ci(release): drop stray latest.json from release assets

[pmaxhogan]

Summary

tauri-apps/tauri-action attaches a latest.json updater manifest to the GitHub Release on publish even though the build job sets uploadUpdaterJson: false. The app uses Cloudflare-hosted, channel-in-path manifests (updates/<channel>/<os>/<arch>/update.json), so the stray target-flat latest.json is harmless but is confusing clutter on the Release assets (issue #29).

This adds an idempotent post-publish cleanup step that deletes any latest.json asset from the just-created GitHub Release for the pushed tag.

What changed

• .github/workflows/release.yml: new step Remove stray latest.json from the release in the publish-updater-manifest job.
  • That job runs ONCE (needs: build), so it executes only after every matrix build's tauri-action upload has completed. It already has the tag (RELEASE_TAG: ${{ github.ref_name }}, job-level env - not hardcoded) and GITHUB_TOKEN, so the cleanup runs exactly once after all assets exist.
  • Idempotent: it queries gh release view "$RELEASE_TAG" --json assets for an asset named latest.json and only calls gh release delete-asset "$RELEASE_TAG" latest.json --yes when one is present; otherwise it logs and exits 0. The gh release view ... --json assets --jq / gh release delete-asset ... --yes forms match the patterns already used in dev-channel.yml.

Why uploadUpdaterJson: false does not suppress it

src-tauri/tauri.conf.json sets bundle.createUpdaterArtifacts: true, so the Tauri bundler emits updater artifacts and tauri-action generates a latest.json. Per the tauri-action action.yml + docs (verified via Context7), uploadUpdaterJson (default true) is the correct input and the current dev branch gates the upload on it (if (shouldUploadUpdaterJson) { uploadVersionJSON(...) }). However this repo pins the floating tauri-apps/tauri-action@v0 major tag, whose resolved build does not match that current dev-branch logic, so the generated latest.json is still attached despite the flag. The input name itself is correct (a previous codex pass already confirmed includeUpdaterJson does not exist), so renaming is not the fix - the robust fix shipped here is the post-publish delete.

Why dev-channel.yml is unchanged

dev-channel.yml's tauri-action step has NO tagName, so it builds only and creates/uploads no release (and thus no latest.json). The rolling dev pre-release is assembled by softprops/action-gh-release from dev-artifacts/*, which is populated by a find allow-list (.dmg, .app.tar.gz(.sig), .msi(.sig), -setup.exe(.sig), .AppImage(.sig), .deb) that excludes latest.json. And even if a latest.json ever did land there, the existing gc-stale-dev-assets job already deletes every asset not carrying the run's dev version. So no cleanup is needed there.

Testing

This is YAML/CI only - no app code changed, so the pnpm/cargo gates were skipped per the task. Validation run:

• actionlint .github/workflows/release.yml - PASS
• actionlint .github/workflows/dev-channel.yml - PASS (unchanged, sanity check)
• python -c "import yaml; yaml.safe_load(open('.github/workflows/release.yml'))" - parses
• python -c "import yaml; yaml.safe_load(open('.github/workflows/dev-channel.yml'))" - parses
• git diff | grep -P '[^\x00-\x7F]' - no non-ASCII introduced; file remains LF ASCII text
• Step ordering verified: the cleanup lives in publish-updater-manifest (needs: build), so it runs after all tauri-action uploads; RELEASE_TAG resolves from job-level github.ref_name.

This cannot be fully proven until the next real tagged release exercises release.yml end to end (the cleanup only runs on a v* tag push). The idempotent delete-asset + actionlint/YAML lint is the ceiling here; the delete is a safe no-op if latest.json is ever absent.

Closes #29

🤖 Generated with Claude Code

https://claude.ai/code/session_01MZQh3ZfwtZsM6c5qnTuWZP

[github-actions]

Coverage

Area	main	this PR	delta
Rust (lib crates)	76.60%	76.60%	+0.00 (OK)
UI (vue/ts)	87.17%	87.17%	+0.00 (OK)

Gate: passed - no coverage regression (epsilon 0.1 pp).