chore: ignore Task cache directory

Task (used by wails3 via Taskfile.yml) stores incremental-build fingerprints under .task/checksum/. Purely local cache — hashes of sources/deps, machine-generated, recreated on next wails3 dev/build. Keep it out of git like node_modules/frontend/dist/build/bin (already ignored). No files were tracked; this just stops it showing as untracked on branches that have run wails3.
fix(ci): track frontend lockfile for reproducible installs
2026-09-13 18:01:01 -04:00 · 2026-09-12 22:40:21 -04:00 · 2026-09-12 22:26:12 -04:00 · 2026-09-12 21:27:12 -04:00 · 2026-09-12 21:26:25 -04:00 · 2026-09-12 21:23:14 -04:00
11 changed files with 3268 additions and 96 deletions
@@ -0,0 +1,280 @@
+name: Release
+
+# Overrides the default run name (the tagged commit's message) so the Actions
+# runs list shows "Release 1.6.7" instead.
+run-name: "Release ${{ gitea.event.inputs.tag || gitea.ref_name }}"
+
+# Builds the Wails Linux binary via `make build`, packages
+# AniTrack-<version>.tar.gz from build/, and creates/updates a Gitea Release
+# named AniTrack-<version> with the archive attached. Triggered by a plain
+# version tag push (1.6.7), or manually via workflow_dispatch with a tag for
+# re-runs and secrets tests. Pushing to main does nothing, so
+# work-in-progress commits never ship.
+#
+# Local flow: `./release 1.6.7` (or `make release VERSION=1.6.7`) bumps
+# wails.json, commits the bump, creates an annotated tag carrying the
+# git-cliff notes, and pushes commit + tag. This workflow verifies
+# wails.json matches the tag before building.
+#
+# Secrets test (verifies environment.go wiring without shipping): tag the
+# current bumped commit with a suffix and push, e.g.
+#   git tag 1.6.7-rc1 && git push origin 1.6.7-rc1
+# Tags containing '-' are published as pre-releases; delete the test
+# Release/tag afterwards.
+on:
+  push:
+    tags:
+      - '[0-9]*.[0-9]*.[0-9]*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to release (e.g. 1.6.7)'
+        required: true
+        type: string
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      # Resolve the target tag for both triggers: explicit input on manual
+      # dispatch, otherwise the pushed tag ref.
+      TAG: ${{ gitea.event.inputs.tag || gitea.ref_name }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # Full history ensures the tag annotation (the release notes) is present.
+          fetch-depth: 0
+          ref: ${{ gitea.event.inputs.tag || gitea.ref }}
+
+      - name: Guard wails.json matches tag
+        run: |
+          set -euo pipefail
+          : "${TAG:?TAG is required}"
+          # Normalize "v1.6.7" / "AniTrack-1.6.7" to plain "1.6.7" (make release
+          # only ever creates plain tags; this tolerates manual typos).
+          NORM="${TAG#v}"
+          NORM="${NORM#AniTrack-}"
+          BASE="${NORM%%-*}"
+          WAILS_VER="$(python3 -c "import json; print(json.load(open('wails.json'))['info']['productVersion'])")"
+          if [ "${NORM}" = "${BASE}" ]; then
+            if [ "${WAILS_VER}" != "${NORM}" ]; then
+              echo "::error::wails.json productVersion (${WAILS_VER}) != tag (${NORM}). Bump via ./release ${NORM} first." >&2
+              exit 1
+            fi
+          else
+            # Pre-release (e.g. 1.6.7-rc1): wails.json must match the base version.
+            if [ "${WAILS_VER}" != "${BASE}" ]; then
+              echo "::error::wails.json productVersion (${WAILS_VER}) != tag base (${BASE}). Bump via ./release ${BASE} first." >&2
+              exit 1
+            fi
+          fi
+          echo "VERSION=${NORM}" >> "${GITHUB_ENV}"
+          echo "Version guard passed: wails.json=${WAILS_VER} tag=${NORM}"
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache-dependency-path: go.sum
+
+      - name: Cache Go build cache
+        uses: actions/cache@v4
+        with:
+          # setup-go only caches modules (GOMODCACHE). This caches compiled
+          # packages (GOCACHE) so the cgo/WebKit compile goes incremental.
+          # restore-keys gives a close cache instead of a cold one when
+          # go.sum changes. First run after adding this still compiles cold
+          # (it saves); the payoff shows from the second run on.
+          path: ~/.cache/go-build
+          key: go-build-1.25-${{ runner.os }}-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            go-build-1.25-${{ runner.os }}-
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          # Caches npm's download cache keyed on the frontend lockfile, so
+          # the `npm install` inside `wails build` stops fetching cold.
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install Wails Linux build dependencies
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential pkg-config \
+            libgtk-3-dev libwebkit2gtk-4.1-dev \
+            jq
+
+      - name: Cache Wails CLI
+        uses: actions/cache@v4
+        id: wails-cli
+        with:
+          # The compiled CLI binary. Bump the key whenever the @version pin
+          # below changes, or the old CLI will be silently reused.
+          path: ~/go/bin/wails
+          key: wails-v2.15.0-${{ runner.os }}
+
+      - name: Install Wails CLI
+        if: steps.wails-cli.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          go install github.com/wailsapp/wails/v2/cmd/wails@v2.15.0
+
+      - name: Add Go bin to PATH
+        run: echo "${HOME}/go/bin" >> "${GITHUB_PATH}"
+
+      - name: Write environment.go from secrets
+        env:
+          ANILIST_SECRET_TOKEN: ${{ secrets.ANILIST_SECRET_TOKEN }}
+          ANILIST_APP_ID: ${{ secrets.ANILIST_APP_ID }}
+          ANILIST_APP_NAME: ${{ secrets.ANILIST_APP_NAME }}
+          ANILIST_CALLBACK_URI: ${{ secrets.ANILIST_CALLBACK_URI }}
+          SIMKL_CLIENT_ID: ${{ secrets.SIMKL_CLIENT_ID }}
+          SIMKL_CLIENT_SECRET: ${{ secrets.SIMKL_CLIENT_SECRET }}
+          SIMKL_CALLBACK_URI: ${{ secrets.SIMKL_CALLBACK_URI }}
+          MAL_CLIENT_ID: ${{ secrets.MAL_CLIENT_ID }}
+          MAL_CLIENT_SECRET: ${{ secrets.MAL_CLIENT_SECRET }}
+          MAL_CALLBACK_URI: ${{ secrets.MAL_CALLBACK_URI }}
+        run: |
+          set -euo pipefail
+          # All 10 fields come from Gitea Actions secrets (never committed).
+          # Values are masked in logs; do not echo them or run with set -x.
