Windows: leaner portable package and opt-in in-app updater (#421)

.github/workflows/linux-release.yml

@@ -102,8 +102,12 @@ jobs:
 
       - name: build Linux CPU
         run: |
+          # PUBLISH_UPDATER_ASSETS=1 also emits the slim app-layer asset the
+          # in-app updater downloads (#421). Built once here: StemDeck and
+          # backend/ are identical in both variants.
           PACKAGE_NAME=StemDeck-Linux-x64 \
           PACKAGE_VERSION="$VERSION" \
+          PUBLISH_UPDATER_ASSETS=1 \
             bash scripts/linux/make-portable.sh
           # Drop the uncompressed stage but keep the tarball; frees disk for the
           # larger NVIDIA build. The Tauri binary under target/ is preserved.
@@ -145,3 +149,6 @@ jobs:
             dist/StemDeck-Linux-x64.tar.gz.sha256
             dist/StemDeck-Linux-x64.NVIDIA.tar.gz
             dist/StemDeck-Linux-x64.NVIDIA.tar.gz.sha256
+            dist/StemDeck-Linux-x64-app.tar.gz
+            dist/StemDeck-Linux-x64-app.tar.gz.sha256
+            dist/StemDeck-Linux-x64-runtime-version.json

.github/workflows/macos-check.yml

@@ -8,6 +8,15 @@ name: macOS Rust Check
 # only way to get a real compiler pass over it before merging.
 on:
   workflow_dispatch:
+  # Also on PRs that actually touch the Rust, so a desktop-shell change cannot
+  # merge without a real compiler pass on this platform. Scoped by path so the
+  # self-hosted runner's load is unchanged for the majority of PRs, which do not
+  # go near src-tauri. (#421 added ~600 lines of mostly cfg-gated Rust and every
+  # CI check passed without compiling any of it.)
+  pull_request:
+    paths:
+      - "desktop/src-tauri/**"
+      - ".github/workflows/macos-check.yml"
 
 permissions: {}
 

.github/workflows/windows-check.yml

@@ -9,6 +9,15 @@ name: Windows Rust Check
 # build in v0.11.1's first release attempt.
 on:
   workflow_dispatch:
+  # Also on PRs that actually touch the Rust, so a desktop-shell change cannot
+  # merge without a real compiler pass on this platform. Scoped by path so the
+  # self-hosted runner's load is unchanged for the majority of PRs, which do not
+  # go near src-tauri. (#421 added ~600 lines of mostly cfg-gated Rust and every
+  # CI check passed without compiling any of it.)
+  pull_request:
+    paths:
+      - "desktop/src-tauri/**"
+      - ".github/workflows/windows-check.yml"
 
 permissions: {}
 

.github/workflows/windows-release.yml

@@ -53,16 +53,15 @@ jobs:
         run: |
           powershell -NoProfile -ExecutionPolicy Bypass -File scripts/windows/make-portable.ps1 `
             -PackageName StemDeck-Windows-x64.NVIDIA `
-            -PackageVersion "$env:REF_NAME" `
-            -StripVenv
+            -PackageVersion "$env:REF_NAME"
 
       - name: build Windows CPU
         run: |
           powershell -NoProfile -ExecutionPolicy Bypass -File scripts/windows/make-portable.ps1 `
             -PackageName StemDeck-Windows-x64 `
             -PackageVersion "$env:REF_NAME" `
             -CpuOnly `
-            -StripVenv
+            -PublishUpdaterAssets
 
       - name: scan artifacts
         run: |
@@ -101,3 +100,6 @@ jobs:
             dist/StemDeck-Windows-x64.NVIDIA.zip.sha256
             dist/StemDeck-Windows-x64.zip
             dist/StemDeck-Windows-x64.zip.sha256
+            dist/StemDeck-Windows-x64-app.zip
+            dist/StemDeck-Windows-x64-app.zip.sha256
+            dist/StemDeck-Windows-x64-runtime-version.json

app/main.py

@@ -3,6 +3,7 @@
 import asyncio
 import functools
 import io
+import json
 import logging
 import os
 import re
@@ -94,9 +95,32 @@
 
 
 def app_version() -> str:
-    # Version is git-tag-derived via hatch-vcs (#169). Prefer installed package
-    # metadata (set at install/build from the tag); fall back to the generated
-    # app/_version.py for non-installed runs, then a dev placeholder.
+    # Version is git-tag-derived via hatch-vcs (#169).
+    #
+    # A packaged desktop install carries its version in the app layer
+    # (static/version.json, written by the make-portable scripts), and that is
+    # checked FIRST. The in-app updater (#421) replaces backend/ but
+    # deliberately never replaces python/, where the installed dist metadata
+    # lives -- so after a self-update that metadata is a version behind, and
+    # trusting it would make the app keep offering an update it already applied.
+    # The file is gitignored, so Docker images and source checkouts do not have
+    # it and correctly fall through to the metadata below.
+    try:
+        # utf-8-sig: some writers emit a BOM, which json.loads rejects.
+        raw = (STATIC_DIR / "version.json").read_text(encoding="utf-8-sig")
+        packaged = json.loads(raw).get("version")
+        if isinstance(packaged, str) and packaged.strip():
+            return packaged.strip()
+    except (OSError, ValueError, AttributeError):
+        # Absent or unreadable (OSError), not valid JSON or not decodable
+        # (ValueError), or valid JSON that is not an object so has no .get
+        # (AttributeError). All of those simply mean "no app-layer marker
+        # here", so fall through to the metadata below. Narrow rather than a
+        # bare except so a genuine bug in this function still surfaces instead
+        # of silently degrading the reported version (bandit B110).
+        pass
+    # Installed package metadata (set at install/build from the tag); then the
+    # generated app/_version.py for non-installed runs, then a dev placeholder.
     try:
         return package_version("stemdeck")
     except PackageNotFoundError: