fix(release): don't bundle libwayland into the Tauri AppImage, and gate it

[ErikBjare]

A Discord user on CachyOS (KDE Plasma 6, Wayland) gets segfaults clicking tray items in the v0.14.0 Tauri AppImage. Not reproduced yet (we've asked for a backtrace), but the bundle matches a known upstream failure: the v0.14.0 AppImage ships libwayland-client/-cursor/-egl/-server from the Ubuntu 24.04 build image but no Mesa, so host Mesa 25+ loads on top of an older libwayland. That's tauri-apps/tauri#15665 and tauri-apps/tauri#15976 (crash or blank webview), fixed upstream by tauri-apps/tauri#16062 (newer linuxdeploy, shipped in @tauri-apps/cli 2.12.0). It's the same class as #1484, which only covers the Qt bundle.

Changes

• release.yml (build-tauri): LINUXDEPLOY_EXCLUDED_LIBRARIES=libwayland-*, which linuxdeploy (run by Tauri's bundler) reads.
• New step: run host-abi-gate.sh on the Tauri AppImage, checking only libwayland-*.
• host-abi-gate.sh: HOST_ABI_LIBS_LIST replaces the default list. The Tauri AppImage keeps glib on purpose, because its bundled GTK 3 / WebKitGTK need the glib they were built against. The Qt gate is unchanged.

Merge with the v0.14.1 aw-tauri bump. The current aw-tauri pin (1d52445) builds with cli 2.11.4, whose linuxdeploy ignores the exclude variable, so I expect this PR's Linux Tauri jobs to fail the new gate. That's the gate catching the v0.14.0 bundle. aw-tauri master is on cli 2.12.0 (ActivityWatch/aw-tauri@c8c566c), so it should pass once the submodule is bumped.

Tested locally: bash -n, the YAML parses, and the gate's three cases on a fake tree: libwayland present → 1; only glib with the wayland list → 0; only glib with the default list → 1. Extracting a real AppImage needs Linux, so CI is the check there.

Complementary runtime mitigation: ActivityWatch/aw-tauri#286 (WEBKIT_DISABLE_DMABUF_RENDERER=1 under an AppImage).

[ErikBjare]

@greptileai review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T11:10:59.463659Z	cdeeea8	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Confidence Score: 5/5

[High risk] Changes build and release configuration for Linux packages.

No review findings block merging alongside the companion aw-tauri bump described in the PR.

Summary

The PR excludes Wayland libraries from the Tauri AppImage and adds a gate that checks the resulting bundle. HOST_ABI_LIBS_LIST lets the Tauri check keep glib while leaving the Qt default unchanged.

• The latest change makes the symlink test depend on finding the forbidden link.
• Both previous findings are fixed. No new actionable issues were found.
• ErikBjare explicitly accepts Linux Tauri job failures until the companion aw-tauri bump supplies the newer CLI.

_{Reviews (3) · Last reviewed commit: "test(package): make the symlink case dep..." · Reviewed by Greptile}

[ErikBjare]

@greptileai review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cdeeea8b27

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ErikBjare]

@greptileai review

[ErikBjare]

@TimeToBuildBob review

[TimeToBuildBob]

🤖 AI code review

This PR adds a host-ABI gate for the Tauri AppImage in the release workflow, sets LINUXDEPLOY_EXCLUDED_LIBRARIES=libwayland-* to prevent bundling libwayland, and extends host-abi-gate.sh with a HOST_ABI_LIBS_LIST environment variable to replace the default library list. It also adds a new test file for the gate script.

Safe to merge — no P0/P1 findings

Confidence 5/5

✅ No findings. The diff looks correct to me on this pass.

Files changed (3) — the diff as I read it

• .github/workflows/release.yml — Adds a test step for host-abi-gate, sets LINUXDEPLOY_EXCLUDED_LIBRARIES in build-tauri, and adds a Host-ABI gate step for the Tauri AppImage.
• scripts/package/host-abi-gate.sh — Adds HOST_ABI_LIBS_LIST environment variable to override the default HOST_ABI_LIBS array.
• scripts/tests/test_host_abi_gate.py — Adds tests for the gate script covering default list, override, empty override, and symlink handling.

_{Reviewed fdde6f076b54 · openrouter/deepseek/deepseek-v4-flash-0731 · llm engine · 83s · about this reviewer}

_{Maintainer commands}

_{@TimeToBuildBob review (own line) — fresh review · @TimeToBuildBob fix — a worker acts on the findings. Once per comment; 👀 = received.}