test(desktop): add Linux packaged app E2E

.github/workflows/ci.yml

@@ -182,6 +182,7 @@ jobs:
       # step. A missing or malformed filter output must fail this job instead
       # of silently making every expensive job skip.
       ci: ${{ steps.scope.outputs.ci }}
+      desktop: ${{ steps.scope.outputs.desktop }}
       native: ${{ steps.matrices.outputs.native }}
       # Matrix include lists for keyring-smoke and npm-global-smoke, built and
       # shape-checked by the same validation step as `native`.
@@ -263,6 +264,20 @@ jobs:
               - '.github/workflows/ci.yml'
             gui:
               - 'gui/**'
+            # Building both Linux package formats and booting their real payloads is
+            # substantially heavier than the Rust-only desktop-shell check. Keep it
+            # scoped to inputs that can change the packaged shell, dashboard or
+            # standalone sidecar. The workflow names itself so edits to this lane
+            # cannot skip their own E2E.
+            desktop:
+              - 'desktop/**'
+              - 'gui/**'
+              - 'src/**'
+              - 'scripts/build-standalone.ts'
+              - 'scripts/standalone-targets.ts'
+              - 'package.json'
+              - 'bun.lock'
+              - '.github/workflows/ci.yml'
             # The docs site is built by nothing else on a pull request. `ci` above
             # deliberately omits `docs-site/**` -- a prose edit has no business
             # starting the cross-platform suite -- and `deploy-docs.yml` triggers
@@ -345,6 +360,7 @@ jobs:
         env:
           CI_SCOPE: ${{ steps.filter.outputs.ci }}
           PRIVACY_SCOPE: ${{ steps.filter.outputs.privacy }}
+          DESKTOP_SCOPE: ${{ steps.filter.outputs.desktop }}
         run: |
           set -euo pipefail
           case "$CI_SCOPE" in
@@ -365,6 +381,15 @@ jobs:
               exit 1
               ;;
           esac
+          case "$DESKTOP_SCOPE" in
+            true|false)
+              printf 'desktop=%s\n' "$DESKTOP_SCOPE" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              printf '::error::changes.outputs.desktop was %q, expected true or false\n' "$DESKTOP_SCOPE"
+              exit 1
+              ;;
+          esac
 
       - name: Assert the native and matrix outputs are usable
         id: matrices
@@ -1264,11 +1289,11 @@ jobs:
   desktop-shell:
     name: desktop shell
     needs: [changes, gates]
-    # Native-gated like platform-macos: the Rust shell is formatted, linted
-    # and tested only when native-capable paths changed.
-    if: github.event_name != 'pull_request' || (needs.changes.outputs.ci == 'true' && needs.changes.outputs.native == 'true')
+    # Native shell changes run the Rust checks; package-affecting changes also run the real Linux
+    # bundle acceptance. The aggregate gate below mirrors this union exactly.
+    if: github.event_name != 'pull_request' || (needs.changes.outputs.ci == 'true' && (needs.changes.outputs.native == 'true' || needs.changes.outputs.desktop == 'true'))
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 45
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -1278,7 +1303,11 @@ jobs:
       - name: Install Tauri Linux dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf dbus-x11 xvfb xauth xdotool openbox
+
+      - name: Setup Bun for packaged E2E
+        if: needs.changes.outputs.desktop == 'true'
+        uses: ./.github/actions/setup-project-bun
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
@@ -1304,6 +1333,79 @@ jobs:
       - name: Run Rust tests
         run: cargo test --manifest-path desktop/src-tauri/Cargo.toml
 
