Pipeline Guide

When you connect a GitHub repository to Arara, we inject a workflow file (`.github/workflows/arara-release.yml`) into your repo. Every time you publish a GitHub Release, this workflow triggers automatically — no manual upload required.

• ▸1. Trigger: GitHub Release published (any tag)
• ▸2. Build: Compile your app for Windows (x64), macOS (arm64 + x64), Linux (x64)
• ▸3. Sign: Code-signed with Arara's certificate (Windows Authenticode + macOS Notarization)
• ▸4. Scan: Automated malware scan via ClamAV + VirusTotal API
• ▸5. Delta: Generate binary diff against previous release for update patching
• ▸6. Upload: Push binaries to Arara CDN (Cloudflare R2)
• ▸7. Publish: App version goes live on the store automatically

# .github/workflows/arara-release.yml
name: Arara Release

on:
  release:
    types: [published]

jobs:
  build:
    strategy:
      matrix:
        os: [windows-latest, macos-latest, ubuntu-latest]
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: npm run build  # Replace with your build command

      - name: Upload to Arara
        uses: arara-app/release-action@v1
        with:
          app-id: ${{ secrets.ARARA_APP_ID }}
          api-key: ${{ secrets.ARARA_API_KEY }}
          artifact-path: dist/

• ▸Your build output must be a single executable or installer per platform
• ▸App must not require internet access at install time (offline installer)
• ▸No bundled Node.js >= 2GB — use electron-builder or tauri for web apps
• ▸macOS builds must be signed with a valid Apple Developer certificate
• ▸Windows builds should be NSIS or MSI installers (not zip-only)

Arara generates binary diffs between releases using bsdiff. Users with the previous version installed will download only the changed bytes — typically 5–15% of the full installer size. Delta updates are applied transparently by the Arara Launcher.