GifBar

A menu bar app for searching, copying and sharing GIFs

Works on macOS, Windows, and Linux

Demo

Features

• Lives in your system tray / menu bar
• Search GIFs from GIPHY and Tenor
• Click any GIF to copy the image itself — paste straight into Teams, Slack or Outlook and it arrives animated, not as a link
• Lightweight (~3 MB installer, ~30 MB RAM)
• Cross-platform: macOS, Windows, Linux

Prerequisites

• Node.js 22+
• Rust (stable)
• Platform-specific dependencies:
  • macOS: Xcode Command Line Tools
  • Linux: libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev
  • Windows: Visual Studio C++ Build Tools + WebView2

Installing

Grab the installer for your platform from the latest release.

macOS: first launch

The app is not signed with an Apple Developer ID, so Gatekeeper blocks it on first open. This is expected — right-click the app in Applications and choose Open, then confirm. You only do this once.

If macOS insists the app "is damaged and can't be opened", that is the quarantine attribute rather than a real problem:

xattr -cr /Applications/GifBar.app

Setup (development)

1. Clone the repository
2. Install dependencies:

   npm install

3. Optionally point the app at your own GIF proxy — it defaults to the deployed one, so this is only needed if you are running the Worker locally:

   cp .env.example .env   # then set VITE_GIF_API_BASE=http://localhost:8787

Where the API keys live

The app ships no API keys. Vite inlines import.meta.env values into the JavaScript bundle at build time, so a key referenced from the frontend ends up in plain text inside every shipped .app and .exe, recoverable with strings in seconds.

Instead, GIPHY and Tenor are called from a Cloudflare Worker in worker/, which holds the keys as encrypted secrets and normalizes both providers into one response shape. The desktop app only ever talks to that Worker. A leaked or rate-limited key can be rotated with wrangler secret put — no new release.

The Worker deploys from CI — see worker/README.md for the one secret it needs and how to set the provider keys.

Development

npm run tauri dev

Testing

npm test

Building

npm run tauri build

This produces platform-specific installers:

• macOS: .dmg in src-tauri/target/release/bundle/dmg/
• Windows: .exe installer in src-tauri/target/release/bundle/nsis/
• Linux: .deb and .AppImage in src-tauri/target/release/bundle/

Releasing

Releases are cut by release-please from conventional commits — you never tag by hand.

1. Land conventional commits on master (feat:, fix:, …).
2. release-please keeps a release PR open with the version bump and changelog. Merging it is what cuts the release.
3. .github/workflows/release.yml then tags, builds installers for macOS (Apple Silicon + Intel), Windows and Linux, and uploads them to a draft release.
4. The publish job checks a .dmg, .AppImage, .deb and .exe are all attached before flipping the release live.

The draft step matters: a published GitHub release is immutable, so assets have to land before it goes live.

Required GitHub Actions configuration:

Name	Kind	Purpose
TAURI_SIGNING_PRIVATE_KEY	secret	signs updater artifacts (npx tauri signer generate)
TAURI_SIGNING_PRIVATE_KEY_PASSWORD	secret	password for the above
CLOUDFLARE_API_TOKEN	secret	deploys the GIF proxy Worker
VITE_GIF_API_BASE	variable	URL of the Worker — only if it is not the default

Note that CI itself needs no secrets, which is what keeps Dependabot's builds green — Dependabot events get an empty secrets context.

Tech Stack

• Tauri v2 — lightweight desktop framework (Rust backend, native webview)
• Svelte 5 — reactive UI framework (compiles to vanilla JS)
• Vite — frontend build tool
• Vitest — test framework
• Cloudflare Workers + Hono — the GIF proxy that keeps API keys off users' machines

Download

See all releases here.

License

MIT