+      - name: Install packaged E2E dependencies
+        if: needs.changes.outputs.desktop == 'true'
+        run: |
+          bun install --frozen-lockfile
+          cd desktop
+          bun install --frozen-lockfile
+
+      - name: Build dashboard and bundled sidecar
+        if: needs.changes.outputs.desktop == 'true'
+        run: |
+          bun run build:gui
+          bun desktop/scripts/prepare-sidecar.ts --target x86_64-unknown-linux-gnu
+
+      # Build separately. One format failing must not delete or hide the other
+      # format's evidence, and neither verification artifact needs an updater key.
+      - name: Preserve the compiled Linux sidecar
+        if: needs.changes.outputs.desktop == 'true'
+        run: chmod +x desktop/scripts/appimage-patchelf.py
+
+      - name: Build Linux AppImage
+        if: needs.changes.outputs.desktop == 'true'
+        working-directory: desktop
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/opencodex-appimage-target
+          PATCHELF: ${{ github.workspace }}/desktop/scripts/appimage-patchelf.py
+        run: bunx tauri build --ci --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'
+
+      - name: Build Linux deb
+        if: needs.changes.outputs.desktop == 'true'
+        working-directory: desktop
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/opencodex-deb-target
+        run: bunx tauri build --ci --bundles deb --config '{"bundle":{"createUpdaterArtifacts":false}}'
+
+      - name: Stage isolated Linux bundles
+        if: needs.changes.outputs.desktop == 'true'
+        env:
+          APPIMAGE_BUNDLE: ${{ runner.temp }}/opencodex-appimage-target/release/bundle/appimage
+          DEB_BUNDLE: ${{ runner.temp }}/opencodex-deb-target/release/bundle/deb
+          BUNDLE_ROOT: ${{ runner.temp }}/opencodex-linux-bundles
+        run: |
+          set -euo pipefail
+          mkdir -p "$BUNDLE_ROOT/appimage" "$BUNDLE_ROOT/deb"
+          cp -a "$APPIMAGE_BUNDLE/." "$BUNDLE_ROOT/appimage/"
+          cp -a "$DEB_BUNDLE/." "$BUNDLE_ROOT/deb/"
+          chmod -R a-w "$BUNDLE_ROOT"
+
+      - name: Run Linux packaged-shell E2E
+        if: needs.changes.outputs.desktop == 'true'
+        env:
+          REPORT_PATH: ${{ runner.temp }}/opencodex-linux-e2e/report.json
+        run: |
+          set -euo pipefail
+          mkdir -p "$(dirname "$REPORT_PATH")"
+          dbus-run-session -- xvfb-run -a -s '-screen 0 1440x900x24' bash -lc '
+            openbox >"$RUNNER_TEMP/opencodex-openbox.log" 2>&1 &
+            wm_pid=$!
+            trap '\''kill "$wm_pid" 2>/dev/null || true'\'' EXIT
+            bun desktop/scripts/linux-packaged-e2e.ts \
+              --bundle-root "$RUNNER_TEMP/opencodex-linux-bundles" \
+              --report "$REPORT_PATH" \
+              --version "$(jq -r .version package.json)"
+          '
+
+      - name: Upload Linux packaged-shell E2E report
+        if: always() && needs.changes.outputs.desktop == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-packaged-shell-e2e
+          path: ${{ runner.temp }}/opencodex-linux-e2e/report.json
+          if-no-files-found: warn
+          retention-days: 7
+
   ci:
     name: ci
     if: always()
@@ -1331,6 +1433,7 @@ jobs:
           CHANGES_DOCS: ${{ needs.changes.outputs.docs }}
           CHANGES_STRUCTURE: ${{ needs.changes.outputs.structure }}
           CHANGES_NATIVE: ${{ needs.changes.outputs.native }}
+          CHANGES_DESKTOP: ${{ needs.changes.outputs.desktop }}
           CHANGES_PRIVACY: ${{ needs.changes.outputs.privacy }}
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -1352,15 +1455,19 @@ jobs:
           if [ "$EVENT_NAME" = "pull_request" ] && [ "$CHANGES_CI" != "true" ]; then
             scoped=not-requested
           fi
-          # platform-macos, widget and desktop-shell carry a compound
-          # condition: the ordinary scope gate AND the native path filter.
+          # platform-macos and widget carry the ordinary scope gate AND the native path filter.
+          # desktop-shell accepts that native set plus the package-E2E set.
           # This mirrors that expression exactly; where it disagrees with the
           # jobs' own `if:`, the gate fails by name instead of demanding
           # success from a job that was deliberately left unselected.
           native=not-requested
           if [ "$EVENT_NAME" != "pull_request" ] || { [ "$CHANGES_CI" = "true" ] && [ "$CHANGES_NATIVE" = "true" ]; }; then
             native=requested
           fi
+          desktop_shell=not-requested
+          if [ "$EVENT_NAME" != "pull_request" ] || { [ "$CHANGES_CI" = "true" ] && { [ "$CHANGES_NATIVE" = "true" ] || [ "$CHANGES_DESKTOP" = "true" ]; }; }; then
+            desktop_shell=requested
+          fi
           packaging=not-requested
           if [ "$CHANGES_PACKAGING" = "true" ]; then
             packaging=requested
@@ -1407,8 +1514,9 @@ jobs:
               changes|select-windows-runner) echo requested ;;
               test|storage-policy|api-usage|gates|keyring-smoke|docker-smoke)
                 echo "$scoped" ;;
-              platform-macos|widget|desktop-shell)
+              platform-macos|widget)
                 echo "$native" ;;
+              desktop-shell) echo "$desktop_shell" ;;
               npm-global-smoke) echo "$packaging" ;;
               docs-site-build) echo "$docs" ;;
               structure-gate) echo "$structure" ;;

