Add Linux AppImage shipping foundation

.github/CODEOWNERS

@@ -4,6 +4,9 @@
 /justfile @protocol-works/engineering
 /scripts/create-release.sh @protocol-works/engineering
 /scripts/build-macos-release.sh @protocol-works/engineering
+/scripts/build-linux-appimage.sh @protocol-works/engineering
 /scripts/freeze-sidecar.sh @protocol-works/engineering
+/scripts/release_artifact.py @protocol-works/engineering
+/scripts/verify_linux_appimage.py @protocol-works/engineering
 /src-tauri/entitlements.plist @protocol-works/engineering
 /src-tauri/tauri*.conf.json @protocol-works/engineering

.github/workflows/ci.yml

@@ -51,12 +51,16 @@ jobs:
       - name: Check release tooling formatting
         run: >-
           uv run --project backend --frozen --only-group ci ruff format --check
-          scripts/release_artifact.py scripts/tests/test_release_artifact.py
+          scripts/release_artifact.py scripts/verify_linux_appimage.py
+          scripts/tests/test_release_artifact.py
+          scripts/tests/test_verify_linux_appimage.py
 
       - name: Lint release tooling
         run: >-
           uv run --project backend --frozen --only-group ci ruff check
-          scripts/release_artifact.py scripts/tests/test_release_artifact.py
+          scripts/release_artifact.py scripts/verify_linux_appimage.py
+          scripts/tests/test_release_artifact.py
+          scripts/tests/test_verify_linux_appimage.py
 
       - name: Check portable Python formatting
         working-directory: backend
@@ -152,3 +156,91 @@ jobs:
         run: >-
           cargo clippy --locked --workspace --all-targets
           --manifest-path src-tauri/Cargo.toml -- -D warnings
+
+  linux_appimage:
+    name: Linux AppImage contract (Ubuntu 22.04)
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+
+    steps:
+      - name: Check out source and test corpus
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          lfs: true
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install pinned native build dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes \
+            binutils \
+            build-essential \
+            libasound2-dev \
+            libayatana-appindicator3-dev \
+            libfuse2 \
+            libgtk-3-dev \
+            libssl-dev \
+            libudev-dev \
+            libwebkit2gtk-4.1-dev \
+            libxdo-dev \
+            librsvg2-dev \
+            xvfb
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup default stable
+          cargo install tauri-cli --version '=2.11.2' --locked
+          npm ci --prefix frontend
+
+      - name: Build and audit AppImage
+        env:
+          LSDJ_LINUX_AUDIT_PATH: ${{ runner.temp }}/linux-package-audit.json
+        shell: bash
+        run: scripts/build-linux-appimage.sh
+
+      - name: Smoke AppImage with spaces, Unicode, and isolated XDG roots
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          APPIMAGES=(src-tauri/target/release/bundle/appimage/*.AppImage)
+          [[ "${#APPIMAGES[@]}" -eq 1 ]]
+
+          PROFILE="$RUNNER_TEMP/DJ Name 音楽"
+          export HOME="$PROFILE/home"
+          export XDG_CONFIG_HOME="$PROFILE/config 空間"
+          export XDG_DATA_HOME="$PROFILE/data 音楽"
+          export XDG_CACHE_HOME="$PROFILE/cache 音楽"
+          export XDG_RUNTIME_DIR="$RUNNER_TEMP/xdg-runtime"
+          mkdir -p \
+            "$HOME" \
+            "$XDG_CONFIG_HOME" \
+            "$XDG_DATA_HOME" \
+            "$XDG_CACHE_HOME" \
+            "$XDG_RUNTIME_DIR"
+          chmod 700 "$XDG_RUNTIME_DIR"
+
+          set +e
+          APPIMAGE_EXTRACT_AND_RUN=1 timeout --signal=TERM --kill-after=5s 15s \
+            xvfb-run --auto-servernum "${APPIMAGES[0]}"
+          STATUS=$?
+          set -e
+          [[ "$STATUS" -eq 0 || "$STATUS" -eq 124 || "$STATUS" -eq 143 ]]
+          test -d "$XDG_CONFIG_HOME/lsdj"
+          test -d "$XDG_DATA_HOME/lsdj"
+          test -d "$XDG_CACHE_HOME/lsdj"
+
+      - name: Upload package audit evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-package-audit
+          path: ${{ runner.temp }}/linux-package-audit.json
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/macos-release.yml

