From bb55230c3ac551138fa74de5494708b24c90986e Mon Sep 17 00:00:00 2001
From: Ap_Tx <3045929398@qq.com>
Date: Fri, 25 Sep 2026 22:01:31 +0800
Subject: [PATCH] =?UTF-8?q?chore(ci):=20=E6=89=93=20tag=20=E8=87=AA?=
 =?UTF-8?q?=E5=8A=A8=E7=BC=96=E8=AF=91=E5=B9=B6=E5=8F=91=E5=B8=83=20Releas?=
 =?UTF-8?q?e?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

新增 build-on-tag.yml：推送 v* tag 时在 4 个平台（Linux x64/arm64、
Windows x64、macOS universal）编译，并通过 tauri-action 直接发布
GitHub Release，包含各平台安装包与 Windows 便携版/多安装器变体。

相比原 axolotl-release.yml 移除了与自动更新相关的后处理步骤
（生成/上传更新清单、通知 Update Server、CNB 镜像、网站下载元数据），
仅保留“编译 + 发布 Release”这一核心目标；相关脚本仍保留在仓库中，
供后续接入自动更新时复用。

同时移除原 axolotl-release.yml，避免两个 workflow 同时响应 v* tag
造成的重复构建与产物冲突。
---
 .github/workflows/axolotl-release.yml | 409 --------------------------
 .github/workflows/build-on-tag.yml    | 206 +++++++++++++
 2 files changed, 206 insertions(+), 409 deletions(-)
 delete mode 100644 .github/workflows/axolotl-release.yml
 create mode 100644 .github/workflows/build-on-tag.yml

diff --git a/.github/workflows/axolotl-release.yml b/.github/workflows/axolotl-release.yml
deleted file mode 100644
index 3709c38..0000000
--- a/.github/workflows/axolotl-release.yml
+++ /dev/null
@@ -1,409 +0,0 @@
-name: Axolotl release
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-permissions:
-  contents: write
-
-concurrency:
-  group: axolotl-release-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  preflight:
-    name: Release preflight
-    runs-on: ubuntu-24.04
-    env:
-      SQLX_OFFLINE: true
-    steps:
-      - name: Check out source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
-
-      - name: Set up Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version-file: .nvmrc
-          cache: pnpm
-
-      - name: Set up Rust
-        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Install Blockbench skin editor dependencies
-        run: npm ci
-        working-directory: third-party/blockbench
-
-      - name: Run release guardrails
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          node scripts/axolotl/check-migrations.mjs --release
-          node scripts/axolotl/brand-guard.mjs
-          node scripts/axolotl/i18n-check.mjs
-          cargo fmt --all --check
-
-      - name: Prepare draft release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          release_notes="${RUNNER_TEMP}/axolotl-release-notes.md"
-          node scripts/axolotl/create-release-notes.mjs "${GITHUB_REF_NAME}" "$release_notes"
-          existing_release="$(
-            gh release list --limit 100 --json tagName \
-              --jq ".[] | select(.tagName == \"${GITHUB_REF_NAME}\") | .tagName"
-          )"
-          if [[ -n "$existing_release" ]]; then
-            echo "Release ${GITHUB_REF_NAME} already exists"
-            gh release edit "${GITHUB_REF_NAME}" --notes-file "$release_notes"
-            exit 0
-          fi
-
-          release_args=(
-            --draft
-            --notes-file "$release_notes"
-            --title "Axolotl Launcher ${GITHUB_REF_NAME}"
-          )
-          if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
-            release_args+=(--prerelease)
-          fi
-          gh release create "${GITHUB_REF_NAME}" "${release_args[@]}"
-
-  build:
-    name: Build (${{ matrix.name }})
-    needs: preflight
-    strategy:
-      fail-fast: true
-      max-parallel: 4
-      matrix:
-        include:
-          - name: Linux x64
-            runner: ubuntu-24.04
-            args: --config tauri-release.conf.json --config tauri-updater.conf.json
-          - name: Linux arm64
-            runner: ubuntu-24.04-arm
-            args: --config tauri-release.conf.json --config tauri-updater.conf.json
-          - name: Windows x64
-            runner: windows-2025
-            args: --config tauri-release.conf.json --config tauri-modern.conf.json --config tauri-updater.conf.json
-          - name: macOS universal
-            runner: macos-15
-            args: --target universal-apple-darwin --config tauri-release.conf.json --config tauri-updater.conf.json
