2eTFtUEYK",
       "endpoints": [
         "https://github.com/ActivityWatch/activitywatch/releases/latest/download/latest.json"
       ],