ci(release): debug .sig discovery, disable verify-nix during testing

- Replace the glob find for the .sig file with an explicit target-based
  path ($matrix → src-tauri/target/<target>-apple-darwin/release/bundle/
  macos/Psysonic.app.tar.gz.sig) and dump directory listings so we can
  see what tauri-action actually leaves behind if the path is wrong
- Skip verify-nix while we iterate fast on signing + updater (its auto-
  commits of flake.lock / npmDepsHash cause rebase friction on every
  release)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -128,6 +128,35 @@ jobs:
         with:
           releaseId: ${{ needs.create-release.outputs.release_id }}
           args: ${{ matrix.settings.args }}
+      - name: upload updater signature (macOS only)
+        if: runner.os == 'macOS'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -x
+          VERSION=${{ needs.create-release.outputs.package_version }}
+          TARGET_ARG='${{ matrix.settings.args }}'
+          if echo "$TARGET_ARG" | grep -q 'aarch64'; then
+            TARGET="aarch64-apple-darwin"
+            DST="Psysonic_aarch64.app.tar.gz.sig"
+          else
+            TARGET="x86_64-apple-darwin"
+            DST="Psysonic_x64.app.tar.gz.sig"
+          fi
+
+          BUNDLE_DIR="src-tauri/target/${TARGET}/release/bundle/macos"
+          echo "=== Listing $BUNDLE_DIR ==="
+          ls -la "$BUNDLE_DIR" || true
+          echo "=== Searching whole target tree for .sig ==="
+          find "src-tauri/target" -name '*.sig' -type f 2>/dev/null || true
+
+          SIG="${BUNDLE_DIR}/Psysonic.app.tar.gz.sig"
+          if [ ! -f "$SIG" ]; then
+            echo "::error::Signature not at expected path: $SIG"
+            exit 1
+          fi
+          cp "$SIG" "$DST"
+          gh release upload "app-v${VERSION}" "$DST" --clobber
 
   generate-manifest:
     needs: [create-release, build-macos-windows]
@@ -204,6 +233,11 @@ jobs:
   #
   # The refreshed lock/hash files are committed back to `main` when they change.
   verify-nix:
+    # TEMPORARILY DISABLED during the v1.34.x testing iteration (signing +
+    # updater stabilisation). Remove `if: false` to re-enable — it auto-commits
+    # flake.lock / npmDepsHash refreshes to main on every release, which causes
+    # rebase friction while we're iterating fast on the release pipeline.
+    if: false
     needs: create-release
     runs-on: ubuntu-24.04
     permissions:

CHANGELOG.md

@@ -9,6 +9,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 >
 > **🎉 macOS users:** Starting with **v1.34.15**, Psysonic can **update itself silently**. No more DMG downloading and dragging to Applications — the updater fetches the signed `.app` bundle, verifies the signature, replaces the app in place, and relaunches. Just click "Update" when the toast appears.
 
+## [1.34.16] - 2026-04-18
+
+### Fixed
+
+- **CI — Updater signature upload** *(by [@Psychotoxical](https://github.com/Psychotoxical))*: tauri-action on macOS produces the `.app.tar.gz.sig` minisign signature locally but does not upload it as a release asset for cross-target builds, which caused the `latest.json` manifest generator to fail (no signature to embed). An explicit post-build step now finds the `.sig` under `src-tauri/target/*/release/bundle/macos/` and uploads it with the expected filename (`Psysonic_aarch64.app.tar.gz.sig` / `Psysonic_x64.app.tar.gz.sig`).
+
 ## [1.34.15] - 2026-04-18
 
 ### Added

package.json

@@ -1,6 +1,6 @@
 {
   "name": "psysonic",
-  "version": "1.34.15",
+  "version": "1.34.17",
   "private": true,
   "scripts": {
     "dev": "vite",

src-tauri/Cargo.lock

@@ -3653,7 +3653,7 @@ dependencies = [
 
 [[package]]
 name = "psysonic"
-version = "1.34.15"
+version = "1.34.17"
 dependencies = [
  "biquad",
  "discord-rich-presence",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psysonic"
-version = "1.34.15"
+version = "1.34.17"
 description = "Psysonic Desktop Music Player"
 authors = []
 license = ""

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Psysonic",
-  "version": "1.34.15",
+  "version": "1.34.17",
   "identifier": "dev.psysonic.player",
   "build": {
     "beforeDevCommand": "npm run dev",