Tooling

The build, lint, and release tooling around this monorepo. Each tool below is wired into one or more files in .github/workflows/.

Cargo workspace

The Rust workspace is rooted at Cargo.toml. Every crate inherits authors, repository, license, edition, and rust-version from [workspace.package]. The [patch.crates-io] block redirects tauri, tauri-plugin, and tauri-utils to the local paths so cyclic dev-dependencies (e.g. examples that depend on tauri while being part of the same workspace) resolve correctly.

The release profile is tuned for small binaries:

[profile.release]
panic = "abort"
codegen-units = 1
lto = true
incremental = false
opt-level = "s"
strip = true

There is also release-size-optimized which mirrors release but is intentionally identical so users have a name to depend on.

pnpm workspace

pnpm-workspace.yaml lists the npm packages: packages/api, packages/cli, crates/tauri-schema-worker, and the example apps. The package manager is pinned via package.json#packageManager to pnpm@10.30.3. pnpm install installs everything; pnpm build builds the CLI and API in the right order.

Formatting

Tool	Config	Scope
rustfmt	rustfmt.toml	All Rust files.
prettier	.prettierrc, .prettierignore	All non-Rust files: TS, JS, JSON, YAML, MD.
eslint	packages/*/eslint.config.js	TypeScript in packages/api and packages/cli.

Scripts:

pnpm format            # write
pnpm format:check      # check (CI: fmt.yml)
cargo fmt --all
cargo fmt --all -- --check

Linting

Tool	Command	CI workflow
Clippy	cargo clippy --workspace --all-targets -- -D warnings	lint-rust.yml
ESLint	pnpm eslint:check / pnpm eslint:fix	lint-js.yml
tsc	pnpm ts:check	lint-js.yml

Schema generator

crates/tauri-schema-generator reads the Rust types in crates/tauri-utils/src/config.rs and crates/tauri-utils/src/acl/ and produces:

• crates/tauri-cli/config.schema.json — the user-facing tauri.conf.json schema.
• crates/tauri-schema-generator/schemas/config.schema.json — the canonical copy that the schema worker serves.
• ACL JSON schemas used to validate permissions/*.toml and capabilities/*.json.

cargo run -p tauri-schema-generator

CI: check-generated-files.yml runs the generator and fails on a non-empty diff. Always run it after changing config or ACL types.

Schema worker

crates/tauri-schema-worker is a Cloudflare Worker (TypeScript, deployed via Wrangler) that serves the generated schemas at https://schema.tauri.app. CI deploys it via deploy-schema-worker.yml when changes land in dev.

Covector and release flow

Releases are managed by covector. The flow:

1. PR adds a change file under .changes/ describing which packages bump and why. Format:

   ---
   'tauri': patch:enhance
   '@tauri-apps/api': minor:feat
   ---
   
   Short user-facing summary.

   Tags after the bump (patch:enhance, minor:feat, patch:bug) are aggregated into the changelog.

2. covector-status.yml runs on every PR to sanity-check the change file.

3. check-change-tags.yml ensures every change file uses a known tag.

4. covector-version-or-publish.yml runs on dev. It either opens a "Version Packages" PR (which bumps versions and writes CHANGELOG entries) or, if such a PR was just merged, publishes the artefacts.

5. publish-cli-rs.yml publishes the Rust CLI to crates.io, and publish-cli-js.yml builds platform-specific NPM packages for @tauri-apps/cli (Linux/macOS/Windows × x64/arm64/etc.) and pushes them.

The pinned minimumReleaseAge: 4320 in package.json (4320 minutes ≈ 3 days) is a guard for the npm provenance flow.

Supply chain

• cargo-vet — audits live under audits/ and configuration under supply-chain/config.toml. CI supply-chain.yml runs cargo vet on every PR.
• cargo-audit — CI audit.yml runs against the lockfile.
• cargo-udeps — CI udeps.yml (nightly) flags unused deps.

When you add a new dependency, expect to also add a cargo vet exemption or audit.

CI matrix at a glance

Workflow	Triggers	What it runs
test-core.yml	PR / push	cargo test -p tauri on Linux/macOS/Windows
test-cli-rs.yml	PR / push	cargo test -p tauri-cli
test-cli-js.yml	PR / push	Build @tauri-apps/cli and run its tests
test-android.yml	PR / push	Build an Android target via the CLI
lint-rust.yml	PR / push	Clippy with -D warnings
lint-js.yml	PR / push	ESLint + tsc --noEmit
fmt.yml	PR / push	cargo fmt --check + pnpm format:check
check-license-header.yml	PR / push	License header presence
check-generated-files.yml	PR / push	Re-runs schema generator and diffs
check-change-tags.yml	PR	Validates .changes/*.md tag values
covector-status.yml	PR	Validates change files
covector-version-or-publish.yml	push to dev	Versions or publishes
covector-comment-on-fork.yml	PR from fork	Helpful comment about how to add a change file
publish-cli-js.yml	tag push	Builds and publishes platform npm packages
publish-cli-rs.yml	tag push	Publishes the Rust CLI to crates.io
deploy-schema-worker.yml	push to dev (changes in worker)	Deploys the Cloudflare Worker
audit.yml	scheduled / PR	cargo audit
supply-chain.yml	PR / push	cargo vet
udeps.yml	scheduled	cargo udeps
bench.yml	scheduled / manual	Binary-size and startup benchmarks
docker.yml	manual	Builds the dev container image

Local development containers

.devcontainer/devcontainer.json and .docker/ mirror the CI Linux image (Ubuntu with webkit2gtk-4.1, libgtk-3-dev, the Rust toolchain, Node, pnpm). Use them when an issue reproduces only on Linux.