.github/workflows/release.yml

@@ -370,6 +370,7 @@ jobs:
       # and updater signatures require maintainer-owned credentials; builds without
       # those secrets remain useful for local validation but are not release assets.
       - name: Build desktop bundles
+        if: runner.os != 'Linux'
         working-directory: desktop
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
@@ -389,16 +390,58 @@ jobs:
         if: runner.os == 'Linux'
         run: bash desktop/scripts/verify-linux-sidecar.sh
 
+      # Tauri patches a bundle-type marker into the application binary for each Linux format.
+      # Keep each format in its own Cargo target so the deb cannot inherit the AppImage marker
+      # and linuxdeploy cannot mutate the binary later consumed by the deb build.
+      - name: Build Linux AppImage bundle
+        if: runner.os == 'Linux'
+        working-directory: desktop
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/opencodex-appimage-target
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: bunx tauri build --ci --target ${{ matrix.target }} --bundles appimage
+
+      - name: Build Linux deb bundle
+        if: runner.os == 'Linux'
+        working-directory: desktop
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/opencodex-deb-target
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: bunx tauri build --ci --target ${{ matrix.target }} --bundles deb
+
+      - name: Stage isolated Linux release bundles
+        if: runner.os == 'Linux'
+        shell: bash
+        env:
+          DESKTOP_TARGET: ${{ matrix.target }}
+          APPIMAGE_TARGET: ${{ runner.temp }}/opencodex-appimage-target
+          DEB_TARGET: ${{ runner.temp }}/opencodex-deb-target
+        run: |
+          set -euo pipefail
+          bundle_root="$RUNNER_TEMP/opencodex-linux-release-bundles"
+          mkdir -p "$bundle_root/appimage" "$bundle_root/deb"
+          cp -a "$APPIMAGE_TARGET/$DESKTOP_TARGET/release/bundle/appimage/." "$bundle_root/appimage/"
+          cp -a "$DEB_TARGET/$DESKTOP_TARGET/release/bundle/deb/." "$bundle_root/deb/"
+          chmod -R a-w "$bundle_root"
+          echo "DESKTOP_BUNDLE_ROOT=$bundle_root" >> "$GITHUB_ENV"
+
       - name: Rename release assets
         shell: bash
         env:
           RELEASE_VERSION: ${{ inputs.version }}
           DESKTOP_TARGET: ${{ matrix.target }}
         run: |
-          bun desktop/scripts/collect-release-assets.ts \
+          args=( \
             --version "$RELEASE_VERSION" \
             --target "$DESKTOP_TARGET" \
-            --out dist/release
+            --out dist/release \
+          )
+          if [[ -n "${DESKTOP_BUNDLE_ROOT:-}" ]]; then
+            args+=(--bundle-root "$DESKTOP_BUNDLE_ROOT")
+          fi
+          bun desktop/scripts/collect-release-assets.ts "${args[@]}"
 
       # After the bundle exists, not before: a sweep that runs first passes by finding nothing.
       - name: Verify every Mach-O in the bundle carries the release identity

desktop/package.json

@@ -5,6 +5,7 @@
     "dev": "tauri dev",
     "build": "tauri build",
     "build:local": "bun scripts/build-local.ts",
+    "e2e:linux-packaged": "bun scripts/linux-packaged-e2e.ts",
     "icons": "bun scripts/generate-icons.ts",
     "icons:check": "bun scripts/generate-icons.ts --check",
     "prepare-sidecar": "bun scripts/prepare-sidecar.ts",