+          for v in ANILIST_SECRET_TOKEN ANILIST_APP_ID ANILIST_APP_NAME ANILIST_CALLBACK_URI SIMKL_CLIENT_ID SIMKL_CLIENT_SECRET SIMKL_CALLBACK_URI MAL_CLIENT_ID MAL_CLIENT_SECRET MAL_CALLBACK_URI; do
+            if [ -z "${!v:-}" ]; then
+              echo "::error::Missing secret ${v}. Add it under Settings → Secrets → Actions." >&2
+              exit 1
+            fi
+          done
+          cat > environment.go <<EOF
+          package main
+
+          var Environment = EnvironmentStruct{
+          	ANILIST_SECRET_TOKEN: "${ANILIST_SECRET_TOKEN}",
+          	ANILIST_APP_ID:       "${ANILIST_APP_ID}",
+          	ANILIST_APP_NAME:     "${ANILIST_APP_NAME}",
+          	ANILIST_CALLBACK_URI: "${ANILIST_CALLBACK_URI}",
+          	SIMKL_CLIENT_ID:      "${SIMKL_CLIENT_ID}",
+          	SIMKL_CLIENT_SECRET:  "${SIMKL_CLIENT_SECRET}",
+          	SIMKL_CALLBACK_URI:   "${SIMKL_CALLBACK_URI}",
+          	MAL_CLIENT_ID:        "${MAL_CLIENT_ID}",
+          	MAL_CLIENT_SECRET:    "${MAL_CLIENT_SECRET}",
+          	MAL_CALLBACK_URI:     "${MAL_CALLBACK_URI}",
+          }
+          EOF
+          echo "Wrote environment.go from secrets."
+
+      - name: Build Linux binary
+        run: |
+          set -euo pipefail
+          export PATH="${HOME}/go/bin:${PATH}"
+          make build
+          test -x build/bin/AniTrack || { echo "::error::build/bin/AniTrack missing after make build" >&2; exit 1; }
+
+      - name: Package release archive
+        run: |
+          set -euo pipefail
+          : "${VERSION:?VERSION missing from version-guard step}"
+          STAGE="dist/AniTrack-${VERSION}"
+          rm -rf dist "AniTrack-${VERSION}.tar.gz"
+          mkdir -p "${STAGE}/bin"
+          cp build/bin/AniTrack "${STAGE}/bin/"
+          cp -r build/icon "${STAGE}/"
+          cp build/AniTrack.desktop build/install_linux.sh build/README.md "${STAGE}/"
+          chmod +x "${STAGE}/bin/AniTrack" "${STAGE}/install_linux.sh"
+          tar -czf "AniTrack-${VERSION}.tar.gz" -C dist "AniTrack-${VERSION}"
+          tar tzf "AniTrack-${VERSION}.tar.gz"
+          echo "ARCHIVE=AniTrack-${VERSION}.tar.gz" >> "${GITHUB_ENV}"
+
+      - name: Create Gitea Release
+        env:
+          # REGISTRY_TOKEN is reused for release creation because Gitea's auto
+          # token cannot create releases on this instance. The PAT must carry
+          # write:repository scope. Idempotent: re-runs update an existing
+          # release for this tag instead of failing with 409. On any HTTP error
+          # the API response body is printed so a 403 names the missing scope.
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          REPO: ${{ gitea.repository }}
+        run: |
+          set -euo pipefail
+          : "${TAG:?TAG is required}"
+          : "${VERSION:?VERSION missing from version-guard step}"
+          API="https://git.linuxhg.com/api/v1/repos/${REPO}/releases"
+          AUTH="Authorization: token ${TOKEN}"
+          # Release body = the annotated tag's message (the git-cliff notes).
+          # Manual test tags without an annotation fall back to the tag name.
+          BODY="$(git tag -l --format='%(contents)' "${TAG}")"
+          if [ -z "$(printf '%s' "${BODY}" | tr -d '[:space:]')" ]; then
+            BODY="${TAG}"
+          fi
+
+          # Tags containing a '-' (e.g. 1.6.7-rc1) are published as pre-releases.
+          PRE="false"; case "${TAG}" in *-*) PRE="true";; esac
+
+          PAYLOAD=$(jq -n \
+            --arg t "${TAG}" --arg n "AniTrack-${VERSION}" --arg b "${BODY}" --argjson p "${PRE}" \
+            '{tag_name:$t, name:$n, body:$b, draft:false, prerelease:$p}')
+
+          # POST/PATCH the release, surfacing Gitea's error message on failure
+          # (e.g. "token does not have write scope") instead of failing silently.
+          api_call() {
+            local method="$1" url="$2" resp code rbody
+            resp="$(curl -sS -w '\n%{http_code}' -X "${method}" \
+              -H "${AUTH}" -H "Content-Type: application/json" \
+              -d "${PAYLOAD}" "${url}")"
+            code="$(printf '%s' "${resp}" | tail -n1)"
+            rbody="$(printf '%s' "${resp}" | sed '$d')"
+            if [ "${code}" -ge 400 ]; then
+              echo "::error::Release API ${code} (${method} ${url}): ${rbody}" >&2
+              return 1
+            fi
+          }
+
+          EXISTING_ID="$(curl -sS -H "${AUTH}" "${API}/tags/${TAG}" | jq -r '.id // empty' 2>/dev/null || true)"
+          if [ -n "${EXISTING_ID}" ]; then
+            api_call PATCH "${API}/${EXISTING_ID}"
+            echo "Updated existing release id=${EXISTING_ID} for ${TAG}"
+          else
+            api_call POST "${API}"
+            echo "Created new release for ${TAG}"
+          fi
+
+      - name: Upload release archive
+        env:
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          REPO: ${{ gitea.repository }}
+        run: |
+          set -euo pipefail
+          : "${TAG:?TAG is required}"
+          : "${ARCHIVE:?ARCHIVE missing from packaging step}"
+          API="https://git.linuxhg.com/api/v1/repos/${REPO}/releases"
+          AUTH="Authorization: token ${TOKEN}"
+          test -f "${ARCHIVE}" || { echo "::error::${ARCHIVE} not found" >&2; exit 1; }
+
+          RID="$(curl -sS -H "${AUTH}" "${API}/tags/${TAG}" | jq -r '.id // empty')"
+          if [ -z "${RID}" ]; then
+            echo "::error::No release found for tag ${TAG} after create step" >&2
+            exit 1
+          fi
+
+          # Replace a same-named asset so re-runs stay idempotent.
+          AID="$(curl -sS -H "${AUTH}" "${API}/${RID}/assets" | jq -r --arg n "${ARCHIVE}" '.[] | select(.name==$n) | .id // empty')"
+          if [ -n "${AID}" ]; then
+            curl -sS -X DELETE -H "${AUTH}" "${API}/${RID}/assets/${AID}" >/dev/null
+            echo "Deleted existing asset id=${AID} (${ARCHIVE})"
+          fi
+
+          resp="$(curl -sS -w '\n%{http_code}' -X POST -H "${AUTH}" \
+            -F "attachment=@${ARCHIVE}" "${API}/${RID}/assets?name=${ARCHIVE}")"
+          code="$(printf '%s' "${resp}" | tail -n1)"
+          rbody="$(printf '%s' "${resp}" | sed '$d')"
+          if [ "${code}" -ge 400 ]; then
+            echo "::error::Asset upload ${code}: ${rbody}" >&2
+            exit 1
+          fi
+          echo "Uploaded ${ARCHIVE} to release id=${RID}"
@@ -23,10 +23,13 @@ go.work

