From 145a2b4e5ce83425776884d8e453553795e46940 Mon Sep 17 00:00:00 2001
From: Zack Kollar <rallokkcaz@gmail.com>
Date: Mon, 16 Mar 2026 23:34:28 -0400
Subject: [PATCH 1/7] :construction_worker: Add CI/CD pipeline and release
 workflow

---
 .github/workflows/ci.yml      | 181 ++++++++++++++++++++++
 .github/workflows/release.yml | 282 ++++++++++++++++++++++++++++++++++
 2 files changed, 463 insertions(+)
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..51e6fdf
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,181 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+  RUST_BACKTRACE: short
+  # sccache config
+  SCCACHE_GHA_ENABLED: true
+  RUSTC_WRAPPER: sccache
+
+jobs:
+  # ──────────────────────────────────────────────
+  # Rust lint: fmt + clippy (fast, catches issues early)
+  # ──────────────────────────────────────────────
+  rust-lint:
+    name: Rust Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y protobuf-compiler libwebkit2gtk-4.1-dev libayatana-appindicator3-dev libgtk-3-dev libssl-dev
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Setup sccache
+        uses: mozilla-actions/sccache-action@v0.0.9
+
+      - name: Cargo registry cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+          key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Clippy
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
+  # ──────────────────────────────────────────────
+  # Rust tests: full test suite
+  # ──────────────────────────────────────────────
+  rust-test:
+    name: Rust Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y protobuf-compiler libwebkit2gtk-4.1-dev libayatana-appindicator3-dev libgtk-3-dev libssl-dev
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Setup sccache
+        uses: mozilla-actions/sccache-action@v0.0.9
+
+      - name: Cargo registry cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+          key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-
+
+      - name: Run tests
+        run: cargo test --all-features
+
+  # ──────────────────────────────────────────────
+  # Frontend: vitest unit tests + typecheck
+  # ──────────────────────────────────────────────
+  frontend-test:
+    name: Frontend Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: latest
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: app/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install
+        working-directory: app
+
+      - name: TypeScript check
+        run: pnpm exec tsc --noEmit
+        working-directory: app
+
+      - name: Vitest
+        run: pnpm test
+        working-directory: app
+
+  # ──────────────────────────────────────────────
+  # E2E: Playwright (needs Vite dev server)
+  # ──────────────────────────────────────────────
+  e2e-test:
+    name: E2E Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: latest
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: app/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install
+        working-directory: app
+
+      - name: Install Playwright browsers
+        run: pnpm exec playwright install --with-deps chromium
+        working-directory: app
+
+      - name: Run E2E tests
+        run: pnpm exec playwright test
+        working-directory: app
+        env:
+          CI: true
+
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@v4
+        if: ${{ !cancelled() }}
+        with:
+          name: playwright-report
+          path: app/playwright-report/
+          retention-days: 14
+
+  # ──────────────────────────────────────────────
+  # Gate: all checks must pass
+  # ──────────────────────────────────────────────
+  ci-pass:
+    name: CI Pass
+    if: always()
+    needs: [rust-lint, rust-test, frontend-test, e2e-test]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check results
+        run: |
+          if [[ "${{ needs.rust-lint.result }}" != "success" ||
+                "${{ needs.rust-test.result }}" != "success" ||
+                "${{ needs.frontend-test.result }}" != "success" ||
+                "${{ needs.e2e-test.result }}" != "success" ]]; then
+            echo "One or more CI jobs failed"
+            exit 1
+          fi
+          echo "All CI checks passed"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..f8fea9e
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,282 @@
+name: Release
+
+# Trigger on version tags or manual dispatch
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Version tag (e.g. v0.1.0)"
+        required: true
+        type: string
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+  SCCACHE_GHA_ENABLED: true
+  RUSTC_WRAPPER: sccache
+
+permissions:
+  contents: write # needed for creating releases and uploading assets
+
+jobs:
+  # ──────────────────────────────────────────────
+  # Build matrix: macOS (universal), Windows, Linux
+  # All three run in parallel
+  # ──────────────────────────────────────────────
+
+  build-macos:
+    name: Build macOS (Universal)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-darwin,x86_64-apple-darwin
+
+      - name: Setup sccache
+        uses: mozilla-actions/sccache-action@v0.0.9
+
+      - name: Cargo registry cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+          key: cargo-registry-macos-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-macos-
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: latest
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: app/pnpm-lock.yaml
+
+      - name: Install frontend dependencies
+        run: pnpm install
+        working-directory: app
+
+      # Tauri's built-in universal macOS build (fat binary: arm64 + x86_64)
+      - name: Build Tauri app (universal)
+        run: pnpm tauri build --target universal-apple-darwin