desktop/scripts/appimage-patchelf.py

@@ -5,17 +5,51 @@
 import sys
 
 
+APPDIR_SIDECAR_TAIL = (
+    "release",
+    "bundle",
+    "appimage",
+    "OpenCodex.AppDir",
+    "usr",
+    "bin",
+    "ocx",
+)
+
+
+def prepared_sidecar(root, candidate, target_root):
+    """Return the one prepared Linux CLI that the AppDir sidecar exactly mirrors."""
+    try:
+        relative = candidate.resolve().relative_to(target_root.resolve())
+    except ValueError:
+        return None
+    if tuple(relative.parts[-len(APPDIR_SIDECAR_TAIL):]) != APPDIR_SIDECAR_TAIL:
+        return None
+    prefix = relative.parts[:-len(APPDIR_SIDECAR_TAIL)]
+    if len(prefix) > 1:
+        return None
+
+    binaries = root / "desktop/src-tauri/binaries"
+    candidates = sorted(path for path in binaries.glob("ocx-*-linux-gnu") if path.is_file())
+    if prefix:
+        candidates = [path for path in candidates if path.name == f"ocx-{prefix[0]}"]
+    matches = [path for path in candidates if path.read_bytes() == candidate.read_bytes()]
+    return matches[0] if len(matches) == 1 else None
+
+
 def main(args):
     root = Path(__file__).resolve().parents[2]
-    triple = "x86_64-unknown-linux-gnu"
-    original = root / "desktop/src-tauri/binaries" / f"ocx-{triple}"
-    sidecar = root / "desktop/src-tauri/target" / triple / "release/bundle/appimage/OpenCodex.AppDir/usr/bin/ocx"
-    if len(args) == 3 and args[:2] == ["--set-rpath", "$ORIGIN/../lib"] and Path(args[2]).resolve() == sidecar.resolve():
+    target_root = Path(os.environ.get("CARGO_TARGET_DIR", root / "desktop/src-tauri/target"))
+    sidecar = Path(args[2]) if len(args) == 3 else None
+    if (
+        sidecar is not None
+        and args[:2] == ["--set-rpath", "$ORIGIN/../lib"]
+        and prepared_sidecar(root, sidecar, target_root) is not None
+    ):
         # linuxdeploy's nested GTK pass runs ldd again after patching. Its
         # patchelf rewrite breaks the compiled Bun ELF. This sidecar depends
         # only on host glibc libraries; it needs no AppDir library search path.
         # Never bless an already-modified binary or a different executable.
-        if sidecar.is_symlink() or original.read_bytes() != sidecar.read_bytes():
+        if sidecar.is_symlink():
             raise RuntimeError("AppImage sidecar differs from the prepared CLI")
         print("Preserving compiled ocx bytes (no AppDir RPATH required)", file=sys.stderr)
         return

desktop/scripts/collect-release-assets.ts

@@ -42,6 +42,7 @@ export interface CollectReleaseAssetsOptions {
   target: string;
   out: string;
   repoRoot?: string;
+  bundleRoot?: string;
 }
 
 function findBundle(directory: string, kind: BundleKind): string {
@@ -61,13 +62,17 @@ export function collectReleaseAssets(options: CollectReleaseAssetsOptions): stri
   const repoRoot = resolve(options.repoRoot ?? join(import.meta.dir, "../.."));
   const bundles = bundlesByTarget[options.target];
   if (!bundles) throw new Error(`Unsupported desktop target: ${options.target}`);
+  const bundleRoot = resolve(
+    options.bundleRoot
+      ?? join(repoRoot, "desktop", "src-tauri", "target", options.target, "release", "bundle"),
+  );
 
   const output = resolve(options.out);
   mkdirSync(output, { recursive: true });
   const written: string[] = [];
   for (const bundle of bundles) {
     const source = findBundle(
-      join(repoRoot, "desktop", "src-tauri", "target", options.target, "release", "bundle", bundle.dir),
+      join(bundleRoot, bundle.dir),
       bundle.kind,
     );
     const destinationName = `OpenCodex-${options.version}-${bundle.name}`;
@@ -98,8 +103,11 @@ if (import.meta.main) {
   const version = argument("--version");
   const target = argument("--target");
   const out = argument("--out");
+  const bundleRoot = argument("--bundle-root");
   if (!version || !target || !out) {
     throw new Error("Usage: collect-release-assets.ts --version <version> --target <target> --out <dir>");
   }
-  for (const path of collectReleaseAssets({ version, target, out })) console.log(`Wrote ${path}`);
+  const options: CollectReleaseAssetsOptions = { version, target, out };
+  if (bundleRoot) options.bundleRoot = bundleRoot;
+  for (const path of collectReleaseAssets(options)) console.log(`Wrote ${path}`);
 }