[ItsAlphaNeon]

Merge order: this one, then #370, then #393. Merging publishes nothing: the schedule stays off until the repository variable NIGHTLIES is on, and a run by hand refuses to start without the signing key.

What this adds

Builds made by the new release workflow update themselves on their own channel. Builds from source have no channel and never update.

• tools/updater, lemonstudio-updater. It checks the channel's manifest, verifies its minisign signature, downloads the build and checks its SHA-256. Once Lemon Studio closes, it replaces the Windows .exe, the Linux AppImage ($APPIMAGE) or the macOS .app, then starts the new version. The app carries it inside itself (build.rs, LEMON_UPDATER) and writes it to <user folder>/Updates/<channel> to run it. HTTPS uses rustls with ring and the system's certificate store.
• Versions (version.rs): nightlies use dated versions (YEAR.MONTH.DAY.N) and tagged releases use MAJOR.MINOR.PATCH. The two are never compared, and the updater never moves to an older version. The version shown everywhere follows the build: the app, diagnostics, the panic log, the "saved by" stamp and the Windows version resource.
• Alphas: a tag with major version 0, like v0.1.0, is an alpha. alpha is not in the tag. The app, the diagnostics and the release's title say "alpha", where nightlies and builds from source say "pre-alpha". An alpha isn't a GitHub pre-release, because the updater finds it as GitHub's latest release, and it updates on to v1.0.0 like any newer version.
• In the app (update.rs):
  • a check at start
  • an Install and restart / Skip this version / Later prompt, which waits until no dialog is open and nothing is recording
  • HELP ▸ Check for updates
  • the two General ▸ Updates checks, previously greyed out, now work
  • the About tab shows the channel and has a Check for updates button
  • OPENSTUDIO_NO_UPDATE_CHECK=1 turns off the check at start, and OPENSTUDIO_UPDATE_BASE points it at a test server
• release.yml:
  • a nightly from main every night once turned on, skipped if main hasn't moved, keeping the newest 14
  • a tagged release from a vMAJOR.MINOR.PATCH tag that is on main and matches Cargo.toml
  • a dry run (Run workflow): builds, packages and signs, then keeps the files as the run's artifacts. It can rehearse a tag as well as a nightly
  • assets: LemonStudio.exe, LemonStudio.AppImage (built on Ubuntu 22.04), macOS .app (Apple silicon, signed ad hoc, not notarized; the release notes say how to open it), and the VST3/CLAP plugins as a zip per platform. The .exe and AppImage have no version in their names, and a nightly's are LemonStudioNightly: an update replaces the file in place, so shortcuts to it never break
• Docs: docs/releasing.md, with the going-live steps in order, plus updates to the README, the alpha checklist and the regenerated THIRD-PARTY-NOTICES.txt.

After merging

The steps are under "Going live" in docs/releasing.md:

• Repository secret MINISIGN_SECRET_KEY and variable MINISIGN_PUBLIC_KEY set
• Dry runs of a nightly and a tag, and each platform's build opened
• First nightly published, and NIGHTLIES set to on
• Each platform updates itself once
• For the first alpha: version in Cargo.toml set (it is still 0.0.1) and merged, then the tag pushed

Testing

• cargo test --workspace on Windows, with Nightly builds: their own name, icon and splash (Moonrise) #370 and HELP menu: opens the website, and About works #393 merged in: 2523 passed, 0 failed.
• tools/package/test.sh, which CI now runs: the release plan against a throwaway repository (nightly numbering, no nightly when main hasn't moved, a tag not matching Cargo.toml, off main or with alpha in it refused, rehearsals), and the manifest.
• In a throwaway workflow, since deleted: actionlint on both workflows, and cargo check of the app and updater on Ubuntu 22.04.
• From before this round, on Windows against a local server with a signed test manifest: a 2026.11.6.1 build checked at start, downloaded 2026.11.7.1 and showed the prompt, Skip this version was saved, the updater replaced lemonstudio.exe and relaunched it, and a tampered manifest was refused. Not repeated since the update folders became per channel.

Not run: the Release workflow itself, by request, so the AppImage and .app of a real build, and the Linux and macOS update and swap code outside CI's tests, are still untried. The tag path's releases/latest lookup can't be tried until a tagged release exists.

🤖 Generated with Claude Code