+        working-directory: app
+        env:
+          # TODO: Configure code signing for production releases
+          # APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          # APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          # APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          # APPLE_ID: ${{ secrets.APPLE_ID }}
+          # APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          # APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          CI: true
+
+      - name: Upload macOS DMG
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-dmg
+          path: app/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg
+          if-no-files-found: error
+
+      - name: Upload macOS .app (zipped)
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-app
+          path: app/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app
+          if-no-files-found: error
+
+  build-windows:
+    name: Build Windows
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Setup sccache
+        uses: mozilla-actions/sccache-action@v0.0.9
+
+      - name: Cargo registry cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+          key: cargo-registry-windows-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-windows-
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: latest
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: app/pnpm-lock.yaml
+
+      - name: Install frontend dependencies
+        run: pnpm install
+        working-directory: app
+
+      - name: Build Tauri app
+        run: pnpm tauri build
+        working-directory: app
+        env:
+          # TODO: Configure code signing for production releases
+          # TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          CI: true
+
+      # NSIS installer (.exe) is the modern default; MSI also generated by "all" target
+      - name: Upload Windows NSIS installer
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-nsis
+          path: app/src-tauri/target/release/bundle/nsis/*.exe
+          if-no-files-found: error
+
+      - name: Upload Windows MSI
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-msi
+          path: app/src-tauri/target/release/bundle/msi/*.msi
+          if-no-files-found: warn
+
+  build-linux:
+    name: Build Linux
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            protobuf-compiler \
+            libwebkit2gtk-4.1-dev \
+            libayatana-appindicator3-dev \
+            libgtk-3-dev \
+            libssl-dev \
+            librsvg2-dev \
+            patchelf
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Setup sccache
+        uses: mozilla-actions/sccache-action@v0.0.9
+
+      - name: Cargo registry cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+          key: cargo-registry-linux-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-linux-
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: latest
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: app/pnpm-lock.yaml
+
+      - name: Install frontend dependencies
+        run: pnpm install
+        working-directory: app
+
+      - name: Build Tauri app
+        run: pnpm tauri build
+        working-directory: app
+        env:
+          CI: true
+
+      - name: Upload Linux .deb
+        uses: actions/upload-artifact@v4
+        with:
+          name: linux-deb
+          path: app/src-tauri/target/release/bundle/deb/*.deb
+          if-no-files-found: error
+
+      - name: Upload Linux AppImage
+        uses: actions/upload-artifact@v4
+        with:
+          name: linux-appimage
+          path: app/src-tauri/target/release/bundle/appimage/*.AppImage
+          if-no-files-found: error
+
+  # ──────────────────────────────────────────────
+  # Publish: create GitHub Release with all artifacts
+  # ──────────────────────────────────────────────
+  publish:
+    name: Publish Release
+    needs: [build-macos, build-windows, build-linux]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Determine version
+        id: version
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts/
+
+      - name: List artifacts
+        run: find artifacts/ -type f | sort
+
+      # Flatten all artifacts into a single directory for upload
+      - name: Prepare release assets
+        run: |
+          mkdir -p release-assets
+          # macOS DMG
+          cp artifacts/macos-dmg/*.dmg release-assets/ 2>/dev/null || true
+          # Windows
+          cp artifacts/windows-nsis/*.exe release-assets/ 2>/dev/null || true
+          cp artifacts/windows-msi/*.msi release-assets/ 2>/dev/null || true
+          # Linux
+          cp artifacts/linux-deb/*.deb release-assets/ 2>/dev/null || true
+          cp artifacts/linux-appimage/*.AppImage release-assets/ 2>/dev/null || true
+          # macOS .app -> zip it for release
+          if [ -d "artifacts/macos-app" ]; then
+            cd artifacts/macos-app
+            zip -r "../../release-assets/Variance-macos-universal.app.zip" *.app
+            cd ../..
+          fi
+          echo "Release assets:"
+          ls -lh release-assets/
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.version.outputs.tag }}
+          name: Variance ${{ steps.version.outputs.tag }}
+          draft: true
+          prerelease: ${{ contains(steps.version.outputs.tag, '-') }}
+          generate_release_notes: true
+          files: release-assets/*
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 2ae789112533f43b43db92fc0087c52b89bb9336 Mon Sep 17 00:00:00 2001
From: Zack Kollar <rallokkcaz@gmail.com>
Date: Mon, 16 Mar 2026 23:44:14 -0400
Subject: [PATCH 2/7] :hammer: Update CI and GH actions deps

