docs(build): explain where createUpdaterArtifacts is enabled

[TimeToBuildBob]

tauri.conf.json has no bundle.createUpdaterArtifacts key, yet release builds produce .sig updater artifacts. The explanation is in Makefile: when TAURI_SIGNING_PRIVATE_KEY is present in the environment, a --config override injects the flag at build time.

Add a three-line comment on the build target so the config file is not misleading to anyone reading it in isolation.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the documentation now accurately describes the existing build behavior.

Findings

1.  The comment says Tauri CLI automatically enables createUpdaterArtifacts , but the surrounding Makefile explicitly enables it by adding a --config override when TAURI SIGNING PRIVATE KEY is defined. This may lead maintainers to assume that direct CLI builds receive the same override. ▶

Summary

The PR documents why signed builds generate updater signature artifacts even though createUpdaterArtifacts is absent from tauri.conf.json.

• Clarifies that the Makefile’s conditional --config override enables updater artifacts.
• Corrects the wording identified in the previous review.

_{Reviews (2) · Last reviewed commit: "docs(build): attribute createUpdaterArti..."}

[greptile-apps]

The comment says Tauri CLI automatically enables createUpdaterArtifacts, but the surrounding Makefile explicitly enables it by adding a --config override when TAURI_SIGNING_PRIVATE_KEY is defined. This may lead maintainers to assume that direct CLI builds receive the same override.

Suggested change

	# TAURI_SIGNING_PRIVATE_KEY in the environment causes Tauri CLI to set
	# bundle.createUpdaterArtifacts=true automatically. That flag is therefore
	# absent from tauri.conf.json even though release builds produce .sig files.
	# When TAURI_SIGNING_PRIVATE_KEY is present, the Makefile override above sets
	# bundle.createUpdaterArtifacts=true. That flag is therefore absent from
	# tauri.conf.json even though signed builds produce .sig files.

Knowledge Base Used:

• Local build and packaging
• Build, release, and distribution

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[TimeToBuildBob]

Fixed in 9ced114 — comment now attributes the flag to the Makefile's --config override (using your suggested wording).

[TimeToBuildBob]

@greptileai review

[TimeToBuildBob]

🤖 AI code review

This PR adds a three-line comment to the Makefile's build target explaining that the bundle.createUpdaterArtifacts flag is injected via a --config override when TAURI_SIGNING_PRIVATE_KEY is set, and is therefore absent from tauri.conf.json. No functional code changes are made.

Safe to merge — no P0/P1 findings

Confidence 5/5

✅ No findings. The diff looks correct to me on this pass.

Files changed (1) — the diff as I read it

• Makefile — Adds a comment block to the build target explaining the absence of createUpdaterArtifacts in tauri.conf.json.

_{Reviewed 9ced1149ced8 · openrouter/deepseek/deepseek-v4-flash-0731 · llm engine · 11s · about this reviewer}

_{Maintainer commands}

_{@TimeToBuildBob review (own line) — fresh review · @TimeToBuildBob fix — a worker acts on the findings. Once per comment; 👀 = received.}

[TimeToBuildBob]

CI-green and mergeable (Greptile 5/5) — waiting only on a maintainer click.

This PR is ready to merge, but the bot has pull-only access to this repo and can't self-merge — surfacing it here so it isn't lost. The monitoring loop will stop re-flagging it now that this note is posted.