 # ---> Wails
 build/bin
+.task/
 node_modules
 frontend/dist
 package.json.md5
-package-lock.json
+# Root-level lockfile only: the frontend lockfile IS tracked so CI installs
+# are reproducible and setup-node's npm cache has something to hash.
+/package-lock.json
 .idea
 .env
 environment.go
@@ -383,7 +383,7 @@ func (a *App) AniListSearch(query string) (interface{}, error) {
 			ListType: "ANIME",
 		},
 	}
-	returnedBody, status := AniListQuery(body, false)
+	returnedBody, status := AniListQuery(body, a.CheckIfAniListLoggedIn())
 	if status != "200 OK" {
 		return nil, aniListSearchStatusError(status, returnedBody)
 	}
@@ -19,18 +19,48 @@ import (

 var aniListJwt AniListJWT

-var aniRing, _ = keyring.Open(keyring.Config{
+var aniRing keyring.Keyring
+
+func init() {
+	var err error
+	aniRing, err = keyring.Open(keyring.Config{
 		ServiceName:                    "AniTrack",
 		KeychainName:                   "AniTrack",
 		KeychainSynchronizable:         false,
 		KeychainTrustApplication:       true,
 		KeychainAccessibleWhenUnlocked: true,
 	})
+	if err != nil {
+		log.Printf("anilist: secure storage unavailable: %s", err)
+	}
+}
+
+func aniRingReady() bool {
+	if aniRing == nil {
+		log.Println("anilist: secure storage unavailable")
+		return false
+	}
+	return true
+}
+
+func aniRingSet(key string, data []byte) error {
+	if !aniRingReady() {
+		return errors.New("anilist: secure storage unavailable")
+	}
+	if err := aniRing.Set(keyring.Item{Key: key, Data: data}); err != nil {
+		log.Printf("anilist: save %s failed: %s", key, err)
+		return err
+	}
+	return nil
+}

 var aniCtxShutdown, aniCancel = context.WithCancel(context.Background())

 func (a *App) CheckIfAniListLoggedIn() bool {
 	if (AniListJWT{} == aniListJwt) {
+		if !aniRingReady() {
+			return false
+		}
 		tokenType, tokenErr := aniRing.Get("anilistTokenType")
 		expiresIn, expiresInErr := aniRing.Get("anilistTokenExpiresIn")
 		refreshToken, refreshTokenErr := aniRing.Get("anilistRefreshToken")
@@ -38,10 +68,15 @@ func (a *App) CheckIfAniListLoggedIn() bool {
 		if (tokenErr != nil || expiresInErr != nil || refreshTokenErr != nil || accessTokenErr != nil) || len(accessToken.Data) == 0 {
 			return false
 		} else {
+			var expiresInConvertErr error
 			aniListJwt.TokenType = string(tokenType.Data)
 			aniListJwt.AccessToken = string(accessToken.Data)
 			aniListJwt.RefreshToken = string(refreshToken.Data)
-			aniListJwt.ExpiresIn, _ = strconv.Atoi(string(expiresIn.Data))
+			aniListJwt.ExpiresIn, expiresInConvertErr = strconv.Atoi(string(expiresIn.Data))
+			if expiresInConvertErr != nil {
+				log.Printf("anilist: invalid expiresIn %q: %s", string(expiresIn.Data), expiresInConvertErr)
+				return false
+			}
 			return true
 		}
 	} else {
@@ -51,6 +86,10 @@ func (a *App) CheckIfAniListLoggedIn() bool {

