fix(release): don't bundle libwayland into the Tauri AppImage, and gate it

[ErikBjare]

A Discord user on CachyOS (KDE Plasma 6, Wayland) gets segfaults clicking tray items in the v0.14.0 Tauri AppImage. Not reproduced yet (we've asked for a backtrace), but the bundle matches a known upstream failure: the v0.14.0 AppImage ships libwayland-client/-cursor/-egl/-server from the Ubuntu 24.04 build image but no Mesa, so host Mesa 25+ loads on top of an older libwayland. That's tauri-apps/tauri#15665 and tauri-apps/tauri#15976 (crash or blank webview), fixed upstream by tauri-apps/tauri#16062 (newer linuxdeploy, shipped in @tauri-apps/cli 2.12.0). It's the same class as #1484, which only covers the Qt bundle.

Changes

• release.yml (build-tauri): LINUXDEPLOY_EXCLUDED_LIBRARIES=libwayland-*, which linuxdeploy (run by Tauri's bundler) reads.
• New step: run host-abi-gate.sh on the Tauri AppImage, checking only libwayland-*.
• host-abi-gate.sh: HOST_ABI_LIBS_LIST replaces the default list. The Tauri AppImage keeps glib on purpose, because its bundled GTK 3 / WebKitGTK need the glib they were built against. The Qt gate is unchanged.

Merge with the v0.14.1 aw-tauri bump. The current aw-tauri pin (1d52445) builds with cli 2.11.4, whose linuxdeploy ignores the exclude variable, so I expect this PR's Linux Tauri jobs to fail the new gate. That's the gate catching the v0.14.0 bundle. aw-tauri master is on cli 2.12.0 (ActivityWatch/aw-tauri@c8c566c), so it should pass once the submodule is bumped.

Tested locally: bash -n, the YAML parses, and the gate's three cases on a fake tree: libwayland present → 1; only glib with the wayland list → 0; only glib with the default list → 1. Extracting a real AppImage needs Linux, so CI is the check there.

Complementary runtime mitigation: ActivityWatch/aw-tauri#286 (WEBKIT_DISABLE_DMABUF_RENDERER=1 under an AppImage).

[ErikBjare]

@greptileai review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T14:49:19.704630Z	0fadc04	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Confidence Score: 5/5

[High risk] Changes build and release configuration for Linux packages.

No review findings block merging alongside the companion aw-tauri bump described in the PR.

Summary

The PR excludes Wayland libraries from the Tauri AppImage and adds a gate that checks the resulting bundle. HOST_ABI_LIBS_LIST lets the Tauri check keep glib while leaving the Qt default unchanged.

• The latest change makes the symlink test depend on finding the forbidden link.
• Both previous findings are fixed. No new actionable issues were found.
• ErikBjare explicitly accepts Linux Tauri job failures until the companion aw-tauri bump supplies the newer CLI.

_{Reviews (3) · Last reviewed commit: "test(package): make the symlink case dep..." · Reviewed by Greptile}

[ErikBjare]

@greptileai review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cdeeea8b27

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ErikBjare]

@greptileai review

[ErikBjare]

@TimeToBuildBob review

[TimeToBuildBob]

🤖 AI code review

This PR excludes libwayland from the Tauri AppImage bundle by setting LINUXDEPLOY_EXCLUDED_LIBRARIES in the build-tauri job, adds a host-ABI gate step that runs host-abi-gate.sh on the Tauri AppImage with a wayland-only library list, and extends host-abi-gate.sh to accept a HOST_ABI_LIBS_LIST environment variable that replaces the default library list. It also adds a new test file for the gate script and wires that test into the research-edition-checks job.

Needs a look — P2 only

Confidence 4/5

1 finding · ⚠️ 1 P2

⚠️ P2 medium — scripts/tests/test_host_abi_gate.py:62

The new test test_symlinked_name_is_flagged creates a symlink libwayland-client.so.0 pointing to libgtk-3.so.0. The gate script's scan_dir resolves symlinks and checks the target's basename. In this case, the target is libgtk-3.so.0, which is not in the wayland-only list, so the gate should NOT flag it. However, the test asserts run_gate(bundle, WAYLAND_ONLY) == 1, expecting the gate to fail. The test comment says 'The forbidden name exists only as a link to a harmless file, so this fails if the gate stops checking symlinks.' But the gate checks both the link name and the target name. The link name libwayland-client.so.0 matches the wayland list, so the gate flags it. The test is correct in that the gate flags the symlink by its own name, but the comment is misleading. The test does not actually verify that the target name is checked; it verifies that the link name is checked. This is a test-defect because the test's stated purpose (checking symlink target resolution) is not what it tests. The test would pass even if the gate only checked the link name and never resolved the target, so it does not pin the symlink-target behavior.

Change the symlink target to a file that is in the wayland list, e.g. symlink_to("libwayland-client.so.0") or point to a file with a wayland name. Or change the test to expect returncode 0 if the intent is to test that symlinks are not flagged when target is harmless.

_{How this was verified: Read the gate script's scan_dir: it checks base (the link name) first, and if that matches, it sets matched=1 without needing to resolve the target. The test's symlink name is libwayland-client.so.0, which matches the wayland list, so the gate flags it regardless of the target. The test does not exercise the target-resolution branch.}

Files changed (3) — the diff as I read it

• .github/workflows/release.yml — Adds LINUXDEPLOY_EXCLUDED_LIBRARIES to build-tauri env, a host-ABI gate step for the Tauri AppImage, and a pytest step for the new gate test.
• scripts/package/host-abi-gate.sh — Adds HOST_ABI_LIBS_LIST environment variable that replaces the default HOST_ABI_LIBS array when set.
• scripts/tests/test_host_abi_gate.py — Adds tests for the gate script covering default list, override, empty override, and symlink detection.

