The `release: published` trigger does not fire for a release whose draft was
created by tauri-action's GITHUB_TOKEN — verified on v0.8.0, which produced
zero workflow runs after publishing, so the Homebrew cask was never bumped and
the tap stayed empty.
Adds `bump_cask` to the workflow_dispatch inputs so the cask bump can be run
on demand for any tag, and switches the cask job to RELEASE_TAG (which resolves
for both dispatch and release events) instead of GITHUB_REF_NAME.
Also stops the cask template's header comment from being rewritten with the
substituted version and checksums on every render.
GitHub is unsuspended, so releases move back from Gitea to GitHub, with the
Gitea mirror kept as a fallback.
- release.yml: re-enable as the active path and wire up Developer-ID signing
+ notarization for the macOS jobs. The Apple steps are guarded on the
secrets being present, so the workflow stays green (ad-hoc signed) until
they are configured.
- release.yml: re-sign the bundled PostgreSQL/MariaDB client binaries with
the Developer ID identity + hardened runtime + timestamp — Apple rejects
ad-hoc-signed nested executables during notarization.
- release.yml: move the Homebrew cask bump to the `release: published` event.
It previously ran on tag push, but the releases/tags API does not serve
drafts, so it could never download the DMGs. It now also skips cleanly
when HOMEBREW_TAP_TOKEN is unset rather than failing the workflow.
- release.yml: drop the stale header note claiming this is not the active
release path.
- README + cask template: point downloads, issues, releases and the Homebrew
tap back at github.com/AdrianBonpin.
adrianbonpin