-    runs-on: ${{ matrix.runner }}
-    env:
-      SQLX_OFFLINE: true
-    steps:
-      - name: Check out source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
-
-      - name: Set up Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version-file: .nvmrc
-          cache: pnpm
-
-      - name: Set up Rust
-        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
-
-      - name: Set up Rust compiler cache
-        if: runner.os == 'Windows'
-        uses: mozilla-actions/sccache-action@2df7dbab909c49ab7d3382d05da469f3f975c2d6 # v0.0.7
-
-      - name: Check Rust compiler cache availability
-        id: sccache
-        if: runner.os == 'Windows'
-        continue-on-error: true
-        shell: bash
-        env:
-          SCCACHE_GHA_ENABLED: 'true'
-        run: ${SCCACHE_PATH} rustc -vV
-
-      - name: Enable Rust compiler cache
-        if: runner.os == 'Windows' && steps.sccache.outcome == 'success'
-        shell: bash
-        run: |
-          echo 'RUSTC_WRAPPER=sccache' >> "$GITHUB_ENV"
-          echo 'SCCACHE_GHA_ENABLED=true' >> "$GITHUB_ENV"
-          echo 'SCCACHE_CACHE_SIZE=4G' >> "$GITHUB_ENV"
-
-      - name: Add macOS universal targets
-        if: runner.os == 'macOS'
-        run: rustup target add aarch64-apple-darwin x86_64-apple-darwin
-
-      - name: Install Linux dependencies
-        if: runner.os == 'Linux'
-        run: sudo apt-get -o Acquire::ForceIPv4=true update && sudo apt-get -o Acquire::ForceIPv4=true install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf xdg-utils
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Install Blockbench skin editor dependencies
-        run: npm ci
-        working-directory: third-party/blockbench
-
-      - uses: ./.github/actions/replace-gradle-mirror
-
-      - name: Set release version
-        run: node scripts/axolotl/set-version.mjs "${{ github.ref_name }}"
-
-      - name: Build and upload release assets
-        uses: tauri-apps/tauri-action@1ddc7b49b13c3038297360482fcb3e058764d7c9 # v0.6.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CURSEFORGE_API_KEY: ${{ secrets.CURSEFORGE_API_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          TAURI_BUNDLER_DMG_IGNORE_CI: ${{ runner.os == 'macOS' && 'true' || '' }}
-        with:
-          projectPath: apps/app
-          tauriScript: pnpm tauri
-          args: ${{ matrix.args }}
-          tagName: ${{ github.ref_name }}
-          releaseName: Axolotl Launcher ${{ github.ref_name }}
-          releaseDraft: true
-          prerelease: ${{ contains(github.ref_name, '-') }}
-          generateReleaseNotes: false
-          includeUpdaterJson: false
-          updaterJsonPreferNsis: true
-          retryAttempts: 2
-
-      - name: Show Rust compiler cache statistics
-        if: runner.os == 'Windows' && steps.sccache.outcome == 'success' && always()
-        shell: bash
-        run: ${SCCACHE_PATH} --show-stats
-
-      - name: Publish Windows distribution variants
-        if: runner.os == 'Windows'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CURSEFORGE_API_KEY: ${{ secrets.CURSEFORGE_API_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-        shell: pwsh
-        run: |
-          $version = "${{ github.ref_name }}" -replace '^v', ''
-          $appName = (Get-Content apps/app/tauri.conf.json -Raw | ConvertFrom-Json).mainBinaryName
-          $outDir = "target/release/bundle/nsis"
-          $buildDir = "target/portable-build"
-          $publishDir = Join-Path $env:RUNNER_TEMP "windows-assets"
-
-          New-Item -ItemType Directory -Force -Path $publishDir | Out-Null
-
-          $modernInstallers = @(Get-ChildItem $outDir -Filter '*-setup.exe' -File)
-          if ($modernInstallers.Count -ne 1) {
-            throw "Expected one modern installer, found $($modernInstallers.Count)"
-          }
-
-          $modernName = "Axolotl_Launcher_${version}_x64_modern-setup.exe"
-          $modernPath = Join-Path $publishDir $modernName
-          Copy-Item -Force $modernInstallers[0].FullName $modernPath
-          gh release upload "${{ github.ref_name }}" $modernPath --clobber
