Add app_version workflow_dispatch input for specifying custom version during manual builds. Implement version application step that validates input format and updates package.json, tauri.conf.json, and Cargo.toml with requested version string.
Add artifact name suffix based on provided version to distinguish versioned build outputs. Append version to NexaVPN-windows-installer and NexaVPN-windows
Add install-runtime command to tunnel-helper for automated WireGuard installation on Windows. Download and bundle official WireGuard MSI during build process with automatic version discovery from wireguard.com.
Add ensure_windows_runtime_installed checks before connect/disconnect operations. Implement install_windows_runtime with UAC elevation prompt and install_windows_runtime_direct for MS
Add osslsigncode dependency and implement three-step signing workflow. Decode base64-encoded PFX certificate from secrets, sign bundled tunnel helper before build, then sign desktop executable and NSIS installer after build. Use configurable timestamp URL with DigiCert fallback. Clean up certificate file in always-run step to prevent secret leakage.
Remove automatic push trigger on main/master branches and desktop-client path changes, keeping only manual workflow_dispatch. Remove self-hosted runner requirement to allow running on any Linux runner.
Add workflow to build Windows desktop client using cargo-xwin on Linux runners. Install Node.js 22, Rust with x86_64-pc-windows-msvc target, and required system dependencies including NSIS for installer creation. Build bundled Windows tunnel helper and desktop client installer, then upload both NSIS installer artifacts and raw executables.