---
 .github/workflows/ci.yml      | 50 ++++++++++++++++-------
 .github/workflows/release.yml | 76 ++++++++++++++++++++++++-----------
 2 files changed, 89 insertions(+), 37 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 51e6fdf..1026948 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
     name: Rust Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install system dependencies
         run: |
@@ -41,7 +41,7 @@ jobs:
         uses: mozilla-actions/sccache-action@v0.0.9
 
       - name: Cargo registry cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -63,7 +63,7 @@ jobs:
     name: Rust Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install system dependencies
         run: |
@@ -76,7 +76,7 @@ jobs:
         uses: mozilla-actions/sccache-action@v0.0.9
 
       - name: Cargo registry cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -95,17 +95,27 @@ jobs:
     name: Frontend Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: pnpm/action-setup@v4
         with:
           version: latest
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
-          cache: pnpm
-          cache-dependency-path: app/pnpm-lock.yaml
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('app/pnpm-lock.yaml') }}
+          restore-keys: pnpm-store-${{ runner.os }}-
 
       - name: Install dependencies
         run: pnpm install
@@ -126,17 +136,27 @@ jobs:
     name: E2E Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: pnpm/action-setup@v4
         with:
           version: latest
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
-          cache: pnpm
-          cache-dependency-path: app/pnpm-lock.yaml
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('app/pnpm-lock.yaml') }}
+          restore-keys: pnpm-store-${{ runner.os }}-
 
       - name: Install dependencies
         run: pnpm install
@@ -153,11 +173,13 @@ jobs:
           CI: true
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: ${{ !cancelled() }}
         with:
           name: playwright-report
-          path: app/playwright-report/
+          path: |
+            app/test-results/
+            app/playwright-report/
           retention-days: 14
 
   # ──────────────────────────────────────────────
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f8fea9e..8c4c2d6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
     name: Build macOS (Universal)
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -45,7 +45,7 @@ jobs:
         uses: mozilla-actions/sccache-action@v0.0.9
 
       - name: Cargo registry cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -58,11 +58,21 @@ jobs:
         with:
           version: latest
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
-          cache: pnpm
-          cache-dependency-path: app/pnpm-lock.yaml
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('app/pnpm-lock.yaml') }}
+          restore-keys: pnpm-store-${{ runner.os }}-
 
       - name: Install frontend dependencies
         run: pnpm install
@@ -83,14 +93,14 @@ jobs:
           CI: true
 
       - name: Upload macOS DMG
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: macos-dmg
           path: app/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg
           if-no-files-found: error
 
       - name: Upload macOS .app (zipped)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: macos-app
           path: app/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app
@@ -100,7 +110,7 @@ jobs:
     name: Build Windows
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -108,7 +118,7 @@ jobs:
         uses: mozilla-actions/sccache-action@v0.0.9
 
       - name: Cargo registry cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -121,11 +131,21 @@ jobs:
         with:
           version: latest
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
-          cache: pnpm
-          cache-dependency-path: app/pnpm-lock.yaml
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('app/pnpm-lock.yaml') }}
+          restore-keys: pnpm-store-${{ runner.os }}-
 
       - name: Install frontend dependencies
         run: pnpm install
@@ -141,14 +161,14 @@ jobs:
 
       # NSIS installer (.exe) is the modern default; MSI also generated by "all" target
       - name: Upload Windows NSIS installer
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: windows-nsis
           path: app/src-tauri/target/release/bundle/nsis/*.exe
           if-no-files-found: error
 
       - name: Upload Windows MSI
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: windows-msi
           path: app/src-tauri/target/release/bundle/msi/*.msi
@@ -158,7 +178,7 @@ jobs:
     name: Build Linux
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install system dependencies
         run: |
@@ -178,7 +198,7 @@ jobs:
         uses: mozilla-actions/sccache-action@v0.0.9
 