 func (a *App) AniListLogin() {
 	if (AniListJWT{} == aniListJwt) {
+		if !aniRingReady() {
+			log.Println("anilist: cannot check login, secure storage unavailable")
+			return
+		}
 		tokenType, tokenErr := aniRing.Get("anilistTokenType")
 		expiresIn, expiresInErr := aniRing.Get("anilistTokenExpiresIn")
 		refreshToken, refreshTokenErr := aniRing.Get("anilistRefreshToken")
@@ -64,10 +103,14 @@ func (a *App) AniListLogin() {
 			a.handleAniListCallback(serverDone)
 			serverDone.Wait()
 		} else {
+			var expiresInConvertErr error
 			aniListJwt.TokenType = string(tokenType.Data)
 			aniListJwt.AccessToken = string(accessToken.Data)
 			aniListJwt.RefreshToken = string(refreshToken.Data)
-			aniListJwt.ExpiresIn, _ = strconv.Atoi(string(expiresIn.Data))
+			aniListJwt.ExpiresIn, expiresInConvertErr = strconv.Atoi(string(expiresIn.Data))
+			if expiresInConvertErr != nil {
+				log.Printf("anilist: invalid expiresIn %q: %s", string(expiresIn.Data), expiresInConvertErr)
+			}
 		}
 	}
 }
@@ -85,22 +128,10 @@ func (a *App) handleAniListCallback(wg *sync.WaitGroup) {
 		content := r.FormValue("code")
 		if content != "" {
 			aniListJwt = getAniListAuthorizationToken(content)
-			_ = aniRing.Set(keyring.Item{
-				Key:  "anilistTokenType",
-				Data: []byte(aniListJwt.TokenType),
-			})
-			_ = aniRing.Set(keyring.Item{
-				Key:  "anilistTokenExpiresIn",
-				Data: []byte(strconv.Itoa(aniListJwt.ExpiresIn)),
-			})
-			_ = aniRing.Set(keyring.Item{
-				Key:  "anilistAccessToken",
-				Data: []byte(aniListJwt.AccessToken),
-			})
-			_ = aniRing.Set(keyring.Item{
-				Key:  "anilistRefreshToken",
-				Data: []byte(aniListJwt.RefreshToken),
-			})
+			_ = aniRingSet("anilistTokenType", []byte(aniListJwt.TokenType))
+			_ = aniRingSet("anilistTokenExpiresIn", []byte(strconv.Itoa(aniListJwt.ExpiresIn)))
+			_ = aniRingSet("anilistAccessToken", []byte(aniListJwt.AccessToken))
+			_ = aniRingSet("anilistRefreshToken", []byte(aniListJwt.RefreshToken))
 			_, err := runtime.MessageDialog(*wailsContext, runtime.MessageDialogOptions{
 				Title:   "AniList Authorization",
 				Message: "It is now safe to close your browser tab",
@@ -208,12 +239,16 @@ func (a *App) GetAniListLoggedInUser() AniListUser {

 func (a *App) LogoutAniList() string {
 	if (AniListJWT{} != aniListJwt) {
+		if !aniRingReady() {
+			aniListJwt = AniListJWT{}
+			return "AniList Logged Out Successfully"
+		}
 		typeErr := aniRing.Remove("anilistTokenType")
 		expiresInErr := aniRing.Remove("anilistTokenExpiresIn")
 		accessTokenErr := aniRing.Remove("anilistAccessToken")
 		refreshTokenErr := aniRing.Remove("anilistRefreshToken")
 		if typeErr != nil || expiresInErr != nil || accessTokenErr != nil || refreshTokenErr != nil {
-			fmt.Println("AniList Logout Failed")
+			log.Printf("anilist: logout cleanup failed (type=%v expires=%v access=%v refresh=%v)", typeErr, expiresInErr, accessTokenErr, refreshTokenErr)
 		}
 		aniListJwt = AniListJWT{}
 	}
@@ -23,13 +23,40 @@ import (

 var myAnimeListJwt MyAnimeListJWT

-var myAnimeListRing, _ = keyring.Open(keyring.Config{
+var myAnimeListRing keyring.Keyring
+
+func init() {
+	var err error
+	myAnimeListRing, err = keyring.Open(keyring.Config{
 		ServiceName:                    "AniTrack",
 		KeychainName:                   "AniTrack",
 		KeychainSynchronizable:         false,
 		KeychainTrustApplication:       true,
 		KeychainAccessibleWhenUnlocked: true,
 	})
+	if err != nil {
+		log.Printf("mal: secure storage unavailable: %s", err)
+	}
+}
+
+func malRingReady() bool {
+	if myAnimeListRing == nil {
+		log.Println("mal: secure storage unavailable")
+		return false
+	}
+	return true
+}
+
+func malRingSet(key string, data []byte) error {
+	if !malRingReady() {
+		return errors.New("mal: secure storage unavailable")
+	}
+	if err := myAnimeListRing.Set(keyring.Item{Key: key, Data: data}); err != nil {
+		log.Printf("mal: save %s failed: %s", key, err)
+		return err
+	}
+	return nil
+}

 var myAnimeListCtxShutdown, myAnimeListCancel = context.WithCancel(context.Background())

