Full codebase audit: Linux support merge, Svelte 5 fixes, perf, #20/#22/#32/#34, dead code purge, 3-OS CI

.github/workflows/ci.yml

@@ -0,0 +1,142 @@
+name: CI
+
+# PR-only by design: pushing to a branch (including main via a merged PR)
+# must never rebuild or retest on its own — releases are cut exclusively
+# by v* tags (release.yml), and the repo owner was explicit that a bare
+# push should not light up CI. workflow_dispatch covers manual runs.
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  linux:
+    name: Linux (test + package)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.12'
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20.19.2'
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install Linux build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev
+
+      - name: Install pinned build tools
+        run: |
+          go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-alpha.74
+          go install github.com/go-task/task/v3/cmd/task@v3.45.4
+          echo "$HOME/go/bin" >> "$GITHUB_PATH"
+
+      # main.go embeds frontend/dist, so the frontend must exist before any
+      # command that loads the root Go package (test, vet, or bindings).
+      - name: Build frontend
+        working-directory: frontend
+        run: |
+          npm ci
+          npm run build
+
+      - name: Test and vet
+        run: |
+          go test -race ./...
+          go vet ./...
+
+      - name: Build native Linux binary
+        run: task linux:build ARCH=amd64
+
+      - name: Check runtime linking
+        run: |
+          file bin/wireguide
+          if ldd bin/wireguide | grep -q 'not found'; then
+            ldd bin/wireguide
+            exit 1
+          fi
+
+      - name: Build and inspect DEB
+        env:
+          GOARCH: amd64
+          GIT_COMMITTER_NAME: WireGuide CI
+          GIT_COMMITTER_EMAIL: noreply@example.com
+        run: |
+          wails3 tool package -name wireguide -format deb -config ./build/linux/nfpm/nfpm.yaml -out ./bin
+          dpkg-deb --info bin/wireguide.deb
+          dpkg-deb --contents bin/wireguide.deb
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: linux-amd64-ci
+          path: |
+            bin/wireguide
+            bin/wireguide.deb
+          if-no-files-found: error
+          retention-days: 7
+
+  macos:
+    name: macOS (test)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.12'
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20.19.2'
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Build frontend
+        working-directory: frontend
+        run: |
+          npm ci
+          npm run build
+
+      - name: Test and vet
+        run: |
+          go test -race ./...
+          go vet ./...
+
+  windows:
+    name: Windows (test)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.12'
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20.19.2'
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Build frontend
+        working-directory: frontend
+        shell: pwsh
+        run: |
+          npm ci
+          npm run build
+
+      # No -race on Windows: the race detector needs cgo + a C toolchain,
+      # and the runner's mingw setup is not something we want this suite
+      # to depend on. The Linux job's -race pass covers the shared code.
+      - name: Test and vet
+        shell: pwsh
+        run: |
+          go test ./...
+          go vet ./...

.github/workflows/release.yml

@@ -34,16 +34,16 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.25'
+          go-version: '1.25.12'
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '20.19.2'
 
       - name: Install wails3 + task
         run: |
-          go install github.com/wailsapp/wails/v3/cmd/wails3@latest
-          go install github.com/go-task/task/v3/cmd/task@latest
+          go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-alpha.74
+          go install github.com/go-task/task/v3/cmd/task@v3.45.4
           echo "$HOME/go/bin" >> "$GITHUB_PATH"
 
       - name: Build .app bundle (ad-hoc signed)
@@ -87,17 +87,17 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.25'
+          go-version: '1.25.12'
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '20.19.2'
 
       - name: Install wails3 + task
         shell: pwsh
         run: |
-          go install github.com/wailsapp/wails/v3/cmd/wails3@latest
-          go install github.com/go-task/task/v3/cmd/task@latest
+          go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-alpha.74
+          go install github.com/go-task/task/v3/cmd/task@v3.45.4
           # Append, don't overwrite — PATH already has system entries.
           "$env:USERPROFILE\go\bin" | Out-File -FilePath $env:GITHUB_PATH -Append
 
@@ -253,7 +253,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.25'
+          go-version: '1.25.12'
 
       - name: Sign SHA256SUMS (Ed25519)
         # HARD failure when the key is missing or mismatched — every

.gitignore

@@ -4,6 +4,7 @@ bin
 frontend/dist
 frontend/node_modules
 build/linux/appimage/build
+build/linux/wireguide.desktop
 build/windows/nsis/MicrosoftEdgeWebview2Setup.exe
 
 # Go

CONTRIBUTING.md

@@ -8,14 +8,14 @@ Thanks for your interest in contributing!
 
