ci(release): stop bundling libwayland in the AppImage and reuse build.yml for releases

.github/workflows/build.yml

@@ -1,7 +1,8 @@
 name: Build
 
-# Reusable build matrix used by nightly.yml (cron). Centralises the
-# signing/notarization config in one place so callers can't drift from it.
+# Reusable build matrix used by nightly.yml (cron) and release.yml (tags).
+# Centralises the signing/notarization config in one place so callers can't
+# drift from it.
 on:
   workflow_call:
     inputs:
@@ -33,6 +34,16 @@ on:
         required: false
         type: string
         default: ""
+      release_body:
+        description: "Body of the GitHub Release."
+        required: false
+        type: string
+        default: "See the assets to download this version and install."
+      experimental_appimage:
+        description: "Build the AppImage with the experimental sharun-based format (tauri PR #12491) instead of the official linuxdeploy bundler. Nightly-only until the PR stabilises."
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   publish-tauri:
@@ -122,10 +133,33 @@ jobs:
         with:
           workspaces: src-tauri
 
-      - name: Override tauri-cli with custom AppImage format (Linux)
-        if: matrix.platform == 'ubuntu-24.04'
+      - name: Override tauri-cli with custom AppImage format (Linux, experimental only)
+        if: matrix.platform == 'ubuntu-24.04' && inputs.experimental_appimage
         run: cargo install tauri-cli --git https://github.com/tauri-apps/tauri --branch feat/truly-portable-appimage --force
 
+      # The official tauri-cli AppImage bundler (linuxdeploy) bundles the build
+      # container's libwayland-*; on hosts with a newer Mesa the host libEGL
+      # binds to that stale bundled libwayland-client and WebKit aborts with
+      # EGL_BAD_PARAMETER (issue #423). libwayland must always come from the
+      # host — the AppImage excludelist prescribes exactly that:
+      # https://github.com/AppImageCommunity/pkg2appimage/pull/559
+      # tauri-bundler only downloads linuxdeploy-plugin-gtk.sh when it's
+      # missing from its tools cache, so pre-seed a patched copy that strips
+      # libwayland from the AppDir before the squashfs is packed (the updater
+      # signature is computed afterwards, so it stays valid).
+      - name: Patch AppImage bundling to strip bundled libwayland (Linux)
+        if: matrix.platform == 'ubuntu-24.04' && !inputs.experimental_appimage
+        run: |
+          mkdir -p ~/.cache/tauri
+          curl -fsSL https://raw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gtk/master/linuxdeploy-plugin-gtk.sh \
+            -o ~/.cache/tauri/linuxdeploy-plugin-gtk.sh
+          cat >> ~/.cache/tauri/linuxdeploy-plugin-gtk.sh <<'EOF'
+
+          # tabularis #423: libwayland must come from the host, never bundled.
+          find "$APPDIR" -name 'libwayland-*.so*' -delete
+          EOF
+          chmod +x ~/.cache/tauri/linuxdeploy-plugin-gtk.sh
+
       # Notarization needs the App Store Connect API key on disk. The .p8 is stored
       # base64-encoded in APPLE_API_KEY_CONTENT and decoded into a temp file (macOS only).
       - name: Prepare Apple API key (macOS only)
@@ -150,7 +184,7 @@ jobs:
       - uses: tauri-apps/tauri-action@73fb865345c54760d875b94642314f8c0c894afa # v0.6.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAURI_BUNDLER_NEW_APPIMAGE_FORMAT: "true"
+          TAURI_BUNDLER_NEW_APPIMAGE_FORMAT: ${{ inputs.experimental_appimage && 'true' || '' }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
           # macOS code signing (Developer ID Application certificate)
@@ -164,10 +198,11 @@ jobs:
         with:
           tagName: ${{ inputs.tag }}
           releaseName: ${{ inputs.release_name }}
-          releaseBody: "See the assets to download this version and install."
+          releaseBody: ${{ inputs.release_body }}
           releaseDraft: ${{ inputs.draft }}
           prerelease: ${{ inputs.prerelease }}
-          tauriScript: ${{ matrix.platform == 'ubuntu-24.04' && 'cargo tauri' || 'pnpm tauri' }}
+          # The experimental AppImage format needs the cargo-installed CLI override.
+          tauriScript: ${{ inputs.experimental_appimage && matrix.platform == 'ubuntu-24.04' && 'cargo tauri' || 'pnpm tauri' }}
           args: ${{ matrix.args }}
 
       - name: Upload portable executable (Windows only)

.github/workflows/nightly.yml

@@ -126,3 +126,6 @@ jobs:
       prerelease: true
       draft: false
       updater_version: ${{ needs.gate.outputs.updater_version }}
+      # Nightlies double as the daily canary for the sharun-based AppImage
+      # format (tauri PR #12491); releases stay on the official bundler.
+      experimental_appimage: true