@@ -72,10 +99,13 @@ func (v *CodeVerifier) CodeChallengeS256() string {

 func (a *App) CheckIfMyAnimeListLoggedIn() bool {
 	if (MyAnimeListJWT{} == myAnimeListJwt) {
+		if !malRingReady() {
+			return false
+		}
 		tokenType, tokenErr := myAnimeListRing.Get("MyAnimeListTokenType")
 		expiresIn, expiresInErr := myAnimeListRing.Get("MyAnimeListExpiresIn")
-		refreshToken, refreshTokenErr := myAnimeListRing.Get("MyAnimeListAccessToken")
-		accessToken, accessTokenErr := myAnimeListRing.Get("MyAnimeListRefreshToken")
+		accessToken, accessTokenErr := myAnimeListRing.Get("MyAnimeListAccessToken")
+		refreshToken, refreshTokenErr := myAnimeListRing.Get("MyAnimeListRefreshToken")
 		if (tokenErr != nil || expiresInErr != nil || refreshTokenErr != nil || accessTokenErr != nil) || len(accessToken.Data) == 0 {
 			return false
 		} else {
@@ -83,7 +113,8 @@ func (a *App) CheckIfMyAnimeListLoggedIn() bool {
 			myAnimeListJwt.TokenType = string(tokenType.Data)
 			myAnimeListJwt.ExpiresIn, expiresInConvertErr = strconv.Atoi(string(expiresIn.Data))
 			if expiresInConvertErr != nil {
-				fmt.Println("unable to convert string to int")
+				log.Printf("mal: invalid expiresIn %q: %s", string(expiresIn.Data), expiresInConvertErr)
+				return false
 			}
 			myAnimeListJwt.AccessToken = string(accessToken.Data)
 			myAnimeListJwt.RefreshToken = string(refreshToken.Data)
@@ -97,10 +128,14 @@ func (a *App) CheckIfMyAnimeListLoggedIn() bool {
 func (a *App) MyAnimeListLogin() {
 	if !a.CheckIfMyAnimeListLoggedIn() {
 		fmt.Println("check logged in function failed")
+		if !malRingReady() {
+			log.Println("mal: cannot check login, secure storage unavailable")
+			return
+		}
 		tokenType, tokenErr := myAnimeListRing.Get("MyAnimeListTokenType")
 		expiresIn, expiresInErr := myAnimeListRing.Get("MyAnimeListExpiresIn")
-		refreshToken, refreshTokenErr := myAnimeListRing.Get("MyAnimeListAccessToken")
-		accessToken, accessTokenErr := myAnimeListRing.Get("MyAnimeListRefreshToken")
+		accessToken, accessTokenErr := myAnimeListRing.Get("MyAnimeListAccessToken")
+		refreshToken, refreshTokenErr := myAnimeListRing.Get("MyAnimeListRefreshToken")
 		if (tokenErr != nil || expiresInErr != nil || refreshTokenErr != nil || accessTokenErr != nil) || len(accessToken.Data) == 0 {
 			verifier, _ := verifier()
 			getMyAnimeListCodeUrl := "https://myanimelist.net/v1/oauth2/authorize?response_type=code&client_id=" + Environment.MAL_CLIENT_ID + "&redirect_uri=" + Environment.MAL_CALLBACK_URI + "&code_challenge=" + verifier.Value + "&code_challenge_method=plain"
@@ -114,7 +149,7 @@ func (a *App) MyAnimeListLogin() {
 			myAnimeListJwt.TokenType = string(tokenType.Data)
 			myAnimeListJwt.ExpiresIn, expiresInConvertErr = strconv.Atoi(string(expiresIn.Data))
 			if expiresInConvertErr != nil {
-				fmt.Println("unable to convert string to int in Login function")
+				log.Printf("mal: invalid expiresIn %q: %s", string(expiresIn.Data), expiresInConvertErr)
 			}
 			myAnimeListJwt.AccessToken = string(accessToken.Data)
 			myAnimeListJwt.RefreshToken = string(refreshToken.Data)
@@ -136,22 +171,10 @@ func (a *App) handleMyAnimeListCallback(wg *sync.WaitGroup, verifier *CodeVerifi

 		if content != "" {
 			myAnimeListJwt = getMyAnimeListAuthorizationToken(content, verifier)
-			_ = myAnimeListRing.Set(keyring.Item{
-				Key:  "MyAnimeListTokenType",
-				Data: []byte(myAnimeListJwt.TokenType),
-			})
-			_ = myAnimeListRing.Set(keyring.Item{
-				Key:  "MyAnimeListExpiresIn",
-				Data: []byte(strconv.Itoa(myAnimeListJwt.ExpiresIn)),
-			})
-			_ = myAnimeListRing.Set(keyring.Item{
-				Key:  "MyAnimeListAccessToken",
-				Data: []byte(myAnimeListJwt.AccessToken),
-			})
-			_ = myAnimeListRing.Set(keyring.Item{
-				Key:  "MyAnimeListRefreshToken",
-				Data: []byte(myAnimeListJwt.RefreshToken),
-			})
+			_ = malRingSet("MyAnimeListTokenType", []byte(myAnimeListJwt.TokenType))
+			_ = malRingSet("MyAnimeListExpiresIn", []byte(strconv.Itoa(myAnimeListJwt.ExpiresIn)))
+			_ = malRingSet("MyAnimeListAccessToken", []byte(myAnimeListJwt.AccessToken))
+			_ = malRingSet("MyAnimeListRefreshToken", []byte(myAnimeListJwt.RefreshToken))
 			_, err := runtime.MessageDialog(*wailsContext, runtime.MessageDialogOptions{
 				Title:   "MyAnimeList Authorization",
 				Message: "It is now safe to close your browser tab",
@@ -292,22 +315,10 @@ func refreshMyAnimeListAuthorizationToken() bool {

 	myAnimeListJwt = refreshed

-	_ = myAnimeListRing.Set(keyring.Item{
-		Key:  "MyAnimeListTokenType",
-		Data: []byte(myAnimeListJwt.TokenType),
-	})
-	_ = myAnimeListRing.Set(keyring.Item{
-		Key:  "MyAnimeListExpiresIn",
-		Data: []byte(strconv.Itoa(myAnimeListJwt.ExpiresIn)),
-	})
-	_ = myAnimeListRing.Set(keyring.Item{
-		Key:  "MyAnimeListAccessToken",
-		Data: []byte(myAnimeListJwt.AccessToken),
-	})
-	_ = myAnimeListRing.Set(keyring.Item{
-		Key:  "MyAnimeListRefreshToken",
-		Data: []byte(myAnimeListJwt.RefreshToken),
-	})
+	_ = malRingSet("MyAnimeListTokenType", []byte(myAnimeListJwt.TokenType))
+	_ = malRingSet("MyAnimeListExpiresIn", []byte(strconv.Itoa(myAnimeListJwt.ExpiresIn)))
+	_ = malRingSet("MyAnimeListAccessToken", []byte(myAnimeListJwt.AccessToken))
+	_ = malRingSet("MyAnimeListRefreshToken", []byte(myAnimeListJwt.RefreshToken))
 	return true
 }