 - Go 1.25+
 - Node.js 20+
-- [Wails v3](https://v3alpha.wails.io/) (`go install github.com/wailsapp/wails/v3/cmd/wails3@latest`)
+- [Wails v3](https://v3alpha.wails.io/) (`go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-alpha.74`)
 - macOS with Apple Silicon (for now)
 
 ### Build & Run
 
 ```bash
 # Install frontend dependencies
-cd frontend && npm install && cd ..
+cd frontend && npm ci && cd ..
 
 # Development mode (hot reload)
 task dev

README.ko.md

@@ -65,8 +65,8 @@ brew install --cask wireguide
 
 ```bash
 brew install go node
-go install github.com/go-task/task/v3/cmd/task@latest
-go install github.com/wailsapp/wails/v3/cmd/wails3@latest
+go install github.com/go-task/task/v3/cmd/task@v3.45.4
+go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-alpha.74
 
 task build
 ./bin/wireguide

README.md

@@ -136,8 +136,8 @@ installer registers the helper service and shortcut.
 
 ```bash
 brew install go node
-go install github.com/go-task/task/v3/cmd/task@latest
-go install github.com/wailsapp/wails/v3/cmd/wails3@latest
+go install github.com/go-task/task/v3/cmd/task@v3.45.4
+go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-alpha.74
 
 task build
 ./bin/wireguide

build/Taskfile.yml

@@ -19,7 +19,7 @@ tasks:
       - sh: npm version
         msg: "Looks like npm isn't installed. Npm is part of the Node installer: https://nodejs.org/en/download/"
     cmds:
-      - npm install
+      - npm ci
 
   build:frontend:
     label: build:frontend (DEV={{.DEV}})

build/linux/Taskfile.yml

@@ -142,6 +142,8 @@ tasks:
     cmds:
       - task: generate:dotdesktop
       - task: generate:deb
+        vars:
+          ARCH: '{{.ARCH | default ARCH}}'
 
   create:rpm:
     summary: Creates a rpm package
@@ -150,6 +152,8 @@ tasks:
     cmds:
       - task: generate:dotdesktop
       - task: generate:rpm
+        vars:
+          ARCH: '{{.ARCH | default ARCH}}'
 
   create:aur:
     summary: Creates a arch linux packager package
@@ -158,19 +162,27 @@ tasks:
     cmds:
       - task: generate:dotdesktop
       - task: generate:aur
+        vars:
+          ARCH: '{{.ARCH | default ARCH}}'
 
   generate:deb:
     summary: Creates a deb package
+    env:
+      GOARCH: '{{.ARCH | default ARCH}}'
     cmds:
       - wails3 tool package -name "{{.APP_NAME}}" -format deb -config ./build/linux/nfpm/nfpm.yaml -out {{.ROOT_DIR}}/bin
 
   generate:rpm:
     summary: Creates a rpm package
+    env:
+      GOARCH: '{{.ARCH | default ARCH}}'
     cmds:
       - wails3 tool package -name "{{.APP_NAME}}" -format rpm -config ./build/linux/nfpm/nfpm.yaml -out {{.ROOT_DIR}}/bin
 
   generate:aur:
     summary: Creates a arch linux packager package
+    env:
+      GOARCH: '{{.ARCH | default ARCH}}'
     cmds:
       - wails3 tool package -name "{{.APP_NAME}}" -format archlinux -config ./build/linux/nfpm/nfpm.yaml -out {{.ROOT_DIR}}/bin
 

build/linux/nfpm/nfpm.yaml

@@ -24,20 +24,35 @@ contents:
   - src: "./build/linux/wireguide.desktop"
     dst: "/usr/share/applications/wireguide.desktop"
 
-# Default dependencies for Debian 12/Ubuntu 22.04+ with WebKit 4.1
+# Wails v3 alpha.74 uses GTK3 and the WebKitGTK 4.1 API on Linux.
 depends:
   - libgtk-3-0
   - libwebkit2gtk-4.1-0
+  - libayatana-appindicator3-1
+  - iproute2
+  - nftables
+  - pkexec | policykit-1
+
+# NetworkManager supplies SSID detection and immediate Wi-Fi change events,
+# while resolvconf avoids the guarded /etc/resolv.conf fallback on systems
+# that do not run systemd-resolved. Noto supplies Korean UI glyphs and stable
+# cross-platform text metrics. The core client can still operate without these,
+# so keep them as recommendations rather than hard dependencies.
+recommends:
+  - network-manager
+  - resolvconf
+  - fonts-noto-core
+  - fonts-noto-cjk
 
 # Distribution-specific overrides for different package formats and WebKit versions
 overrides:
-  # RPM packages for RHEL/CentOS/AlmaLinux/Rocky Linux (WebKit 4.0)
+  # RPM package names used by current Fedora/RHEL-family distributions.
   rpm:
     depends:
       - gtk3
       - webkit2gtk4.1
 
-  # Arch Linux packages (WebKit 4.1)  
+  # Arch Linux package names.
   archlinux:
     depends:
       - gtk3