.github/workflows/release.yml

@@ -1,6 +1,9 @@
 name: Release
-env:
-  GH_TOKEN: ${{ SECRETS.GITHUB_TOKEN }}
+
+# Thin dispatcher over the reusable build matrix in build.yml — the single
+# place that defines platforms, signing and AppImage handling for every
+# channel (release + nightly), so the two can't drift apart again (the
+# v0.13.3 AppImage regression, issue #423, came from exactly that drift).
 on:
   push:
     tags:
@@ -15,39 +18,13 @@ on:
         required: false
 
 jobs:
-  publish-tauri:
-    permissions:
-      contents: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: "macos-latest" # for Arm64
-            args: "--target aarch64-apple-darwin"
-          - platform: "macos-15-intel" # for Intel
-            args: "--target x86_64-apple-darwin"
-          - platform: "ubuntu-24.04"
-            args: ""
-            # Build inside an ubuntu:22.04 container (glibc 2.35) rather than
-            # on the bare ubuntu-24.04 runner (glibc 2.39), so the produced
-            # .deb/.AppImage keep running on older LTS distros. Pinned to the
-            # container image, not the runner, so it's unaffected by GitHub's
-            # eventual deprecation of the ubuntu-22.04 *runner* image.
-            container: "ubuntu:22.04"
-          - platform: "windows-latest"
-            args: ""
-
-    runs-on: ${{ matrix.platform }}
-    container: ${{ matrix.container }}
+  meta:
+    runs-on: ubuntu-latest
+    outputs:
+      ref: ${{ steps.meta.outputs.ref }}
+      tag: ${{ steps.meta.outputs.tag }}
+      prerelease: ${{ steps.meta.outputs.prerelease }}
     steps:
-      # libatomic1 is required by the standalone pnpm binary (@pnpm/exe), which
-      # pnpm/action-setup bootstraps here because it runs before setup-node and
-      # finds no Node in the container.
-      - name: Install container prerequisites (ubuntu container only)
-        if: matrix.container
-        run: |
-          apt-get update
-          apt-get install -y git ca-certificates curl libatomic1
       - name: Resolve build ref + tag
         id: meta
         shell: bash
@@ -72,98 +49,20 @@ jobs:
             fi
           fi
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ steps.meta.outputs.ref }}
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: .node-version
-          cache: "pnpm"
-
-      - name: install Rust stable
-        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-        with:
-          # Those targets are only used on macos runners so it's in an `if` to slightly speed up windows and linux builds.
-          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin' || matrix.platform == 'macos-13' && 'x86_64-apple-darwin' || '' }}
-
-      - name: install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-24.04'
-        run: |
-          apt-get update
-          apt-get install -y \
-            build-essential \
-            curl \
-            wget \
-            file \
-            libssl-dev \
-            libgtk-3-dev \
-            libayatana-appindicator3-dev \
-            librsvg2-dev \
-            libfuse2 \
-            libsoup-3.0-dev \
-            libwebkit2gtk-4.1-dev \
-            patchelf \
-            xdg-utils \
-            gstreamer1.0-plugins-base \
-            gstreamer1.0-plugins-bad \
-            fonts-noto-color-emoji \
-            pkg-config \
-            unzip
-
-      - name: install frontend dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Cache Rust dependencies
-        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: src-tauri
-
-      # Notarization needs the App Store Connect API key on disk. The .p8 is stored
-      # base64-encoded in APPLE_API_KEY_CONTENT and decoded into a temp file (macOS only).
-      - name: Prepare Apple API key (macOS only)
-        if: startsWith(matrix.platform, 'macos')
-        shell: bash
-        run: |
-          echo "${{ secrets.APPLE_API_KEY_CONTENT }}" | base64 --decode > "$RUNNER_TEMP/apple_api_key.p8"
-          echo "APPLE_API_KEY_PATH=$RUNNER_TEMP/apple_api_key.p8" >> "$GITHUB_ENV"
-
-      - uses: tauri-apps/tauri-action@73fb865345c54760d875b94642314f8c0c894afa # v0.6.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
-          # macOS code signing (Developer ID Application certificate)
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
-          # macOS notarization (App Store Connect API key)
-          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-          APPLE_API_KEY_PATH: ${{ env.APPLE_API_KEY_PATH }}
-        with:
-          tagName: ${{ steps.meta.outputs.tag }}
-          releaseName: "v__VERSION__"
-          releaseBody: |
-            See the assets below to download this version and install.
-
-            ---
-            **Stay in touch:** [Website](https://tabularis.dev) · [Discord](https://discord.com/invite/K2hmhfHRSt) · [X](https://x.com/tabularisdb) · [Bluesky](https://bsky.app/profile/tabularis.bsky.social) · [Mastodon](https://mastodon.social/@tabularis) · [GitHub](https://github.com/TabularisDB/tabularis)
-          releaseDraft: true
-          prerelease: ${{ steps.meta.outputs.prerelease == 'true' }}
-          tauriScript: pnpm tauri
-          args: ${{ matrix.args }}
+  publish-tauri:
+    needs: meta
+    permissions:
+      contents: write
+    uses: ./.github/workflows/build.yml
+    secrets: inherit
+    with:
+      ref: ${{ needs.meta.outputs.ref }}
+      tag: ${{ needs.meta.outputs.tag }}
+      release_name: "v__VERSION__"
+      release_body: |
+        See the assets below to download this version and install.
 
-      - name: Upload portable executable (Windows only)
-        if: matrix.platform == 'windows-latest'
-        shell: pwsh
-        run: |
-          $version = "${{ steps.meta.outputs.tag }}".TrimStart('v')
-          $src = "src-tauri\target\release\tabularis.exe"
-          $portable = "tabularis_${version}_x64-portable.exe"
-          Copy-Item $src $portable
-          gh release upload "${{ steps.meta.outputs.tag }}" $portable --clobber
+        ---
+        **Stay in touch:** [Website](https://tabularis.dev) · [Discord](https://discord.com/invite/K2hmhfHRSt) · [X](https://x.com/tabularisdb) · [Bluesky](https://bsky.app/profile/tabularis.bsky.social) · [Mastodon](https://mastodon.social/@tabularis) · [GitHub](https://github.com/TabularisDB/tabularis)
+      draft: true
+      prerelease: ${{ needs.meta.outputs.prerelease == 'true' }}