Prove every framework on every platform and trim the README

.github/workflows/ci.yml

@@ -250,6 +250,33 @@ jobs:
           path: target/linux-rust.lcov
           if-no-files-found: error
 
+  example-linux:
+    name: Example apps on Linux through a UnifiedPush distributor
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        example: [winit, tauri]
+    # A fork's pull request gets no secrets, so it pulls anonymously.
+    env:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+    steps:
+      - uses: actions/checkout@v7
+      - run: rustup toolchain install stable --profile minimal
+      # Tauri builds on Linux against GTK and WebKitGTK.
+      - if: matrix.example == 'tauri'
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev
+      # GitHub's runners share Docker Hub's anonymous pull limit, which the image pull otherwise hits.
+      - if: env.DOCKERHUB_USERNAME != ''
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      # The app in a window on Xvfb, KDE's distributor in a Debian testing container, real pushes through ntfy.sh.
+      - name: Token, a push to the open app, a push to the closed app that the bus starts headless, the next window draining it
+        run: ci/linux/example-host.sh ${{ matrix.example }}
+
   coverage:
     name: Coverage and Sonar
     needs: [android-coverage, linux-coverage, web-coverage]
@@ -525,6 +552,38 @@ jobs:
       - name: The static-worker build in Chrome, with real pushes
         run: node ci/web/example.mjs check examples/yew/dist-static "$RUNNER_TEMP/vapid.json" '/pushups-sw\.js\?pushups=static'
 
+  example-winit-web:
+    name: Example winit app on Trunk in Chrome
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - run: |
+          rustup toolchain install stable --profile minimal
+          rustup target add --toolchain stable wasm32-unknown-unknown
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: trunk@0.21.14
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: ci/web/package-lock.json
+      - run: npm ci
+        working-directory: ci/web
+      - name: Build the winit app in both worker modes
+        working-directory: examples/winit
+        run: |
+          key=$(node ../../ci/web/example.mjs keys "$RUNNER_TEMP/vapid.json")
+          PUSHUPS_VAPID_PUBLIC_KEY="$key" trunk build --release --dist dist-rust
+          PUSHUPS_WEB_WORKER=static PUSHUPS_VAPID_PUBLIC_KEY="$key" trunk build --release --dist dist-static
+          # `build.rs` wrote `pushups::SERVICE_WORKER`, which the Trunk hook copied.
+          cmp dist-static/pushups-sw.js ../../js/pushups-sw.js
+      - name: The Rust-handler build in Chrome, with real pushes
+        run: node ci/web/example.mjs check examples/winit/dist-rust "$RUNNER_TEMP/vapid.json" '/sw\.js\?pushups=rust' --rust
+      - name: The static-worker build in Chrome, with real pushes
+        run: node ci/web/example.mjs check examples/winit/dist-static "$RUNNER_TEMP/vapid.json" '/pushups-sw\.js\?pushups=static'
+
   example-leptos:
     name: Example Leptos SSR app in Chrome
     runs-on: ubuntu-latest
@@ -573,3 +632,18 @@ jobs:
               nm -gU "$binary" | grep -q ___pushups_background_handler || { echo "no background handler in $binary"; exit 1; }
             done
           done
+      # The Tauri build needs its CLI, and CI has no signing identity, so the app comes out unsigned.
+      - name: Build the Tauri app, unsigned, and check the handler and the aps-environment entitlement
+        run: |
+          cargo install tauri-cli --locked --version 2.12.1
+          (cd examples/tauri && cargo tauri build --debug --bundles app)
+          app=$(find examples/tauri/target/debug/bundle/macos -maxdepth 1 -name "*.app" | head -n1)
+          binary="$app/Contents/MacOS/pushups-tauri-example"
+          nm -gU "$binary" | grep -q ___pushups_background_handler || { echo "no background handler in $binary"; exit 1; }
+          entitlements=$(codesign -d --entitlements - "$binary" 2>/dev/null || true)
+          if [ -n "$entitlements" ]; then
+            echo "$entitlements" | grep -q "com.apple.developer.aps-environment" || { echo "no aps-environment in the Tauri app entitlements"; exit 1; }
+          else
+            # An unsigned build applies no entitlements, so check the file the signed build applies.
+            grep -q "com.apple.developer.aps-environment" examples/tauri/entitlements.plist || { echo "no aps-environment in examples/tauri/entitlements.plist"; exit 1; }
+          fi

.github/workflows/windows-push.yml

@@ -43,3 +43,49 @@ jobs:
           WNS_OBJECT_ID: ${{ secrets.WNS_OBJECT_ID }}
           WNS_CLIENT_SECRET: ${{ secrets.WNS_CLIENT_SECRET }}
         run: ./ci/windows/w0.ps1
+  example:
+    name: Example (${{ matrix.example }})
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: windows-latest
+    timeout-minutes: 90
+    strategy:
+      matrix:
+        example: [dioxus, tauri, winit]
+    steps:
+      - uses: actions/checkout@v7
+      - run: rustup toolchain install stable --profile minimal
+      - name: Install the Windows App SDK 2.5 runtime
+        shell: pwsh
+        run: |
+          $installer = Join-Path $env:RUNNER_TEMP 'WindowsAppRuntimeInstall-x64.exe'
+          Invoke-WebRequest -TimeoutSec 600 -OutFile $installer 'https://aka.ms/windowsappsdk/2.5/latest/windowsappruntimeinstall-x64.exe'
+          $install = Start-Process $installer -ArgumentList '--quiet' -NoNewWindow -PassThru
+          # The handle is taken now so the exit code stays readable.
+          $null = $install.Handle
+          if (-not $install.WaitForExit(600000)) { $install.Kill(); throw 'the runtime installer did not finish within 10 minutes' }
+          if ($install.ExitCode -ne 0) { throw "the runtime installer exited with $($install.ExitCode)" }
+      - name: Build the ${{ matrix.example }} example
+        shell: pwsh
+        env:
+          EXAMPLE: ${{ matrix.example }}
+          PUSHUPS_WNS_REMOTE_ID: ${{ secrets.WNS_OBJECT_ID }}
+        run: |
+          # The Dioxus example's `firebase_config!` reads this file on every target.
+          Copy-Item tests/fixtures/google-services.json "examples/$env:EXAMPLE/google-services.json"
+          $map = @{
+            dioxus = @{ Manifest = 'examples/dioxus/Cargo.toml'; Args = @('--no-default-features', '--features', 'desktop') }
+            tauri = @{ Manifest = 'examples/tauri/Cargo.toml'; Args = @() }
+            winit = @{ Manifest = 'examples/winit/Cargo.toml'; Args = @() }
+          }
+          $entry = $map[$env:EXAMPLE]
+          $buildArgs = $entry.Args
+          cargo +stable build --release --manifest-path $entry.Manifest @buildArgs
+      - name: Run the ${{ matrix.example }} example with WNS pushes
+        shell: pwsh
+        env:
+          WNS_TENANT_ID: ${{ secrets.WNS_TENANT_ID }}
+          WNS_APP_ID: ${{ secrets.WNS_APP_ID }}
+          WNS_OBJECT_ID: ${{ secrets.WNS_OBJECT_ID }}
+          WNS_CLIENT_SECRET: ${{ secrets.WNS_CLIENT_SECRET }}
+        run: |
+          ./ci/windows/example.ps1 "$env:GITHUB_WORKSPACE\examples\${{ matrix.example }}\target\release\pushups-${{ matrix.example }}-example.exe"