-
-          $modernSignature = "$($modernInstallers[0].FullName).sig"
-          if (Test-Path $modernSignature) {
-            $modernSignaturePath = "$modernPath.sig"
-            Copy-Item -Force $modernSignature $modernSignaturePath
-            gh release upload "${{ github.ref_name }}" $modernSignaturePath --clobber
-            gh release delete-asset "${{ github.ref_name }}" "$($modernInstallers[0].Name).sig" --yes
-          }
-          gh release delete-asset "${{ github.ref_name }}" $modernInstallers[0].Name --yes
-
-          pnpm --filter @modrinth/app tauri build --config tauri-release.conf.json --config tauri-native.conf.json
-
-          $nativeInstallers = @(Get-ChildItem $outDir -Filter '*-setup.exe' -File)
-          if ($nativeInstallers.Count -ne 1) {
-            throw "Expected one native NSIS installer, found $($nativeInstallers.Count)"
-          }
-
-          $nativeName = "Axolotl_Launcher_${version}_x64_nsis-setup.exe"
-          $nativePath = Join-Path $publishDir $nativeName
-          Copy-Item -Force $nativeInstallers[0].FullName $nativePath
-          gh release upload "${{ github.ref_name }}" $nativePath --clobber
-
-          $nativeSignature = "$($nativeInstallers[0].FullName).sig"
-          if (Test-Path $nativeSignature) {
-            $nativeSignaturePath = "$nativePath.sig"
-            Copy-Item -Force $nativeSignature $nativeSignaturePath
-            gh release upload "${{ github.ref_name }}" $nativeSignaturePath --clobber
-          }
-
-          # Reuse the binary already built by tauri-action
-          $appExe = "target/release/${appName}.exe"
-          if (Test-Path $appExe) {
-            New-Item -ItemType Directory -Force -Path "$buildDir\Axolotl" | Out-Null
-            Copy-Item -Force $appExe "$buildDir\Axolotl\"
-
-            $editorResources = "target/release/resources/blockbench-skin"
-            foreach ($requiredFile in @('index.html', 'css/setup.css', 'dist/skin.bundle.js.gz')) {
-              if (!(Test-Path -LiteralPath (Join-Path $editorResources $requiredFile) -PathType Leaf)) {
-                throw "Missing skin editor resource: $requiredFile"
-              }
-            }
-            New-Item -ItemType Directory -Force -Path "$buildDir\Axolotl\resources" | Out-Null
-            Copy-Item -LiteralPath $editorResources -Destination "$buildDir\Axolotl\resources" -Recurse -Force
-
-            # Create empty .Axolotl folder to trigger portable mode
-            New-Item -ItemType Directory -Force -Path "$buildDir\Axolotl\.Axolotl" | Out-Null
-
-            # Create portable zip (for manual download)
-            $zipName = "Axolotl_Launcher_${version}_x64_portable.zip"
-            $zipPath = Join-Path $publishDir $zipName
-            Compress-Archive -Path "$buildDir\Axolotl" -DestinationPath $zipPath -Force
-            Write-Output "Created portable zip: $zipPath"
-
-            # Upload portable zip (for manual download only)
-            gh release upload "${{ github.ref_name }}" "$zipPath" --clobber
-          } else {
-            throw "Binary not found at $appExe"
-          }
-
-  verify-and-publish:
-    name: Verify and publish
-    needs: build
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Check out source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          ref: main
-
-      - name: Download updater signatures
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release download "${GITHUB_REF_NAME}" --pattern '*.sig' --dir release-check/signatures
-
-      - name: Download release metadata
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          release_id="$(
-            gh api "repos/${GITHUB_REPOSITORY}/releases" \
-              --paginate \
-              --jq ".[] | select(.tag_name == \"${GITHUB_REF_NAME}\") | .id"
-          )"
-          if [[ -z "$release_id" ]]; then
-            echo "Release ${GITHUB_REF_NAME} was not found"
-            exit 1
-          fi
-          gh api "repos/${GITHUB_REPOSITORY}/releases/${release_id}" > release-check/release.json
-
-      - name: Generate update manifest
