ci: Linux packaging smoke on packaging-related PRs

Runs electron-builder --publish never on ubuntu so misconfigured
linux.target / missing maintainer / missing rpmbuild is caught in
the PR, not when someone cuts a release tag. Gated by a paths-filter
on electron-builder.yml / resources / scripts / workflows /
pnpm-lock.yaml so unrelated PRs don't pay the ~4min packaging cost.

Asserts all three artifacts (.AppImage / .deb / .rpm) land in the
release/ directory before the job passes.

Signed-off-by: hqhq1025 <1506751656@qq.com>

Author: hqhq1025

.github/workflows/ci.yml

@@ -46,6 +46,77 @@ jobs:
       - name: Build smoke (electron-vite bundle)
         run: pnpm --filter @open-codesign/desktop exec electron-vite build
 
+  # Linux packaging smoke — actually runs electron-builder for the Linux
+  # targets (AppImage + deb + rpm) so misconfiguration in
+  # apps/desktop/electron-builder.yml (missing maintainer, bad icon size,
+  # wrong artifactName, missing rpmbuild) is caught on every PR instead
+  # of only when a tag release is cut. Runs in parallel with `check` and
+  # only on PRs/pushes that touch packaging-relevant files so unrelated
+  # PRs don't pay the ~4min cost.
+  package-linux-smoke:
+    name: Linux packaging smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Detect packaging-relevant changes
+        id: changes
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            packaging:
+              - 'apps/desktop/electron-builder.yml'
+              - 'apps/desktop/package.json'
+              - 'apps/desktop/resources/**'
+              - 'apps/desktop/scripts/**'
+              - '.github/workflows/ci.yml'
+              - '.github/workflows/release.yml'
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+
+      - name: Setup pnpm
+        if: steps.changes.outputs.packaging == 'true'
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node
+        if: steps.changes.outputs.packaging == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+
+      - name: Install
+        if: steps.changes.outputs.packaging == 'true'
+        run: pnpm install --frozen-lockfile
+
+      - name: Install rpmbuild
+        if: steps.changes.outputs.packaging == 'true'
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends rpm
+
+      - name: Build workspace
+        if: steps.changes.outputs.packaging == 'true'
+        run: pnpm --filter '!@open-codesign/desktop' -r build
+
+      - name: Package Linux (AppImage + deb + rpm)
+        if: steps.changes.outputs.packaging == 'true'
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+        run: pnpm --filter @open-codesign/desktop release
+
+      - name: Assert artifacts
+        if: steps.changes.outputs.packaging == 'true'
+        run: |
+          cd apps/desktop/release
+          ls -la
+          for ext in AppImage deb rpm; do
+            if ! ls *."$ext" >/dev/null 2>&1; then
+              echo "::error::no .$ext produced by electron-builder"
+              exit 1
+            fi
+          done
+          echo "All three Linux artifacts present."
+
   dco:
     name: DCO check
     runs-on: ubuntu-latest