ci: enhance Tauri signing key handling in workflows

- Added `crypto` module to generate unique environment variable delimiters for Tauri signing keys.
- Updated the way the signing key is written to the environment, ensuring it is securely handled and properly formatted.
- Modified the signing command in the release workflow to remove the direct reference to the private key path, improving security.

.github/workflows/build-main-snapshot.yml

@@ -167,13 +167,20 @@ jobs:
           const fs = require('fs');
           const os = require('os');
           const path = require('path');
+          const crypto = require('crypto');
 
           const keyB64 = process.env.TAURI_SIGNING_PRIVATE_KEY_B64 || '';
           const runnerTemp = process.env.RUNNER_TEMP || os.tmpdir();
           const keyPath = path.join(runnerTemp, 'tauri-updater.key');
+          const keyText = Buffer.from(keyB64, 'base64').toString('utf8').trim();
+          const envDelimiter = `TAURI_KEY_${crypto.randomUUID().replace(/-/g, '')}`;
 
-          fs.writeFileSync(keyPath, Buffer.from(keyB64, 'base64'));
-          fs.appendFileSync(process.env.GITHUB_ENV, `TAURI_SIGNING_PRIVATE_KEY_PATH=${keyPath}\n`);
+          fs.writeFileSync(keyPath, keyText);
+          fs.appendFileSync(
+            process.env.GITHUB_ENV,
+            `TAURI_SIGNING_PRIVATE_KEY<<${envDelimiter}\n${keyText}\n${envDelimiter}\n` +
+              `TAURI_SIGNING_PRIVATE_KEY_PATH=${keyPath}\n`
+          );
 
           console.log(`Tauri updater signing key prepared at: ${keyPath}`);
           NODE

.github/workflows/build-release.yml

@@ -180,13 +180,20 @@ jobs:
           const fs = require('fs');
           const os = require('os');
           const path = require('path');
+          const crypto = require('crypto');
 
           const keyB64 = process.env.TAURI_SIGNING_PRIVATE_KEY_B64 || '';
           const runnerTemp = process.env.RUNNER_TEMP || os.tmpdir();
           const keyPath = path.join(runnerTemp, 'tauri-updater.key');
+          const keyText = Buffer.from(keyB64, 'base64').toString('utf8').trim();
+          const envDelimiter = `TAURI_KEY_${crypto.randomUUID().replace(/-/g, '')}`;
 
-          fs.writeFileSync(keyPath, Buffer.from(keyB64, 'base64'));
-          fs.appendFileSync(process.env.GITHUB_ENV, `TAURI_SIGNING_PRIVATE_KEY_PATH=${keyPath}\n`);
+          fs.writeFileSync(keyPath, keyText);
+          fs.appendFileSync(
+            process.env.GITHUB_ENV,
+            `TAURI_SIGNING_PRIVATE_KEY<<${envDelimiter}\n${keyText}\n${envDelimiter}\n` +
+              `TAURI_SIGNING_PRIVATE_KEY_PATH=${keyPath}\n`
+          );
 
           console.log(`Tauri updater signing key prepared at: ${keyPath}`);
           NODE
@@ -261,7 +268,7 @@ jobs:
           New-Item -ItemType File -Path (Join-Path $dataDir ".keep") -Force | Out-Null
 
           Compress-Archive -Path $portableDir -DestinationPath $assetPath -Force
-          pnpm tauri signer sign --private-key-path "$env:TAURI_SIGNING_PRIVATE_KEY_PATH" --password "$env:TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$assetPath"
+          pnpm tauri signer sign --password "$env:TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$assetPath"
 
           $signaturePath = "$assetPath.sig"
           if (-not (Test-Path $signaturePath)) {