Split CI into independent per-platform workflows

Each platform (Linux, macOS, Windows) now has its own workflow file
that builds the sidecar, builds the Tauri app, and uploads to a shared
"latest" release independently. A failure on one platform no longer
blocks releases for the others.

- build-linux.yml: bash throughout, apt for deps
- build-macos.yml: bash throughout, brew for deps
- build-windows.yml: powershell throughout, choco for deps
- All use uv for Python, upload to shared "latest" release tag
- Each platform replaces its own artifacts on the release

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-windows.yml

@@ -0,0 +1,158 @@
+name: Build Windows
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+    branches: [main]
+
+env:
+  PYTHON_VERSION: "3.11"
+  NODE_VERSION: "20"
+  TARGET: x86_64-pc-windows-msvc
+
+jobs:
+  build-sidecar:
+    name: Build sidecar (Windows)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        shell: powershell
+        run: |
+          if (Get-Command uv -ErrorAction SilentlyContinue) {
+            Write-Host "uv already installed: $(uv --version)"
+          } else {
+            irm https://astral.sh/uv/install.ps1 | iex
+            echo "$env:USERPROFILE\.local\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          }
+
+      - name: Install ffmpeg
+        shell: powershell
+        run: choco install ffmpeg -y
+
+      - name: Set up Python
+        shell: powershell
+        run: uv python install ${{ env.PYTHON_VERSION }}
+
+      - name: Build sidecar
+        shell: powershell
+        working-directory: python
+        run: uv run --python ${{ env.PYTHON_VERSION }} python build_sidecar.py --cpu-only
+
+      - name: Upload sidecar artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: sidecar-windows
+          path: python/dist/voice-to-notes-sidecar/
+          retention-days: 7
+
+  build-app:
+    name: Build app (Windows)
+    needs: build-sidecar
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install Rust stable
+        shell: powershell
+        run: |
+          if (Get-Command rustup -ErrorAction SilentlyContinue) {
+            rustup default stable
+          } else {
+            Invoke-WebRequest -Uri https://win.rustup.rs/x86_64 -OutFile rustup-init.exe
+            .\rustup-init.exe -y --default-toolchain stable
+            echo "$env:USERPROFILE\.cargo\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          }
+
+      - name: Download sidecar artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: sidecar-windows
+          path: src-tauri/binaries/
+
+      - name: Install npm dependencies
+        shell: powershell
+        run: npm ci
+
+      - name: Build Tauri app
+        shell: powershell
+        run: npm run tauri build
+        env:
+          TAURI_CONFIG: '{"bundle":{"externalBin":["binaries/voice-to-notes-sidecar"]}}'
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: app-windows
+          path: |
+            src-tauri/target/release/bundle/msi/*.msi
+            src-tauri/target/release/bundle/nsis/*.exe
+          retention-days: 30
+
+  release:
+    name: Release (Windows)
+    needs: build-app
+    if: github.ref == 'refs/heads/main'
+    runs-on: windows-latest
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: app-windows
+          path: artifacts/
+
+      - name: Create or update release
+        shell: powershell
+        env:
+          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
+        run: |
+          $TAG = "latest"
+          $REPO_API = "${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+          $Headers = @{ "Authorization" = "token $env:BUILD_TOKEN" }
+
+          # Check if release exists
+          try {
+            $release = Invoke-RestMethod -Uri "${REPO_API}/releases/tags/${TAG}" -Headers $Headers -ErrorAction Stop
+            $RELEASE_ID = $release.id
+          } catch {
+            # Create new release
+            $body = @{
+              tag_name = $TAG
+              name = "Voice to Notes (Latest Build)"
+              body = "Latest automated build from main branch."
+              draft = $false
+              prerelease = $true
+            } | ConvertTo-Json
+            $release = Invoke-RestMethod -Uri "${REPO_API}/releases" -Method Post -Headers $Headers -ContentType "application/json" -Body $body
+            $RELEASE_ID = $release.id
+          }
+
+          Write-Host "Release ID: ${RELEASE_ID}"
+
+          # Upload artifacts
+          Get-ChildItem -Path artifacts -Recurse -Include *.msi,*.exe | ForEach-Object {
+            $filename = $_.Name
+            Write-Host "Uploading ${filename}..."
+
+            # Delete existing asset with same name
+            try {
+              $assets = Invoke-RestMethod -Uri "${REPO_API}/releases/${RELEASE_ID}/assets" -Headers $Headers
+              $existing = $assets | Where-Object { $_.name -eq $filename }
+              if ($existing) {
+                Invoke-RestMethod -Uri "${REPO_API}/releases/${RELEASE_ID}/assets/$($existing.id)" -Method Delete -Headers $Headers
+              }
+            } catch {}
+
+            # Upload
+            Invoke-RestMethod -Uri "${REPO_API}/releases/${RELEASE_ID}/assets?name=${filename}" `
+              -Method Post -Headers $Headers -ContentType "application/octet-stream" `
+              -InFile $_.FullName
+          }