-        run: node scripts/axolotl/create-update-manifest.mjs release-check/release.json release-check/signatures "${GITHUB_REF_NAME}" release-check/latest.json
-
-      - name: Verify update manifest
-        run: node scripts/axolotl/verify-update-manifest.mjs release-check/latest.json "${GITHUB_REF_NAME}"
-
-      - name: Upload update manifest
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload "${GITHUB_REF_NAME}" release-check/latest.json --clobber
-
-      - name: Publish release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
-            gh release edit "${GITHUB_REF_NAME}" --draft=false --prerelease
-          else
-            gh release edit "${GITHUB_REF_NAME}" --draft=false --latest
-          fi
-
-      - name: Refresh published GitHub release metadata
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          release_id="$(
-            gh api "repos/${GITHUB_REPOSITORY}/releases" \
-              --paginate \
-              --jq ".[] | select(.tag_name == \"${GITHUB_REF_NAME}\") | .id"
-          )"
-          if [[ -z "$release_id" ]]; then
-            echo "Published release ${GITHUB_REF_NAME} was not found"
-            exit 1
-          fi
-          gh api "repos/${GITHUB_REPOSITORY}/releases/${release_id}" > release-check/release.json
-
-      - name: Build Update Server artifact catalog
-        run: |
-          node scripts/axolotl/create-update-server-catalog.mjs \
-            release-check/release.json \
-            "${GITHUB_REF_NAME}" \
-            release-check/update-server-catalog.json
-          node scripts/axolotl/create-update-server-catalog.test.mjs
-
-      - name: Notify Update Server to publish release assets
-        env:
-          UPDATE_SERVER_URL: ${{ secrets.UPDATE_SERVER_URL }}
-          UPDATE_SERVER_WEBHOOK_SECRET: ${{ secrets.UPDATE_SERVER_WEBHOOK_SECRET }}
-          UPDATE_SERVER_FORCE_UPDATE: 'false'
-        run: |
-          node scripts/axolotl/publish-update-server.mjs \
-            release-check/update-server-catalog.json \
-            release-check/release.json \
-            "${GITHUB_REF_NAME}"
-
-      - name: Publish website download metadata
-        if: ${{ !contains(github.ref_name, '-') }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          node scripts/axolotl/create-website-release-metadata.mjs \
-            release-check/release.json \
-            apps/website/releases/latest.json
-          node scripts/axolotl/create-website-release-catalog.mjs \
-            apps/website/releases/catalog.json
-
-          git config user.name "Axolotl Release Bot"
-          git config user.email "release@axolotl.local"
-          git add apps/website/releases/latest.json apps/website/releases/catalog.json
-          if git diff --cached --quiet; then
-            echo "Website metadata is unchanged"
-          else
-            git commit -m "chore(website): update download metadata to ${GITHUB_REF_NAME} [skip ci]"
-            git push origin main
-          fi
-
-      - name: Mirror published release to CNB
-        env:
-          CNB_REPO_URL_HTTPS: ${{ secrets.CNB_REPO_URL_HTTPS }}
-          CNB_TOKEN: ${{ secrets.CNB_TOKEN }}
-          CNB_TOKEN_USER_NAME: ${{ secrets.CNB_TOKEN_USER_NAME }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          if [[ -z "${CNB_TOKEN:-}" ]]; then
-            echo "CNB_TOKEN is not configured"
-            exit 1
-          fi
-
-          cnb_url="${CNB_REPO_URL_HTTPS:-https://cnb.cool/axlmc/Axolotl.git}"
-          token_user="${CNB_TOKEN_USER_NAME:-cnb}"
-          auth="$(printf '%s:%s' "$token_user" "$CNB_TOKEN" | base64 -w0)"
-          git_cnb() {
-            git -c "http.extraHeader=Authorization: Basic $auth" "$@"
-          }
-
-          git fetch origin "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
-          git_cnb push --force "$cnb_url" \
-            "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
-
-          node scripts/axolotl/cnb-release.mjs finalize "${GITHUB_REF_NAME}" cnb-release/final
-          node scripts/axolotl/verify-update-manifest.mjs \
