fix: skip Tauri bundler, build NSIS installer manually

Tauri's bundled makensis can't run under SYSTEM account.
Use --no-bundle, then build installer with system NSIS
directly — same pattern as the old Go pipeline.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-release.yml

@@ -78,12 +78,65 @@ jobs:
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          TAURI_NSIS_PATH: C:\Program Files (x86)\NSIS
         run: |
           $env:Path = "$env:EXTRA_PATH;$env:Path"
-          cargo tauri build
+          cargo tauri build --no-bundle
           Write-Host "=== Build output ==="
-          Get-ChildItem -Recurse src-tauri\target\release\bundle\nsis\*.exe
+          Get-ChildItem src-tauri\target\release\Wraith.exe
+
+      - name: Build NSIS installer
+        shell: powershell
+        run: |
+          $env:Path = "$env:EXTRA_PATH;$env:Path"
+          $version = "${{ steps.version.outputs.version }}"
+
+          # Stage files
+          New-Item -ItemType Directory -Force -Path dist-pkg | Out-Null
+          Copy-Item src-tauri\target\release\Wraith.exe dist-pkg\
+          Copy-Item src-tauri\icons\icon.ico dist-pkg\wraith.ico -ErrorAction SilentlyContinue
+
+          # Write NSIS script
+          @"
+          !include "MUI2.nsh"
+          Name "Wraith"
+          OutFile "Wraith_${version}_x64-setup.exe"
+          InstallDir "`$PROGRAMFILES64\Wraith"
+          RequestExecutionLevel admin
+          !insertmacro MUI_PAGE_DIRECTORY
+          !insertmacro MUI_PAGE_INSTFILES
+          !insertmacro MUI_LANGUAGE "English"
+          Section "Install"
+            SetOutPath "`$INSTDIR"
+            File "Wraith.exe"
+            File "wraith.ico"
+            CreateDirectory "`$SMPROGRAMS\Wraith"
+            CreateShortcut "`$SMPROGRAMS\Wraith\Wraith.lnk" "`$INSTDIR\Wraith.exe" "" "`$INSTDIR\wraith.ico"
+            CreateShortcut "`$DESKTOP\Wraith.lnk" "`$INSTDIR\Wraith.exe" "" "`$INSTDIR\wraith.ico"
+            WriteUninstaller "`$INSTDIR\uninstall.exe"
+            WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wraith" "DisplayName" "Wraith"
+            WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wraith" "UninstallString" "`$INSTDIR\uninstall.exe"
+            WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wraith" "DisplayVersion" "${version}"
+            WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wraith" "Publisher" "Vigilance Cyber"
+          SectionEnd
+          Section "Uninstall"
+            Delete "`$INSTDIR\Wraith.exe"
+            Delete "`$INSTDIR\wraith.ico"
+            Delete "`$INSTDIR\uninstall.exe"
+            RMDir "`$INSTDIR"
+            Delete "`$SMPROGRAMS\Wraith\Wraith.lnk"
+            RMDir "`$SMPROGRAMS\Wraith"
+            Delete "`$DESKTOP\Wraith.lnk"
+            DeleteRegKey HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wraith"
+          SectionEnd
+          "@ | Out-File -FilePath dist-pkg\installer.nsi -Encoding ascii
+
+          # Build installer
+          Push-Location dist-pkg
+          makensis installer.nsi
+          Pop-Location
+          Move-Item "dist-pkg\Wraith_${version}_x64-setup.exe" .
+          Write-Host "=== Installer built ==="
+          Get-ChildItem "Wraith_${version}_x64-setup.exe"
 
       - name: Download jsign
         shell: powershell
@@ -109,10 +162,12 @@ jobs:
         shell: powershell
         run: |
           $env:Path = "$env:EXTRA_PATH;$env:Path"
+          $version = "${{ steps.version.outputs.version }}"
           Write-Host "=== Signing Wraith binaries ==="
-          $installers = Get-ChildItem -Recurse src-tauri\target\release\bundle\nsis\*.exe
-          foreach ($binary in $installers) {
-            Write-Host "Signing: $($binary.FullName)"
+          $binaries = @("src-tauri\target\release\Wraith.exe", "Wraith_${version}_x64-setup.exe")
+          foreach ($path in $binaries) {
+            if (Test-Path $path) {
+              Write-Host "Signing: $path"
               java -jar jsign.jar `
                 --storetype AZUREKEYVAULT `
                 --keystore "${{ secrets.AZURE_KEY_VAULT_URL }}" `
@@ -120,15 +175,16 @@ jobs:
                 --alias "${{ secrets.AZURE_CERT_NAME }}" `
                 --tsaurl http://timestamp.digicert.com `
                 --tsmode RFC3161 `
-              $binary.FullName
-            Write-Host "Signed: $($binary.Name)"
+                $path
+              Write-Host "Signed: $path"
+            }
           }
 
       - name: Create version.json
         shell: powershell
         run: |
           $version = "${{ steps.version.outputs.version }}"
-          $installer = (Get-ChildItem -Recurse src-tauri\target\release\bundle\nsis\*.exe | Select-Object -First 1)
+          $installer = Get-Item "Wraith_${version}_x64-setup.exe"
           $hash = (Get-FileHash $installer.FullName -Algorithm SHA256).Hash.ToLower()
           $json = @{
             version      = $version
@@ -152,27 +208,17 @@ jobs:
 
           Write-Host "=== Uploading Wraith v$version ==="
 
-          $installers = Get-ChildItem -Recurse src-tauri\target\release\bundle\nsis\*.exe
-          foreach ($file in $installers) {
-            Write-Host "Uploading: $($file.Name)"
-            Invoke-RestMethod -Uri "$giteaUrl/api/packages/vstockwell/generic/wraith/$version/$($file.Name)" `
+          $installer = "Wraith_${version}_x64-setup.exe"
+          Write-Host "Uploading: $installer"
+          Invoke-RestMethod -Uri "$giteaUrl/api/packages/vstockwell/generic/wraith/$version/$installer" `
             -Method PUT -Headers $headers -ContentType "application/octet-stream" `
-              -InFile $file.FullName
-          }
+            -InFile $installer
 
           Write-Host "Uploading: version.json"
           Invoke-RestMethod -Uri "$giteaUrl/api/packages/vstockwell/generic/wraith/$version/version.json" `
             -Method PUT -Headers $headers -ContentType "application/octet-stream" `
             -InFile version.json
 
-          $sigs = Get-ChildItem -Recurse src-tauri\target\release\bundle\nsis\*.sig -ErrorAction SilentlyContinue
-          foreach ($sig in $sigs) {
-            Write-Host "Uploading: $($sig.Name)"
-            Invoke-RestMethod -Uri "$giteaUrl/api/packages/vstockwell/generic/wraith/$version/$($sig.Name)" `
-              -Method PUT -Headers $headers -ContentType "application/octet-stream" `
-              -InFile $sig.FullName
-          }
-
           Write-Host "=== Upload complete ==="
 
       - name: Create Gitea Release

src-tauri/tauri.conf.json

@@ -26,7 +26,7 @@
   },
   "bundle": {
     "active": true,
-    "targets": ["nsis"],
+    "targets": [],
     "icon": [
       "icons/32x32.png",
       "icons/128x128.png",