feat(linux): nfpm .deb/.rpm packaging and CI release job

[cserby]

Dependency

Requires #173 to be merged first. This branch is built on top of story/linux-packaging/install-script-and-docs and references the packaging artifacts it introduces (packaging/linux/udev/, packaging/linux/systemd/, packaging/linux/desktop/). Please merge #173 before this PR and rebase onto master at that point.

Summary

• packaging/linux/nfpm.yaml — nfpm package descriptor mapping the three binaries (openlogi, openlogi-gui, openlogi-agent), udev rules, systemd user unit, desktop entry, and icon into .deb/.rpm. The package version is templated via ${VERSION} env var set by the xtask at build time.
• packaging/linux/nfpm-scripts/postinstall.sh — runs after package install: reloads udevadm, refreshes the icon and desktop caches, and prints instructions to enable the background agent.
• packaging/linux/nfpm-scripts/preremove.sh — runs before package removal: reloads udevadm to revoke uaccess tags immediately.
• xtask/src/linux.rs — new package-linux xtask command: builds release binaries, reads the workspace version from Cargo.toml, and invokes nfpm for both deb and rpm. Accepts --no-build to skip the cargo step.
• .github/workflows/release.yml — new linux-packages job (runs on ubuntu-latest, parallel to dmg): installs nfpm via the goreleaser apt repo, runs cargo run -p xtask -- package-linux, and uploads .deb/.rpm as a release artifact. The publish job now depends on both dmg and linux-packages, downloads both artifact sets, includes .deb/.rpm in the checksums and in the GitHub Release.

Test plan

• cargo run -p xtask -- package-linux produces target/release/openlogi_*.deb and target/release/openlogi_*.rpm after a release build
• dpkg -c target/release/openlogi_*.deb shows all expected paths (/usr/bin/, /etc/udev/rules.d/, /usr/lib/systemd/user/, /usr/share/)
• rpm -qlp target/release/openlogi_*.rpm shows the same paths
• Install the .deb on a fresh Ubuntu VM — udev rules active, agent unit present, desktop entry visible
• CI linux-packages job passes on a tag push

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR adds nfpm-based .deb/.rpm packaging for Linux and a new linux-packages CI job that builds, packages, and uploads the artifacts as part of the release pipeline. The xtask package-linux command, packaging scripts, udev rules, systemd user unit, desktop entry, and supporting shell scripts are all new.

• Several previously-flagged issues are addressed: nfpm is now installed via a pinned version + verified SHA256 (replacing the old trusted=yes apt repo), the removal hook is correctly a postremove (runs after file deletion so udev reload actually revokes access), linux-packages is added to the publish job's needs list, and .deb/.rpm are included in SHA256SUMS.
• The publish job's if condition still does not check needs.linux-packages.result, and the artifact download still uses the hard-fail name: form rather than the best-effort pattern: form used for Windows — so a Linux build failure will block the macOS release publish.
• The reconcile_linux function skips systemctl enable when the unit file is already current, which can leave a manually-disabled service disabled even after the user re-enables "Launch at Login" in the GUI.

Confidence Score: 3/5

Safe to merge for feature development, but a Linux build failure will block the macOS DMG release until the hard-fail download is switched to best-effort.

The publish job uses a hard-fail name:-based artifact download for the Linux packages, and the if condition does not gate on needs.linux-packages.result. A Linux packaging failure will cause the download-artifact step to error out, preventing the macOS DMG from being published. The reconcile_linux also silently skips systemctl enable when the unit file content is unchanged, which can leave the autostart broken after a manual systemctl --user disable.

.github/workflows/release.yml — the publish job artifact download and if-condition; crates/openlogi-agent/src/launch_agent.rs — the idempotency guard in reconcile_linux

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds linux-packages CI job with pinned nfpm SHA256 verification; adds linux-packages to publish needs; but download-artifact for linux packages uses hard-fail name: instead of best-effort pattern:, meaning a Linux build failure still blocks the macOS release publish
xtask/src/linux.rs	New xtask subcommand for building .deb/.rpm; uses env!("CARGO_PKG_VERSION") which correctly inherits the workspace version via version.workspace=true; clean implementation
packaging/linux/nfpm.yaml	nfpm package descriptor for .deb/.rpm; version uses ${VERSION} set by xtask (no v-prefix issue); maintainer format is now correct; postremove (not preremove) correctly triggers udev after file removal
crates/openlogi-agent/src/launch_agent.rs	Adds Linux systemd user-unit reconciliation; render_unit/escape_systemd_exec are correct; but reconcile skips systemctl enable when unit content is unchanged, meaning a manually-disabled service won't be re-enabled by the GUI toggle
crates/openlogi-gui/src/platform/permissions.rs	Adds Linux input-device access probing via /dev/uinput and sysfs HID_ID; classify logic is testable and correct; probe_logitech_hidraw correctly checks vendor via sysfs uevent
packaging/linux/nfpm-scripts/postinstall.sh	Runs as root during dpkg/rpm install; correctly expands @bindir@ placeholder, reloads udev rules, and runs udevadm settle to ensure uaccess tags are applied synchronously
packaging/linux/nfpm-scripts/postremove.sh	Correctly placed as postremove (runs after package files are deleted) so udev reload actually revokes the uaccess tags; addresses the previous preremove timing issue
packaging/linux/install.sh	New shell install script with proper @bindir@ substitution, best-effort daemon-reload via SUDO_USER, and udevadm reload; uses sed metachar escaping for path safety

Sequence Diagram

sequenceDiagram
    participant Tag as Git Tag Push
    participant LPkg as linux-packages job
    participant MacOS as macos job
    participant Pub as publish job

    Tag->>LPkg: trigger
    Tag->>MacOS: trigger (parallel)

    LPkg->>LPkg: cargo run -p xtask -- package-linux
    LPkg->>LPkg: nfpm deb + rpm
    LPkg->>LPkg: upload-artifact OpenLogi-linux-packages

    MacOS->>MacOS: build DMG
    MacOS->>MacOS: "upload-artifact OpenLogi-macos-dmg-*"

    LPkg-->>Pub: (needs gate)
    MacOS-->>Pub: (needs gate)

    Pub->>Pub: download-artifact pattern OpenLogi-macos-dmg best-effort
    Pub->>Pub: download-artifact pattern OpenLogi-windows best-effort
    Pub->>Pub: download-artifact name OpenLogi-linux-packages hard-fail

    Note over Pub: if linux-packages failed, download fails, publish blocked
    Pub->>Pub: "sha256sum .dmg .exe .msi .deb .rpm > SHA256SUMS"
    Pub->>Pub: softprops/action-gh-release publish release

Loading

_{Reviews (17): Last reviewed commit: "Merge remote-tracking branch 'origin/mas..." | Re-trigger Greptile}