@@ -367,12 +378,16 @@ func createUser() MyAnimeListUser {

 func (a *App) LogoutMyAnimeList() string {
 	if (MyAnimeListJWT{} != myAnimeListJwt) {
+		if !malRingReady() {
+			myAnimeListJwt = MyAnimeListJWT{}
+			return "MAL Logged Out Successfully"
+		}
 		typeErr := myAnimeListRing.Remove("MyAnimeListTokenType")
 		expiresInErr := myAnimeListRing.Remove("MyAnimeListExpiresIn")
 		accessTokenErr := myAnimeListRing.Remove("MyAnimeListAccessToken")
 		refreshTokenErr := myAnimeListRing.Remove("MyAnimeListRefreshToken")
 		if typeErr != nil || expiresInErr != nil || accessTokenErr != nil || refreshTokenErr != nil {
-			fmt.Println("MAL Logout Failed")
+			log.Printf("mal: logout cleanup failed (type=%v expires=%v access=%v refresh=%v)", typeErr, expiresInErr, accessTokenErr, refreshTokenErr)
 		}
 		myAnimeListJwt = MyAnimeListJWT{}
 	}
@@ -1,6 +1,6 @@
 TAGS := webkit2_41

-.PHONY: dev build clean
+.PHONY: dev build clean release

 dev:
 	wails dev -tags $(TAGS)
@@ -10,3 +10,42 @@ build:

 clean:
 	rm -rf build/bin/*
+
+# Create a version commit (wails.json bump, committed and pushed) plus an
+# annotated version tag carrying auto-generated release notes (git-cliff),
+# and push both. The tag push triggers .gitea/workflows/release.yml, which
+# verifies wails.json matches the tag, builds via `make build`, packages
+# AniTrack-<VERSION>.tar.gz from build/, and publishes a Gitea Release
+# named AniTrack-<VERSION> with the archive attached. Notes come entirely
+# from Conventional Commits — no hand-written message required.
+#
+# git-cliff's --latest needs the tag to exist to scope the notes, so we
+# create a throwaway lightweight tag, generate the notes, replace it with
+# an annotated tag, then push. --cleanup=verbatim keeps the markdown "###"
+# group headers (git's default cleanup would strip lines starting with "#").
+#
+# Tags are plain versions (1.6.7) to match wails.json productVersion and the
+# existing tag history. Pre-releases are created by tagging manually with a
+# suffix (e.g. 1.6.7-rc1 on top of the bumped commit) — the workflow marks
+# those as prerelease. Use ./release as a shortcut.
+#
+# Requires git-cliff: https://git-cliff.org/install
+# Usage: make release VERSION=1.6.7
+release:
+	@test -n "$(VERSION)" || { echo "Usage: make release VERSION=1.6.7"; exit 1; }
+	@echo "$(VERSION)" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$$' || { echo "VERSION must be plain semver like 1.6.7 (no v prefix, no AniTrack- prefix, no suffix)"; exit 1; }
+	@command -v git-cliff >/dev/null 2>&1 || { echo "git-cliff not found — install: https://git-cliff.org/install"; exit 1; }
+	@command -v python3 >/dev/null 2>&1 || { echo "python3 not found — required to bump wails.json"; exit 1; }
+	@git diff --quiet && git diff --cached --quiet || { echo "Working tree dirty — commit or stash first"; exit 1; }
+	@if git rev-parse "$(VERSION)" >/dev/null 2>&1; then echo "Tag $(VERSION) already exists locally — delete it first: git tag -d $(VERSION)"; exit 1; fi
+	@echo "Bumping wails.json to $(VERSION)..."
+	@python3 -c "import json; p='wails.json'; d=json.load(open(p)); d['info']['productVersion']='$(VERSION)'; json.dump(d, open(p,'w'), indent=2); open(p,'a').write('\n')"
+	@git add wails.json
+	@git commit -m "chore(release): bump version to $(VERSION)"
+	@echo "Generating release notes for $(VERSION)..."
+	@git tag "$(VERSION)" HEAD && \
+		(git cliff --latest --config cliff.toml > .release-notes.tmp && git tag -d "$(VERSION)" >/dev/null) || \
+		{ git tag -d "$(VERSION)" >/dev/null 2>&1; rm -f .release-notes.tmp; echo "git-cliff failed"; exit 1; }
+	@git tag -a --cleanup=verbatim -F .release-notes.tmp "$(VERSION)" HEAD && rm -f .release-notes.tmp
+	@git push origin main "$(VERSION)"
+	@echo "Pushed $(VERSION) — Gitea Actions will build, package, and publish AniTrack-$(VERSION).tar.gz."
@@ -17,18 +17,48 @@ import (

 var simklJwt SimklJWT

-var simklRing, _ = keyring.Open(keyring.Config{
+var simklRing keyring.Keyring
+
+func init() {
+	var err error
+	simklRing, err = keyring.Open(keyring.Config{
 		ServiceName:                    "AniTrack",
 		KeychainName:                   "AniTrack",
 		KeychainSynchronizable:         false,
 		KeychainTrustApplication:       true,
 		KeychainAccessibleWhenUnlocked: true,
 	})
+	if err != nil {
+		log.Printf("simkl: secure storage unavailable: %s", err)
+	}
+}
+
+func simklRingReady() bool {
+	if simklRing == nil {
+		log.Println("simkl: secure storage unavailable")
+		return false
+	}
+	return true
+}
+
+func simklRingSet(key string, data []byte) error {
+	if !simklRingReady() {
+		return errors.New("simkl: secure storage unavailable")
+	}
+	if err := simklRing.Set(keyring.Item{Key: key, Data: data}); err != nil {
+		log.Printf("simkl: save %s failed: %s", key, err)
+		return err
+	}
+	return nil
+}

 var simklCtxShutdown, simklCancel = context.WithCancel(context.Background())

 func (a *App) CheckIfSimklLoggedIn() bool {
 	if (SimklJWT{} == simklJwt) {
+		if !simklRingReady() {
+			return false
+		}
 		tokenType, tokenTypeErr := simklRing.Get("SimklTokenType")
 		accessToken, accessTokenErr := simklRing.Get("SimklAccessToken")
 		scope, scopeErr := simklRing.Get("SimklScope")
@@ -47,6 +77,10 @@ func (a *App) CheckIfSimklLoggedIn() bool {