@@ -248,14 +248,151 @@ jobs:
             "${LSDJ_CERTIFICATE_PATH:-}" \
             "${LSDJ_API_KEY_PATH:-}"
 
+  produce_linux:
+    name: Produce Linux x86_64 AppImage
+    needs: validate
+    if: >-
+      needs.validate.result == 'success' &&
+      github.repository == 'protocol-works/lsdj' &&
+      startsWith(github.ref, 'refs/tags/v')
+    # Ubuntu 22.04 (glibc 2.35) is the oldest supported base. Building here,
+    # rather than `ubuntu-latest`, prevents a newer host ABI from silently
+    # raising the AppImage floor.
+    runs-on: ubuntu-22.04
+    timeout-minutes: 120
+
+    steps:
+      - name: Check out the approved release tag
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          lfs: true
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.13"
+
+      - name: Install pinned native build dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes \
+            binutils \
+            build-essential \
+            libasound2-dev \
+            libayatana-appindicator3-dev \
+            libfuse2 \
+            libgtk-3-dev \
+            libssl-dev \
+            libudev-dev \
+            libwebkit2gtk-4.1-dev \
+            libxdo-dev \
+            librsvg2-dev \
+            xvfb
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup default stable
+          cargo install tauri-cli --version '=2.11.2' --locked
+          npm ci --prefix frontend
+
+      - name: Test fail-closed portable runtime launch
+        shell: bash
+        run: >-
+          cargo test --locked --workspace --features managed-runtime
+          --manifest-path src-tauri/Cargo.toml runtime_launch
+
+      - name: Build and audit AppImage
+        env:
+          LSDJ_RELEASE_VERSION: ${{ github.ref_name }}
+          LSDJ_LINUX_AUDIT_PATH: ${{ runner.temp }}/linux-package-audit.json
+        shell: bash
+        run: scripts/build-linux-appimage.sh
+
+      - name: Smoke AppImage with isolated XDG paths
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          APPIMAGES=(src-tauri/target/release/bundle/appimage/*.AppImage)
+          [[ "${#APPIMAGES[@]}" -eq 1 ]]
+
+          PROFILE="$RUNNER_TEMP/DJ Name 音楽"
+          export HOME="$PROFILE/home"
+          export XDG_CONFIG_HOME="$PROFILE/config 空間"
+          export XDG_DATA_HOME="$PROFILE/data 音楽"
+          export XDG_CACHE_HOME="$PROFILE/cache 音楽"
+          export XDG_RUNTIME_DIR="$RUNNER_TEMP/xdg-runtime"
+          mkdir -p \
+            "$HOME" \
+            "$XDG_CONFIG_HOME" \
+            "$XDG_DATA_HOME" \
+            "$XDG_CACHE_HOME" \
+            "$XDG_RUNTIME_DIR"
+          chmod 700 "$XDG_RUNTIME_DIR"
+
+          set +e
+          APPIMAGE_EXTRACT_AND_RUN=1 timeout --signal=TERM --kill-after=5s 15s \
+            xvfb-run --auto-servernum "${APPIMAGES[0]}"
+          STATUS=$?
+          set -e
+          [[ "$STATUS" -eq 0 || "$STATUS" -eq 124 || "$STATUS" -eq 143 ]] || {
+            echo "AppImage desktop smoke exited unexpectedly: $STATUS" >&2
+            exit 1
+          }
+          test -d "$XDG_CONFIG_HOME/lsdj"
+          test -d "$XDG_DATA_HOME/lsdj"
+          test -d "$XDG_CACHE_HOME/lsdj"
+
+      - name: Package verified release artifact
+        env:
+          LSDJ_RELEASE_REVISION: ${{ needs.validate.outputs.revision }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          APPIMAGES=(src-tauri/target/release/bundle/appimage/*.AppImage)
+          [[ "${#APPIMAGES[@]}" -eq 1 ]]
+          python scripts/release_artifact.py create \
+            --producer linux-x64 \
+            --release-tag "$GITHUB_REF_NAME" \
+            --revision "$LSDJ_RELEASE_REVISION" \
+            --asset "${APPIMAGES[0]}" \
+            --output-dir release-artifacts/linux-x64
+
+      - name: Upload verified Linux producer bundle
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-linux-x64
+          path: release-artifacts/linux-x64
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Upload Linux package audit evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-package-audit
+          path: ${{ runner.temp }}/linux-package-audit.json
+          if-no-files-found: error
+          retention-days: 14
+
   publish:
     name: Verify and publish complete release
     needs:
       - validate
       - produce_macos
+      - produce_linux
     if: >-
       needs.validate.result == 'success' &&
       needs.produce_macos.result == 'success' &&
+      needs.produce_linux.result == 'success' &&
       github.repository == 'protocol-works/lsdj' &&
       startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
@@ -280,6 +417,12 @@ jobs:
           name: release-macos-arm64
           path: release-input/macos-arm64
 