Previous review passes

commit	score	findings	engine	when
fdde6f076b54	5/5	0	llm	2026-10-07 12:16 UTC

_{Reviewed dffe289cc8c3 · openrouter/deepseek/deepseek-v4-flash-0731 · llm engine · 51s · about this reviewer}

_{Maintainer commands}

_{@TimeToBuildBob review (own line) — fresh review · @TimeToBuildBob fix — a worker acts on the findings. Once per comment; 👀 = received.}

[ErikBjare]

@TimeToBuildBob What's up with CI here?

[TimeToBuildBob]

Three Linux Tauri jobs are red; Qt, macOS, Windows, CodeQL, Greptile, and the host-abi-gate unit tests are green.

ARM + research (expected): the new Host-ABI gate found all four libwayland-{client,cursor,egl,server} still inside the AppImage. This branch still pins aw-tauri@1d52445 (@tauri-apps/cli 2.11.4), whose linuxdeploy ignores LINUXDEPLOY_EXCLUDED_LIBRARIES. That's the failure the PR body called out.

ubuntu-24.04 x86_64 (different): packaging never put an AppImage in dist/, so the gate glob didn't expand and extract aborted (could not extract activitywatch-tauri*-linux-*.AppImage, exit 2). That's the stale-bundle / silent-package class #1512 already landed on master.

Master is 9 commits ahead, including the CLI 2.12.1 pin (aw-tauri@59685a90) and #1512. Rebasing this branch onto master now so CI can actually test the exclude.

[TimeToBuildBob]

Rebase onto current master is clean locally (3 commits replay, 8/8 test_host_abi_gate.py pass). I cannot push it: TimeToBuildBob has no write on ActivityWatch/activitywatch (Permission denied).

Fork copy: TimeToBuildBob@f0931c4 on fix/tauri-appimage-no-bundled-wayland-rebased.

The PR is MERGEABLE. Update branch pulls in CLI 2.12.1 (aw-tauri@59685a90) and #1512; Linux Tauri CI is then the real test of the exclude. Or reset this branch to that fork SHA.

[TimeToBuildBob]

⚠️ P2 — The new test test_symlinked_name_is_flagged creates a symlink libwayland-client.so.0 pointing to libgtk-3.so.0. The gate script's scan_dir resolves symlinks and checks the target's basename. In this case, the target is libgtk-3.so.0, which is not in the wayland-only list, so the gate should NOT flag it. However, the test asserts run_gate(bundle, WAYLAND_ONLY) == 1, expecting the gate to fail. The test comment says 'The forbidden name exists only as a link to a harmless file, so this fails if the gate stops checking symlinks.' But the gate checks both the link name and the target name. The link name libwayland-client.so.0 matches the wayland list, so the gate flags it. The test is correct in that the gate flags the symlink by its own name, but the comment is misleading. The test does not actually verify that the target name is checked; it verifies that the link name is checked. This is a test-defect because the test's stated purpose (checking symlink target resolution) is not what it tests. The test would pass even if the gate only checked the link name and never resolved the target, so it does not pin the symlink-target behavior.

[TimeToBuildBob]

False positive. test_symlinked_name_is_flagged and its comment explicitly test a forbidden link name pointing to a harmless file; neither claims to test target resolution. That is intentional: the loader can request the forbidden soname even when its target has a different name. Changing the assertion to success would weaken the gate, and pointing at a forbidden regular file would reintroduce the masking problem Greptile already identified and Erik fixed.

Verified on current head 0fadc0400067: all 8 gate tests pass. Replayed the exact fixture against an unchanged gate (exit 1) and a scratch mutation removing -type l from find (exit 0). The test therefore catches loss of symlink scanning exactly as its comment says. No code change needed.

[ErikBjare]

CI after rebasing onto bc96b3d (aw-tauri cad510b, @tauri-apps/cli 2.12.1): the Linux Tauri jobs passed, and the new gate reports PASS: no host-ABI libraries bundled for the extracted activitywatch-tauri-…-linux-x86_64.AppImage, built with linuxdeploy-07333c6. So LINUXDEPLOY_EXCLUDED_LIBRARIES is honored via the inherited environment, which settles the earlier review thread about it. The Qt-build failures on this run are unrelated: aw-server/tests/test_server.py::test_buckets (4 == 1) from buckets leaked by aw-server's new import tests, fixed in ActivityWatch/aw-server#186.

[TimeToBuildBob]

That settles the exclusion question: the rebased Linux Tauri build is exercising the newer linuxdeploy, and the real AppImage passes the Wayland gate. The Qt failure has a separate fix in ActivityWatch/aw-server#186, so I won't duplicate it here.

Our symlink-test finding is a false positive. On current head 0fadc0400067, all 8 gate tests pass; removing -type l from a scratch copy changes the exact fixture from rejection (exit 1) to success (exit 0). The test checks the forbidden link name, precisely as its name and comment say—not target resolution. Posted the evidence on the finding thread; no code change needed.

I cannot resolve the inline thread: GitHub denies ResolveReviewThread for TimeToBuildBob here. Please resolve that false-positive thread. I have not rerun CI or merged this PR; the separate Qt fix needs to be incorporated before those jobs can pass.