feat(release): add deb packaging pipeline

[YougLin-dev]

What Changed

• Added Linux .deb packaging to the desktop release flow.
• Updated the GitHub release workflow to build, collect, and publish .deb artifacts alongside the existing desktop assets.
• Added a dedicated local command for Debian packaging: bun run dist:desktop:deb.
• Hardened the desktop artifact build script so staging installs no longer depend on a globally available node-gyp.
• Added the Debian metadata required by electron-builder / fpm for .deb output.
• Updated the marketing download surfaces to expose the new Linux .deb download option.
• Updated release documentation to reflect the new release artifact set and Linux packaging behavior.

Why

• We needed a first-class Debian package in addition to the existing AppImage output.
• Local packaging was working, but CI/CD was not set up to produce and publish .deb assets.
• The packaging flow was brittle because staging installs could fail when node-pty needed to rebuild without a resolvable node-gyp.
• Debian packaging also requires metadata that was not previously present in the staged package config.
• The download UI needed to reflect the new distribution option so users can actually discover and install it.

UI Changes

• Added a new Linux download card for Debian / Ubuntu (.deb) on the /download page.
• Updated the Linux homepage download CTA to fall back to .deb when an AppImage asset is not available.
• No animation or interaction behavior changed.

Before:

• Linux downloads exposed AppImage only.

After:

• Linux downloads expose both AppImage and .deb.

Screenshots:

• Attach before/after screenshots of the /download page showing the added .deb card.

Video:

• Not applicable. There are no animation or interaction changes in this PR.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes (not applicable: no animation/interaction changes)

---

Note

Medium Risk
Changes the CI release matrix and desktop artifact build/staging process, which could break production release builds or dependency installation (notably native modules) across platforms. Limited runtime impact for users, but packaging/metadata changes for Linux releases need verification.

Overview
Adds first-class Linux .deb packaging to the desktop release workflow: CI now builds an additional Linux deb target, collects/publishes *.deb assets, and includes them in the GitHub Release upload set.

Extends local tooling and build staging to support .deb output by adding dist:desktop:deb, injecting Debian metadata (homepage, Linux maintainer) into the staged package.json, and hardening dependency installs via a generated node-gyp shim + cleaned env so staging no longer relies on a globally available node-gyp.

Updates marketing download surfaces to expose the new .deb option (new Linux download card on /download, and homepage Linux CTA falls back to .deb if no AppImage), and refreshes docs/release.md to document the new artifact set and that Linux auto-update remains AppImage-only.

^{Written by Cursor Bugbot for commit 8fbc65d. This will update automatically on new commits. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 1c404c4f-9d6f-4f6e-b957-b8bf9c90d166

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Duplicate artifact name causes Linux build upload conflict

High Severity

The two new Linux matrix entries (Linux x64 AppImage and Linux x64 deb) both have platform: linux and arch: x64, so the artifact upload name desktop-${{ matrix.platform }}-${{ matrix.arch }} resolves to desktop-linux-x64 for both jobs. With actions/upload-artifact@v7, uploading a second artifact with the same name in the same workflow run results in a 409 Conflict error. The artifact name template needs to incorporate matrix.target to differentiate the two Linux builds.

Additional Locations (1)

• .github/workflows/release.yml#L102-L107

 

[cursor]

Windows PATH key casing causes broken environment variable

Medium Severity

On Windows, spreading process.env into a plain object loses case-insensitivity — the path key is stored as Path, not PATH. Reading buildEnv.PATH returns undefined, so the assignment creates a new PATH key containing only nodeGypShim.shimDir, while Path (with the real system path) remains untouched. The resulting env object has both Path and PATH, leading to unpredictable behavior: the child process may lose the system path entirely, preventing bun and other tools from being found.