fix(ci): sanitize release signing key before tauri build

.github/workflows/release.yml

@@ -56,11 +56,22 @@ jobs:
 
       - run: npm ci
 
+      - name: Sanitize Tauri Signing Key
+        shell: bash
+        env:
+          RAW_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+        run: |
+          CLEAN_KEY=$(echo -n "$RAW_KEY" | python3 -c "import sys, urllib.parse; k = sys.stdin.read().strip(); k = k[:-1] if k.endswith('%') else k; k = urllib.parse.unquote(k) if '%' in k else k; print(k, end='')")
+          echo "::add-mask::$CLEAN_KEY"
+          echo "TAURI_SIGNING_PRIVATE_KEY<<EOF" >> $GITHUB_ENV
+          echo "$CLEAN_KEY" >> $GITHUB_ENV
+          echo "EOF" >> $GITHUB_ENV
+
       - name: Build and Upload Tauri App
         uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ env.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         with:
           tagName: ${{ needs.create-tag.outputs.new_tag }}

AUDIT_LOG.md

@@ -2,6 +2,16 @@
 
 This log tracks all significant changes, updates, and versions in the PaperCache project.
 
+## 2026-06-29 (CI Signing Key Sanitization Fix)
+**Change:** fix(ci): sanitize `TAURI_SIGNING_PRIVATE_KEY` before `tauri build` to strip trailing terminal prompt artifacts (`%`) or URL encoding
+
+**Details/Why:**
+1. **Secret Key Sanitization**: When copying private keys from macOS Zsh terminals without trailing newlines (`cat ~/.tauri/papercache.key`), Zsh appends an inverted `%` symbol at EOF. When pasted into GitHub repository secrets, this trailing `%` causes base64 decoding errors (`Invalid symbol 37, offset 348`). Added a pre-build workflow step in `.github/workflows/release.yml` to automatically strip trailing `%` symbols and decode URL encoding before running `tauri-action`.
+
+**Files changed:** `.github/workflows/release.yml`, `CHANGELOG.md`, `AUDIT_LOG.md`.
+
+---
+
 ## 2026-06-29 (v0.5.7 Release: Auto-Update Overhaul, On-Demand Update Checks, and Build Fixes)
 **Change:** chore(release): bump version to 0.5.7; feat(updater): overhaul auto-update flow with real-time UI feedback ("Checking…"), toast notification with "Restart Now" button, and manifest configuration; fix(api): update `onEvent` listener helper to forward payloads to callbacks fixing TS2345 strict build error
 

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- **Release Signing Key Sanitization**: Added automated workflow sanitization to strip trailing terminal prompt EOF symbols (`%`) or URL-encoding artifacts from `TAURI_SIGNING_PRIVATE_KEY` during CI builds.
+
 ## [v0.5.7] - 2026-06-29
 
 ### Added