+      - name: Download Linux producer bundle
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-linux-x64
+          path: release-input/linux-x64
+
       - name: Verify complete required producer set
         env:
           LSDJ_RELEASE_REVISION: ${{ needs.validate.outputs.revision }}
@@ -289,6 +432,7 @@ jobs:
           python scripts/release_artifact.py verify \
             --input-root release-input \
             --required-producer macos-arm64 \
+            --required-producer linux-x64 \
             --release-tag "$GITHUB_REF_NAME" \
             --revision "$LSDJ_RELEASE_REVISION" \
             --output-dir verified-release

README.md

@@ -36,6 +36,12 @@ pads and finished tracks come from Stable Audio 3. See
 
 All common tasks live in the [`justfile`](justfile) — run `just` to list them.
 
+Linux x86_64 AppImage support is under active qualification. Packaging and
+hosted CI are available, but a public Linux release remains gated on the
+portable MRT2/Stable Audio backends, licensing, and real NVIDIA/audio/FLX4
+evidence. See [the Linux support status](docs/linux.md); do not infer hardware
+support from a green hosted build.
+
 ## Setup
 
 ```sh

docs/cross-platform-ci-and-release.md

@@ -54,21 +54,29 @@ contract. A fake result must not be reported as hardware qualification.
 
 ## Release producer/publisher boundary
 
-The tag workflow keeps macOS as the only required release artifact initially.
-It has three stages:
+The tag workflow requires macOS and Linux release artifacts. It has three
+stages:
 
 1. `validate` accepts only a calendar-version `v*` tag whose commit is contained
    in `main`.
-2. `produce-macos` waits behind the protected `macos-release` Environment,
+2. Independent producers build their platform artifacts. `produce-macos` waits
+   behind the protected `macos-release` Environment,
    freezes the backend, imports ephemeral signing material, builds, signs,
    notarizes, staples, and verifies the app and DMG. It then uploads one Actions
    artifact containing the DMG, `SHA256SUMS.txt`, and metadata binding the
-   producer to the tag and exact source revision.
+   producer to the tag and exact source revision. `produce-linux` builds the
+   x86_64 AppImage on Ubuntu 22.04 (glibc 2.35), verifies its desktop/resource
+   layout and ELF dependencies, performs an isolated-XDG virtual-X11 smoke, and
+   uploads the AppImage with the same checksum/tag/revision contract.
 3. `publish` is the only job with `contents: write`. It downloads every required
    producer bundle, requires the producer set to match exactly, recomputes all
    sizes and SHA-256 digests, and verifies tag/revision/platform metadata before
    it creates a GitHub Release.
 
+Linux is fail-closed: a skipped or failed producer prevents the publisher from
+running. This automated package smoke does not replace issue #112's NVIDIA,
+Wayland/Xorg, audio, MIDI/FLX4, or suspend/resume hardware gate.
+
 The publisher creates an unpublished draft, uploads the complete verified file
 set, checks GitHub's returned asset names, sizes, upload state, and SHA-256
 digest, and only then makes the release public. A missing digest fails closed.