 func (a *App) SimklLogin() {
 	if !a.CheckIfSimklLoggedIn() {
+		if !simklRingReady() {
+			log.Println("simkl: cannot check login, secure storage unavailable")
+			return
+		}
 		tokenType, tokenTypeErr := simklRing.Get("SimklTokenType")
 		accessToken, accessTokenErr := simklRing.Get("SimklAccessToken")
 		scope, scopeErr := simklRing.Get("SimklScope")
@@ -80,18 +114,9 @@ func (a *App) handleSimklCallback(wg *sync.WaitGroup) {

 		if content != "" {
 			simklJwt = getSimklAuthorizationToken(content)
-			_ = simklRing.Set(keyring.Item{
-				Key:  "SimklTokenType",
-				Data: []byte(simklJwt.TokenType),
-			})
-			_ = simklRing.Set(keyring.Item{
-				Key:  "SimklAccessToken",
-				Data: []byte(simklJwt.AccessToken),
-			})
-			_ = simklRing.Set(keyring.Item{
-				Key:  "SimklScope",
-				Data: []byte(simklJwt.Scope),
-			})
+			_ = simklRingSet("SimklTokenType", []byte(simklJwt.TokenType))
+			_ = simklRingSet("SimklAccessToken", []byte(simklJwt.AccessToken))
+			_ = simklRingSet("SimklScope", []byte(simklJwt.Scope))
 			_, err := runtime.MessageDialog(*wailsContext, runtime.MessageDialogOptions{
 				Title:   "Simkl Authorization",
 				Message: "It is now safe to close your browser tab",
@@ -218,12 +243,16 @@ func (a *App) GetSimklLoggedInUser() SimklUser {

 func (a *App) LogoutSimkl() string {
 	if (SimklJWT{} != simklJwt) {
+		if !simklRingReady() {
+			simklJwt = SimklJWT{}
+			return "Simkl Logged Out Successfully"
+		}
 		tokenTypeErr := simklRing.Remove("SimklTokenType")
 		accessTokenErr := simklRing.Remove("SimklAccessToken")
 		scopeErr := simklRing.Remove("SimklScope")

