chore: enable Sentry release reporting and bump Dioxus to 0.7.9

- Bake SENTRY_DSN at compile time via option_env! so release builds report
  events; add build.rs files so cargo rebuilds when SENTRY_DSN changes.
- Initialize Sentry before tracing_subscriber so events from the first
  log onwards land on a real Hub.
- Promote WARN to a Sentry event (the codebase prefers warn! for failures).
- CI: pass SENTRY_DSN to dx bundle and run dsymutil on macOS so .dSYM
  bundles are uploaded with the artifact.
- Bump dioxus / dioxus-desktop 0.7.3 -> 0.7.9 and use the new
  with_tray_icon_show_window_on_click(false) so left-clicking the tray
  icon only surfaces the menu instead of unhiding the main window.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: mattdjenkinson

.github/workflows/bundle.yml

@@ -46,9 +46,11 @@ jobs:
             libxdo-dev
 
       - name: Install Dioxus CLI
-        # Should be pinned to same version as dioxus in Cargo.toml
-        # note: dx bundle on Windows fails with 0.7.3, see
+        # Library deps in ui/Cargo.toml are pinned to dioxus =0.7.9, but the CLI is
+        # held back at 0.7.2 because dx bundle path resolution regressed in 0.7.3+
+        # and the upstream fix is still open:
         # https://github.com/DioxusLabs/dioxus/issues/5233
+        # Bump in lockstep with the lib once that issue is resolved.
         run: cargo binstall dioxus-cli@0.7.2 --disable-telemetry --locked --force -y
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -153,6 +155,10 @@ jobs:
       - name: Bundle (macOS)
         if: runner.os == 'macOS'
         working-directory: ./ui
+        env:
+          # Baked into the binary via `option_env!("SENTRY_DSN")` in ui/src/main.rs.
+          # If the secret isn't set the binary just runs without Sentry reporting.
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
         run: dx bundle --locked --desktop --release --package-types macos
 
       - name: Build DMG (appdmg)
@@ -182,6 +188,26 @@ jobs:
           fi
           codesign --force --sign "$APPLE_SIGNING_IDENTITY" --timestamp ui/dist/Datum.dmg
 
+      - name: Generate dSYM (macOS)
+        if: runner.os == 'macOS' && startsWith(github.ref, 'refs/tags/v')
+        run: |
+          # `debug = "line-tables-only"` in workspace Cargo.toml leaves DWARF
+          # distributed across the `.o` files in target/<triple>/<profile>/deps/
+          # with only N_OSO references in the binary. Without a .dSYM bundle
+          # sentry-cli has nothing to symbolicate against on macOS, so we run
+          # dsymutil manually and stage the result outside the .app bundle so
+          # it doesn't get packaged into the DMG.
+          BIN="ui/target/dx/Datum/release/macos/Datum.app/Contents/MacOS/Datum"
+          DSYM_DIR="$RUNNER_TEMP/dsyms"
+          mkdir -p "$DSYM_DIR"
+          if [ ! -f "$BIN" ]; then
+            echo "Bundled binary not found at $BIN" >&2
+            exit 1
+          fi
+          dsymutil "$BIN" -o "$DSYM_DIR/Datum.dSYM"
+          ls -la "$DSYM_DIR/Datum.dSYM"
+          dwarfdump --uuid "$DSYM_DIR/Datum.dSYM"
+
       - name: Upload Debug Symbols to Sentry (macOS)
         if: runner.os == 'macOS' && startsWith(github.ref, 'refs/tags/v')
         env:
@@ -196,6 +222,7 @@ jobs:
             export PATH="$INSTALL_DIR:$PATH"
             curl -sL https://sentry.io/get-cli/ | SENTRY_CLI_VERSION=3.2.3 sh
             sentry-cli debug-files upload --include-sources \
+              "$RUNNER_TEMP/dsyms" \
               ui/target/dx/Datum/release/macos/Datum.app/Contents/MacOS/
           else
             echo "SENTRY_AUTH_TOKEN not set, skipping debug symbol upload"
@@ -255,6 +282,8 @@ jobs:
         # For now we set NO_STRIP, which makes the bundles *huge*...
         env:
           NO_STRIP: true
+          # Baked into the binary via `option_env!("SENTRY_DSN")` in ui/src/main.rs.
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
         run: dx bundle --locked --desktop --release --package-types appimage
 
       - name: Repack AppImage using system libs (Linux)
@@ -390,6 +419,9 @@ jobs:
       - name: Bundle (Windows)
         working-directory: ./ui
         if: runner.os == 'Windows'
+        env:
+          # Baked into the binary via `option_env!("SENTRY_DSN")` in ui/src/main.rs.
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
         run: dx bundle --locked --desktop --release --package-types nsis
 
       - name: Upload Debug Symbols to Sentry (Windows)

.github/workflows/manual-release.yml

@@ -50,9 +50,11 @@ jobs:
             libxdo-dev
 
       - name: Install Dioxus CLI
-        # Should be pinned to same version as dioxus in Cargo.toml
-        # note: dx bundle on Windows fails with 0.7.3, see
+        # Library deps in ui/Cargo.toml are pinned to dioxus =0.7.9, but the CLI is
+        # held back at 0.7.2 because dx bundle path resolution regressed in 0.7.3+
+        # and the upstream fix is still open:
         # https://github.com/DioxusLabs/dioxus/issues/5233
+        # Bump in lockstep with the lib once that issue is resolved.
         run: cargo binstall dioxus-cli@0.7.2 --disable-telemetry --locked --force -y
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -139,6 +141,10 @@ jobs:
       - name: Bundle (macOS)
         if: runner.os == 'macOS'
         working-directory: ./ui
+        env:
+          # Baked into the binary via `option_env!("SENTRY_DSN")` in ui/src/main.rs.
+          # If the secret isn't set the binary just runs without Sentry reporting.
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
         run: dx bundle --locked --desktop --release --package-types macos
 
       - name: Build DMG (appdmg)
@@ -215,6 +221,8 @@ jobs:
         # For now we set NO_STRIP, which makes the bundles *huge*...
         env:
           NO_STRIP: true
+          # Baked into the binary via `option_env!("SENTRY_DSN")` in ui/src/main.rs.
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
         run: dx bundle --locked --desktop --release --package-types appimage
 
       - name: Repack AppImage using system libs (Linux)
@@ -314,6 +322,9 @@ jobs:
       - name: Bundle (Windows)
         working-directory: ./ui
         if: runner.os == 'Windows'
+        env:
+          # Baked into the binary via `option_env!("SENTRY_DSN")` in ui/src/main.rs.
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
         run: dx bundle --locked --desktop --release --package-types nsis
 
       - name: Upload artifacts