-            cnb-release/final/latest.json "${GITHUB_REF_NAME}" cnb
diff --git a/.github/workflows/build-on-tag.yml b/.github/workflows/build-on-tag.yml
new file mode 100644
index 0000000..3298de4
--- /dev/null
+++ b/.github/workflows/build-on-tag.yml
@@ -0,0 +1,206 @@
+name: Starlight build & release
+
+# 打 tag（v*）时自动编译并发布 GitHub Release，产物包含各平台安装包。
+# 不含更新清单 / Update Server 通知 / CNB 镜像等步骤（自动更新流程单独处理）。
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+concurrency:
+  group: starlight-build-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build (${{ matrix.name }})
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        include:
+          - name: Linux x64
+            runner: ubuntu-24.04
+            args: --config tauri-release.conf.json --config tauri-updater.conf.json
+          - name: Linux arm64
+            runner: ubuntu-24.04-arm
+            args: --config tauri-release.conf.json --config tauri-updater.conf.json
+          - name: Windows x64
+            runner: windows-2025
+            args: --config tauri-release.conf.json --config tauri-modern.conf.json --config tauri-updater.conf.json
+          - name: macOS universal
+            runner: macos-15
+            args: --target universal-apple-darwin --config tauri-release.conf.json --config tauri-updater.conf.json
+    runs-on: ${{ matrix.runner }}
+    env:
+      SQLX_OFFLINE: true
+    steps:
+      - name: Check out source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
+
+      - name: Set up Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+
+      - name: Set up Rust compiler cache
+        if: runner.os == 'Windows'
+        uses: mozilla-actions/sccache-action@2df7dbab909c49ab7d3382d05da469f3f975c2d6 # v0.0.7
+
+      - name: Check Rust compiler cache availability
+        id: sccache
+        if: runner.os == 'Windows'
+        continue-on-error: true
+        shell: bash
+        env:
+          SCCACHE_GHA_ENABLED: 'true'
+        run: ${SCCACHE_PATH} rustc -vV
+
+      - name: Enable Rust compiler cache
+        if: runner.os == 'Windows' && steps.sccache.outcome == 'success'
+        shell: bash
+        run: |
+          echo 'RUSTC_WRAPPER=sccache' >> "$GITHUB_ENV"
+          echo 'SCCACHE_GHA_ENABLED=true' >> "$GITHUB_ENV"
+          echo 'SCCACHE_CACHE_SIZE=4G' >> "$GITHUB_ENV"
+
+      - name: Add macOS universal targets
+        if: runner.os == 'macOS'
+        run: rustup target add aarch64-apple-darwin x86_64-apple-darwin
+
+      - name: Install Linux dependencies
+        if: runner.os == 'Linux'
+        run: sudo apt-get -o Acquire::ForceIPv4=true update && sudo apt-get -o Acquire::ForceIPv4=true install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf xdg-utils
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Blockbench skin editor dependencies
+        run: npm ci
+        working-directory: third-party/blockbench
+
+      - uses: ./.github/actions/replace-gradle-mirror
+
+      - name: Set release version
+        run: node scripts/axolotl/set-version.mjs "${{ github.ref_name }}"
+
+      - name: Build and publish release assets
+        uses: tauri-apps/tauri-action@1ddc7b49b13c3038297360482fcb3e058764d7c9 # v0.6.2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CURSEFORGE_API_KEY: ${{ secrets.CURSEFORGE_API_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          TAURI_BUNDLER_DMG_IGNORE_CI: ${{ runner.os == 'macOS' && 'true' || '' }}
+        with:
+          projectPath: apps/app
+          tauriScript: pnpm tauri
+          args: ${{ matrix.args }}
+          tagName: ${{ github.ref_name }}
+          releaseName: Starlight Launcher ${{ github.ref_name }}
+          releaseDraft: false
+          prerelease: ${{ contains(github.ref_name, '-') }}
+          generateReleaseNotes: false
+          includeUpdaterJson: false
+          updaterJsonPreferNsis: true
+          retryAttempts: 2
+
+      - name: Show Rust compiler cache statistics
+        if: runner.os == 'Windows' && steps.sccache.outcome == 'success' && always()
+        shell: bash
+        run: ${SCCACHE_PATH} --show-stats
+