 		if tokenTypeErr != nil || accessTokenErr != nil || scopeErr != nil {
-			fmt.Println("Simkl Logout Failed")
+			log.Printf("simkl: logout cleanup failed (type=%v access=%v scope=%v)", tokenTypeErr, accessTokenErr, scopeErr)
 		}
 		simklJwt = SimklJWT{}
 	}
@@ -0,0 +1,37 @@
+# git-cliff configuration — generates the body of each Gitea Release from
+# Conventional Commits accumulated since the previous tag. Invoked locally by
+# `make release VERSION=...`; the annotated tag message becomes the Release
+# body in .gitea/workflows/release.yml. Tags are plain versions (1.6.7).
+# Docs: https://git-cliff.org/docs/configuration
+
+[changelog]
+header = ""
+body = """
+{% for group, commits in commits | group_by(attribute="group") %}\
+### {{ group | upper_first }}
+{% for commit in commits %}\
+- {% if commit.scope %}*({{ commit.scope }})* {% endif %}{{ commit.message | upper_first }} ({{ commit.id | truncate(length=7, end="") }})
+{% endfor %}\
+{% endfor %}\
+"""
+trim = true
+footer = ""
+
+[git]
+conventional_commits = true
+filter_unconventional = false
+require_conventional = false
+split_commits = false
+commit_parsers = [
+  { message = "^feat", group = "Features" },
+  { message = "^fix", group = "Bug Fixes" },
+  { message = "^perf", group = "Performance" },
+  { message = "^refactor", group = "Refactor" },
+  { message = "^docs", group = "Documentation" },
+  { message = "^test", group = "Tests" },
+  { message = "^chore|^ci", group = "Miscellaneous Tasks" },
+  { message = ".*", group = "Other" },
+]
+filter_commits = false
+tag_pattern = "[0-9].*"
+sort_commits = "oldest"
@@ -0,0 +1,17 @@
+#!/usr/bin/env sh
+# Project-attached wrapper around `make release` so you can run:
+#   ./release 1.6.7   (or)   ./release v1.6.7   (or)   ./release AniTrack-1.6.7
+# instead of:
+#   make release VERSION=1.6.7
+# Lives in the repo (no machine-specific alias needed). Tags are plain
+# versions (1.6.7) to match wails.json productVersion.
+set -eu
+
+[ "$#" -ge 1 ] || { echo "Usage: ./release 1.6.7" >&2; exit 1; }
+
+# Normalize "v1.6.7" or "AniTrack-1.6.7" down to plain "1.6.7" (the Makefile
+# rejects anything that is not plain semver, so this just saves typing).
+VERSION="${1#v}"
+VERSION="${VERSION#AniTrack-}"
+
+exec make release "VERSION=${VERSION}"
@@ -12,6 +12,6 @@
  },
  "info": {
    "productName": "AniTrack",
-    "productVersion": "1.6.5"
+    "productVersion": "1.6.8"
  }
 }
Author	SHA1	Message	Date
John O'Keefe	a8df8dcce7	chore: ignore Task cache directory Task (used by wails3 via Taskfile.yml) stores incremental-build fingerprints under .task/checksum/. Purely local cache — hashes of sources/deps, machine-generated, recreated on next wails3 dev/build. Keep it out of git like node_modules/frontend/dist/build/bin (already ignored). No files were tracked; this just stops it showing as untracked on branches that have run wails3.	2026-09-13 18:01:01 -04:00
John O'Keefe	2bf8d3887e	fix(ci): track frontend lockfile for reproducible installs Release / release (push) Successful in 2m42s Details The blanket package-lock.json gitignore rule meant the frontend lockfile was never committed, so every release installed whatever the registry handed it (silent transitive drift) and setup-node npm caching failed outright with unable to cache dependencies. Scope the ignore rule to the repo root (/package-lock.json; no root package.json exists) and commit the freshly updated frontend lockfile: all deps at max in-range versions (autoprefixer 10.5.6 -> 10.6.0), majors intentionally deferred to the v3 frontend refresh. Verified with a green vite build before committing.	2026-09-12 22:40:21 -04:00
John O'Keefe	efe45f39e7	ci(release): cache npm, Go build cache, and Wails CLI Release / release (push) Failing after 11s Details Release runs were fully cold every time: ~13s npm install, ~39s full cgo/WebKit compile, and ~34s rebuilding the Wails CLI from source on each tag. Now that the runner cache backend is reachable again, persist all three across runs. Expected total drops from ~3.5 min toward ~2.5 min with apt as the remaining floor. - Set up Node: cache npm keyed on frontend/package-lock.json, so the npm install inside wails build stops fetching cold - New Cache Go build cache step: setup-go only persists modules (GOMODCACHE); this persists compiled packages (GOCACHE) with a go.sum-hashed key plus a version-prefix restore-key fallback, turning the WebKit compile incremental from the second run on - Wails CLI: split install into cache (key wails-v2.15.0-Linux, bump with the version pin), conditional go install on miss, and an unconditional PATH step so cache hits still land on PATH First run after this still compiles cold (it saves); the payoff shows from the second run on. Verify with the throwaway-tag loop and compare Build Linux binary times.	2026-09-12 22:26:12 -04:00
John O'Keefe	336a1f353f	chore(release): bump version to 1.6.8 Release / release (push) Canceled after 20s Details	2026-09-12 21:27:12 -04:00
John O'Keefe	a19080ef39	Revert "docs: add Wails v3 + Android migration plan" The migration plan belongs to the wailsv3 branch, not main. It was merged forward into wailsv3 (now at origin/wailsv3) before this revert, so no content is lost. Main keeps only the v2 keyring error-handling fix.	2026-09-12 21:26:25 -04:00
John O'Keefe	2bddc6a224	docs: add Wails v3 + Android migration plan Skimmable phased plan for getting AniTrack onto Android for personal sideload use (no Play Store, no official F-Droid). Written for both the maintainer and as working context for AI-assisted implementation. Covers: desktop v3 parity as a mechanical step (main.go, runtime call mapping, wailsjs import rewrite), per-file Android storage shims (keyring on desktop vs EncryptedSharedPreferences via Android.Secure*), the localhost :6734 to anitrack:// deep-link OAuth redesign with per-provider dashboard changes, and the sideload run/ package commands plus Obtainium updates. Includes guardrails: small diffs, per-service file ownership, build-tagged platform files only, runnable check per phase, and open decisions (first provider, desktop parallel builds, redirect URI registration).	2026-09-12 21:23:14 -04:00
John O'Keefe	3bf5d8290e	fix(auth): handle keyring open/set errors per service Stop ignoring keyring.Open failures in all three login files. A failed Open previously left a nil ring behind the blank identifier, so the next Get/Set panicked with no message. Each service now opens its ring in init, logs a service-prefixed warning when storage is unavailable, and guards every use with a Ready check that fails safe to logged-out. - AniListUserFunctions.go: add aniRingReady/aniRingSet helpers, log Open and per-key Set failures, reject invalid ExpiresIn instead of silently storing 0, clear in-memory JWT on logout even when storage is missing - MALUserFunctions.go: add malRingReady/malRingSet helpers covering login, OAuth callback, and token-refresh saves; same Open/Set/ ExpiresIn/logout treatment - SimklUserFunctions.go: add simklRingReady/simklRingSet helpers; same Open/Set/logout treatment No wallet, key names, or login flow changed. Same ServiceName AniTrack, same keys, same OAuth callback behavior.	2026-09-12 21:22:58 -04:00
John O'Keefe	a5da544dd7	chore(release): bump version to 1.6.7 Release / release (push) Successful in 11m52s Details	2026-09-11 16:22:45 -04:00
John O'Keefe	270faeb507	feat(ci): automate Linux release builds and Gitea releases Release / release (push) Successful in 13m50s Details Local flow is now ./release 1.6.7 (or make release VERSION=1.6.7): bump wails.json productVersion, commit the bump, generate git-cliff notes into an annotated plain-version tag, and push commit plus tag. The tag push fires the new Gitea Actions workflow. - cliff.toml: git-cliff groups matching Bookhoard, tag_pattern for plain versions so --latest scopes correctly. - Makefile release target: strict plain-semver validation, dirty-tree and existing-tag guards, python3 wails.json bump committed as chore(release), throwaway-tag notes generation, push of main + tag. - release: wrapper normalizing v/AniTrack- prefixes to plain versions. - .gitea/workflows/release.yml: version guard (wails.json vs tag, base-match for -suffix pre-releases), Go 1.25 / Node 20 / Wails v2.15.0 + webkit2_41 system deps, environment.go from Actions secrets, make build, AniTrack-<version>.tar.gz packaged from build/ (bin, icon, desktop, install script, README), idempotent Release create/update named AniTrack-<version> with archive attached via REGISTRY_TOKEN PAT.	2026-09-11 16:00:37 -04:00
John O'Keefe	abba1803fc	chore(release): bump version to 1.6.6 Update productVersion in wails.json from 1.6.5 to 1.6.6 to accompany the MAL token variable fix and the authenticated AniList search fix.	2026-09-11 15:23:43 -04:00
John O'Keefe	ce35a20eba	fix(anilist): send auth token on search when logged in AniListSearch hardcoded false for the authenticated flag to AniListQuery, forcing anonymous searches even with a valid AniList session. Pass a.CheckIfAniListLoggedIn() instead so the stored token is attached when available, enabling user-specific data and authenticated rate limits while keeping anonymous search as fallback.	2026-09-11 15:23:40 -04:00
John O'Keefe	e5ce250392	fix(mal): correct swapped access and refresh token variables In CheckIfMyAnimeListLoggedIn and MyAnimeListLogin the keyring lookups assigned MyAnimeListAccessToken to refreshToken and MyAnimeListRefreshToken to accessToken. Downstream code checks len(accessToken.Data) for login state and assigns accessToken.Data -> myAnimeListJwt.AccessToken, so the swap gated login on the refresh token and stored each token in the wrong field. Swap the variable names to match their keyring keys so login detection, JWT restoration, and the empty-token fallback in MyAnimeListLogin use the correct values.	2026-09-11 15:23:29 -04:00