       - name: Cargo registry cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -191,11 +211,21 @@ jobs:
         with:
           version: latest
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
-          cache: pnpm
-          cache-dependency-path: app/pnpm-lock.yaml
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('app/pnpm-lock.yaml') }}
+          restore-keys: pnpm-store-${{ runner.os }}-
 
       - name: Install frontend dependencies
         run: pnpm install
@@ -208,14 +238,14 @@ jobs:
           CI: true
 
       - name: Upload Linux .deb
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: linux-deb
           path: app/src-tauri/target/release/bundle/deb/*.deb
           if-no-files-found: error
 
       - name: Upload Linux AppImage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: linux-appimage
           path: app/src-tauri/target/release/bundle/appimage/*.AppImage
@@ -229,7 +259,7 @@ jobs:
     needs: [build-macos, build-windows, build-linux]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Determine version
         id: version
@@ -241,7 +271,7 @@ jobs:
           fi
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           path: artifacts/
 

From 418325b4fe8bd9b3cdd7f5bece882387f3465437 Mon Sep 17 00:00:00 2001
From: Zack Kollar <rallokkcaz@gmail.com>
Date: Tue, 17 Mar 2026 00:00:54 -0400
Subject: [PATCH 3/7] :hammer: Attempt to fix CI/CD

---
 .github/workflows/ci.yml | 25 ++++++++++++++++++++++++-
 app/src-tauri/src/lib.rs |  5 +++--
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1026948..9b81612 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -130,7 +130,7 @@ jobs:
         working-directory: app
 
   # ──────────────────────────────────────────────
-  # E2E: Playwright (needs Vite dev server)
+  # E2E: Playwright (needs Vite dev server + variance binary)
   # ──────────────────────────────────────────────
   e2e-test:
     name: E2E Tests
@@ -138,6 +138,29 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y protobuf-compiler libwebkit2gtk-4.1-dev libayatana-appindicator3-dev libgtk-3-dev libssl-dev
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Setup sccache
+        uses: mozilla-actions/sccache-action@v0.0.9
+
+      - name: Cargo registry cache
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+          key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-
+
+      - name: Build variance CLI binary
+        run: cargo build --bin variance
+
       - uses: pnpm/action-setup@v4
         with:
           version: latest
diff --git a/app/src-tauri/src/lib.rs b/app/src-tauri/src/lib.rs
index 5605188..9f5a741 100644
--- a/app/src-tauri/src/lib.rs
+++ b/app/src-tauri/src/lib.rs
@@ -4,6 +4,7 @@ mod state;
 use commands::*;
 use state::NodeState;
 use tauri::Manager;
+#[cfg(target_os = "macos")]
 use tauri_plugin_decorum::WebviewWindowExt;
 use tracing::info;
 
@@ -24,10 +25,10 @@ pub fn run() {
         .plugin(tauri_plugin_fs::init())
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_notification::init())
-        .setup(|app| {
+        .setup(|_app| {
             #[cfg(target_os = "macos")]
             {
-                let win = app.get_webview_window("main").unwrap();
+                let win = _app.get_webview_window("main").unwrap();
                 win.set_traffic_lights_inset(12.0, 16.0).unwrap();
             }
             Ok(())

From 2d6e702671399916b448d9e1cb75f04fa9f45ca3 Mon Sep 17 00:00:00 2001
From: Zack Kollar <rallokkcaz@gmail.com>
Date: Tue, 17 Mar 2026 00:14:17 -0400
Subject: [PATCH 4/7] :hammer: Fix config bug, only became apparent in CI

---
 crates/variance-app/src/config.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/crates/variance-app/src/config.rs b/crates/variance-app/src/config.rs
index bf757f2..b718a03 100644
--- a/crates/variance-app/src/config.rs
+++ b/crates/variance-app/src/config.rs
@@ -3,6 +3,9 @@ use std::fs;
 use std::path::{Path, PathBuf};
 
 fn variance_data_dir() -> PathBuf {
+    if let Ok(dir) = std::env::var("VARIANCE_DATA_DIR") {
+        return PathBuf::from(dir);
+    }
     dirs::data_local_dir()
         .unwrap_or_else(|| PathBuf::from("."))
         .join("variance")

