Authenticator upstream release of the frontend dist tarball

We are happy to answer your questions about the code or discuss technical ideas.

Please complete the following checklist (by adding [x]):

• I have searched open and closed issues for duplicates
• This isn't a feature request
• This is not a report about my app not working as expected

Ask: upstream release of the frontend dist tarball

The problem

Proton Authenticator is a Tauri app. Flatpak builds run without network access, which means yarn/webpack can't run at build time. The Flatpak manifest therefore needs a pre-built copy of applications/authenticator/dist/ (the webpack output) supplied as a source archive. Flathub's rules require all source archives to be referenced by a stable, permanent URL — they cannot live in the Flathub submission repo itself.

Right now there is no stable upstream URL to reference. ProtonMail/WebClients has no GitHub Releases and no proton-authenticator@* tags (though the pattern exists for proton-vpn-settings, proton-wallet, proton-meet, etc.).

What would fix it

A lightweight GitHub Actions workflow, triggered when a proton-authenticator@* tag is pushed, that builds the frontend and uploads the dist as a release asset. This already follows the existing per-product tagging convention in the repo.

The build for the frontend dist is just:

yarn workspace proton-authenticator build:web

Output lands in applications/authenticator/dist/. The workflow would then package that directory and attach it to the release:

# .github/workflows/authenticator-dist-release.yml
name: Authenticator dist release

on:
  push:
    tags:
      - 'proton-authenticator@*'

jobs:
  build-dist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'yarn'

      - run: yarn install --frozen-lockfile

      - run: yarn workspace proton-authenticator build:web

      - name: Package dist
        run: |
          VERSION=${GITHUB_REF_NAME##*@}
          tar -czf authenticator-dist-${VERSION}.tar.gz \
            -C applications/authenticator dist/

      - uses: softprops/action-gh-release@v2
        with:
          files: authenticator-dist-*.tar.gz

Once that's in place, the Flathub manifest source entry becomes:

- type: archive
  url: https://github.com/ProtonMail/WebClients/releases/download/proton-authenticator%401.1.4/authenticator-dist-1.1.4.tar.gz
  sha256: <hash>
  strip-components: 0

No changes to the existing build system, CI pipelines, or release process for other products. It only fires on proton-authenticator@* tags.

Start with the existing per-product tag conventions and workflow files under .github/workflows, then run yarn workspace proton-authenticator build:web to inspect applications/authenticator/dist/. Package that output on proton-authenticator@* tags and verify the workflow publishes a stable release asset named authenticator-dist-VERSION.tar.gz.