Files
Dylan M. Taylor 4bf1b20a75 ci: add signed Linux release matrix, packaging lint, and FreeBSD CI (#2758)
Adds the complete signed Linux release matrix, FreeBSD CI, and packaging
lint to ArtCraft Studio, aligned with the Craft suite standards in
`craft-common-actions`.

| Architecture | Formats |

|:-------------|:------------------------------------------------------------------------|
| x86_64 | AppImage and zsync, DEB, RPM, tar.gz, Arch package, Flatpak
bundle, OCI |
| aarch64 | AppImage and zsync, DEB, RPM, tar.gz, Arch package, Flatpak
bundle, OCI |
| riscv64 | DEB, RPM, tar.gz |

### Changes

- **Linux Packaging Matrix**: Builds and packages ArtCraft Studio across
x86_64, aarch64, and riscv64 using `storytold/craft-common-actions`.
Produces DEB, RPM, AppImage, tarball, Arch package, and Flatpak
bundle/OCI artifacts. Cross-compiles riscv64 DEB and RPM via BoringSSL
CMake configuration. Signed Linux artifacts join existing
`artcraft-v<version>` release drafts while retaining macOS and Windows
assets (storytold/craft-common-actions#160 and #161).
- **Release Trigger Alignment**: Like macOS and Windows release
workflows, Linux release builds run on release branches (`release`,
`artcraft-release`, `artcraft-linux`) and `workflow_dispatch` rather
than on PRs.
- **Documentation**: Updated `README.md` to include Linux under download
options and reference `packaging/linux/README.md`. Added
`packaging/windows/README.md` placeholder.
- **Packaging Lint**: Added `.github/workflows/packaging-lint.yml`
calling `craft-common-actions/packaging-lint.yml@main`. Fixed
pre-existing actionlint and shellcheck issues in macOS and Windows
publish workflows (`shell: pwsh` defaults and variable quoting).
- **FreeBSD CI**: Added `.github/workflows/freebsd.yml` calling
`craft-common-actions/freebsd.yml@main` on scheduled nightly runs,
release branches, and manual dispatch (not on pull requests).
- **SQLx Build Fallback**: Updated
`crates/schema/database/sqlite_tasks/build.rs` to fall back to
`SQLX_OFFLINE=true` using committed `.sqlx/` query data when no live
`/tmp/tasks.sqlite` database file exists, fixing nextest coverage
archives under CI.

### Validation

- `actionlint` passes cleanly across all `.github/workflows/*.yml`
files.
- `shellcheck` passes across all scripts in `packaging/linux/*.sh`.
- `xmllint` validates `packaging/linux/ai.artcraft.app.metainfo.xml`.
- `cargo check -p sqlite_tasks`, `cargo test -p sqlite_tasks`, and
`cargo test --no-run -p sqlite_tasks` pass locally without database
environment variables.
- Packaging lint passes 100% green on CI.
- SonarCloud / nextest instrumented test archive build passes on CI.
- Linux package scripts (`package.sh`, `package-test.sh`, `flatpak.sh`)
verified locally and on CI runners.
2026-11-06 20:02:06 -05:00

2.5 KiB

ArtCraft Studio Linux releases

The Linux workflow builds every package before the release job signs and uploads them to the existing artcraft-v<version> draft, retaining Windows and macOS assets. The version comes from crates/desktop/artcraft/tauri.conf.json.

Architecture Outputs Builder
x86_64 AppImage, DEB, RPM, tar.gz, Arch pkg.tar.zst, Flatpak bundle, OCI Ubuntu 22.04 native
aarch64 AppImage, DEB, RPM, tar.gz, Arch pkg.tar.zst, Flatpak bundle, OCI Ubuntu 22.04 ARM native
riscv64 DEB, RPM, tar.gz Ubuntu 24.04 cross compiler

Native AppImages also include zsync delta-update metadata.

Flatpak uses native Ubuntu 24.04 runners and GNOME 51 for GTK3/WebKitGTK 4.1. Its build checks for missing ELF dependencies inside the sandbox. RISC-V packages require Ubuntu 24.04-era libraries; x86_64 and ARM64 use Ubuntu 22.04 as their build baseline. The suite does not publish RISC-V AppImages, Arch packages or Flatpaks.

package.sh <architecture> <rust-target> normalizes Tauri's DEB/RPM/AppImage filenames and extracts the DEB's /usr tree into the suite's bin/ and share/ tarball layout. Shared Craft Arch packaging consumes that tarball, with WebKitGTK, GTK3 and OpenSSL dependencies added. flatpak.sh consumes the same tarball, builds the bundle, and exports the OCI layout.

Release runs import LINUX_SIGNING_KEY for Flatpak commit signatures and OCI publishing. The final shared draft-release action signs RPMs, DEBs, Arch packages, AppImages, tarballs, OCI manifests and checksums. Only a stable version on release or artcraft-release moves the OCI stable architecture tags. Like the macOS and Windows release workflows, Linux release packaging runs on release branches (release, artcraft-release, artcraft-linux) and workflow dispatch rather than on pull requests.

APT, RPM and pacman repositories are generated by artcraft-services from the release assets and checksums. Its release catalog must be updated only after the signed release is published. Installing a DEB manually is separate from publishing that DEB in the website's APT repository.

A successful build proves artifact production and metadata/dependency checks. It does not replace installation and interactive testing on physical RISC-V, ARM64 and x86_64 desktops.