From 400164ddc74918c922bfb26f1d261c4748cccd2b Mon Sep 17 00:00:00 2001
From: Zack Kollar <rallokkcaz@gmail.com>
Date: Tue, 17 Mar 2026 00:36:38 -0400
Subject: [PATCH 5/7] :hammer: Add dry-run for releases for iterative
 debugging/workflow runs

---
 .github/workflows/release.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8c4c2d6..f87257f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,6 +11,11 @@ on:
         description: "Version tag (e.g. v0.1.0)"
         required: true
         type: string
+      dry_run:
+        description: "Dry run — build artifacts but skip publishing the GitHub Release"
+        required: false
+        type: boolean
+        default: true
 
 concurrency:
   group: release-${{ github.ref }}
@@ -256,6 +261,7 @@ jobs:
   # ──────────────────────────────────────────────
   publish:
     name: Publish Release
+    if: ${{ github.event_name == 'push' || inputs.dry_run != true }}
     needs: [build-macos, build-windows, build-linux]
     runs-on: ubuntu-latest
     steps:

From bfc1c6607f34696d22775b8cb4fa0839d076cabf Mon Sep 17 00:00:00 2001
From: Zack Kollar <rallokkcaz@gmail.com>
Date: Tue, 17 Mar 2026 00:40:02 -0400
Subject: [PATCH 6/7] :hammer: Fix warnings on CI/CD actions

---
 .github/workflows/ci.yml      | 3 +++
 .github/workflows/release.yml | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b81612..9e3409d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,6 +17,8 @@ env:
   # sccache config
   SCCACHE_GHA_ENABLED: true
   RUSTC_WRAPPER: sccache
+  # sccache-action v0.0.9 still uses Node 20; opt into Node 24 runtime
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
   # ──────────────────────────────────────────────
@@ -203,6 +205,7 @@ jobs:
           path: |
             app/test-results/
             app/playwright-report/
+          if-no-files-found: ignore
           retention-days: 14
 
   # ──────────────────────────────────────────────
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f87257f..07f08ef 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,6 +26,8 @@ env:
   CARGO_INCREMENTAL: 0
   SCCACHE_GHA_ENABLED: true
   RUSTC_WRAPPER: sccache
+  # sccache-action v0.0.9 still uses Node 20; opt into Node 24 runtime
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 permissions:
   contents: write # needed for creating releases and uploading assets

From bfde0b56bc6f6b9a279ae1ace4cfef5768ff692d Mon Sep 17 00:00:00 2001
From: Zack Kollar <rallokkcaz@gmail.com>
Date: Tue, 17 Mar 2026 00:58:01 -0400
Subject: [PATCH 7/7] :hammer: Use forked sccache update version

---
 .github/workflows/ci.yml      | 8 +++-----
 .github/workflows/release.yml | 8 +++-----
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9e3409d..07e042d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,8 +17,6 @@ env:
   # sccache config
   SCCACHE_GHA_ENABLED: true
   RUSTC_WRAPPER: sccache
-  # sccache-action v0.0.9 still uses Node 20; opt into Node 24 runtime
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
   # ──────────────────────────────────────────────
@@ -40,7 +38,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: SeedyROM/sccache-action@v0.0.10
 
       - name: Cargo registry cache
         uses: actions/cache@v5
@@ -75,7 +73,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: SeedyROM/sccache-action@v0.0.10
 
       - name: Cargo registry cache
         uses: actions/cache@v5
@@ -148,7 +146,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: SeedyROM/sccache-action@v0.0.10
 
       - name: Cargo registry cache
         uses: actions/cache@v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 07f08ef..88cbc58 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,8 +26,6 @@ env:
   CARGO_INCREMENTAL: 0
   SCCACHE_GHA_ENABLED: true
   RUSTC_WRAPPER: sccache
-  # sccache-action v0.0.9 still uses Node 20; opt into Node 24 runtime
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 permissions:
   contents: write # needed for creating releases and uploading assets
@@ -49,7 +47,7 @@ jobs:
           targets: aarch64-apple-darwin,x86_64-apple-darwin
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: SeedyROM/sccache-action@v0.0.10
 
       - name: Cargo registry cache
         uses: actions/cache@v5
@@ -122,7 +120,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: SeedyROM/sccache-action@v0.0.10
 
       - name: Cargo registry cache
         uses: actions/cache@v5
@@ -202,7 +200,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: SeedyROM/sccache-action@v0.0.10
 
       - name: Cargo registry cache
         uses: actions/cache@v5