+      - name: Publish Windows distribution variants
+        if: runner.os == 'Windows'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CURSEFORGE_API_KEY: ${{ secrets.CURSEFORGE_API_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        shell: pwsh
+        run: |
+          $version = "${{ github.ref_name }}" -replace '^v', ''
+          $appName = (Get-Content apps/app/tauri.conf.json -Raw | ConvertFrom-Json).mainBinaryName
+          $outDir = "target/release/bundle/nsis"
+          $buildDir = "target/portable-build"
+          $publishDir = Join-Path $env:RUNNER_TEMP "windows-assets"
+
+          New-Item -ItemType Directory -Force -Path $publishDir | Out-Null
+
+          $modernInstallers = @(Get-ChildItem $outDir -Filter '*-setup.exe' -File)
+          if ($modernInstallers.Count -ne 1) {
+            throw "Expected one modern installer, found $($modernInstallers.Count)"
+          }
+
+          $modernName = "Starlight_Launcher_${version}_x64_modern-setup.exe"
+          $modernPath = Join-Path $publishDir $modernName
+          Copy-Item -Force $modernInstallers[0].FullName $modernPath
+          gh release upload "${{ github.ref_name }}" $modernPath --clobber
+
+          $modernSignature = "$($modernInstallers[0].FullName).sig"
+          if (Test-Path $modernSignature) {
+            $modernSignaturePath = "$modernPath.sig"
+            Copy-Item -Force $modernSignature $modernSignaturePath
+            gh release upload "${{ github.ref_name }}" $modernSignaturePath --clobber
+            gh release delete-asset "${{ github.ref_name }}" "$($modernInstallers[0].Name).sig" --yes
+          }
+          gh release delete-asset "${{ github.ref_name }}" $modernInstallers[0].Name --yes
+
+          pnpm --filter @modrinth/app tauri build --config tauri-release.conf.json --config tauri-native.conf.json
+
+          $nativeInstallers = @(Get-ChildItem $outDir -Filter '*-setup.exe' -File)
+          if ($nativeInstallers.Count -ne 1) {
+            throw "Expected one native NSIS installer, found $($nativeInstallers.Count)"
+          }
+
+          $nativeName = "Starlight_Launcher_${version}_x64_nsis-setup.exe"
+          $nativePath = Join-Path $publishDir $nativeName
+          Copy-Item -Force $nativeInstallers[0].FullName $nativePath
+          gh release upload "${{ github.ref_name }}" $nativePath --clobber
+
+          $nativeSignature = "$($nativeInstallers[0].FullName).sig"
+          if (Test-Path $nativeSignature) {
+            $nativeSignaturePath = "$nativePath.sig"
+            Copy-Item -Force $nativeSignature $nativeSignaturePath
+            gh release upload "${{ github.ref_name }}" $nativeSignaturePath --clobber
+          }
+
+          $appExe = "target/release/${appName}.exe"
+          if (Test-Path $appExe) {
+            New-Item -ItemType Directory -Force -Path "$buildDir\Starlight" | Out-Null
+            Copy-Item -Force $appExe "$buildDir\Starlight\"
+
+            $editorResources = "target/release/resources/blockbench-skin"
+            foreach ($requiredFile in @('index.html', 'css/setup.css', 'dist/skin.bundle.js.gz')) {
+              if (!(Test-Path -LiteralPath (Join-Path $editorResources $requiredFile) -PathType Leaf)) {
+                throw "Missing skin editor resource: $requiredFile"
+              }
+            }
+            New-Item -ItemType Directory -Force -Path "$buildDir\Starlight\resources" | Out-Null
+            Copy-Item -LiteralPath $editorResources -Destination "$buildDir\Starlight\resources" -Recurse -Force
+
+            New-Item -ItemType Directory -Force -Path "$buildDir\Starlight\.Starlight" | Out-Null
+
+            $zipName = "Starlight_Launcher_${version}_x64_portable.zip"
+            $zipPath = Join-Path $publishDir $zipName
+            Compress-Archive -Path "$buildDir\Starlight" -DestinationPath $zipPath -Force
+            Write-Output "Created portable zip: $zipPath"
+
+            gh release upload "${{ github.ref_name }}" "$zipPath" --clobber
+          } else {
+            throw "Binary not found at $appExe"
+          }
\ No newline at end of file