release.yml

name: Build Release (DEB + AppImage + APT Repo)

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing git tag to build and publish (e.g. v26.311.21342)"
        required: true
        type: string

permissions:
  contents: write

jobs:
  build-and-publish:
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        include:
          - arch: x64
            runner: ubuntu-latest
            cli_package: "@openai/codex-linux-x64@npm:@openai/codex@linux-x64"
          - arch: arm64
            runner: ubuntu-latest
            cli_package: "@openai/codex-linux-arm64@npm:@openai/codex@linux-arm64"

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: package.json

      - name: Cache electron-builder toolchains
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/electron
            ~/.cache/electron-builder
          key: ${{ runner.os }}-ebuilder-${{ matrix.arch }}-${{ hashFiles('package.json', 'electron-builder.yml') }}
          restore-keys: |
            ${{ runner.os }}-ebuilder-${{ matrix.arch }}-

      - name: Install APT tooling
        run: |
          sudo apt-get update
          sudo apt-get install -y 7zip dmg2img dpkg-dev

      - name: Install npm dependencies
        run: npm install --include=dev

      - name: Download Codex DMG
        run: curl -fL "https://persistent.oaistatic.com/codex-app-prod/Codex.dmg" -o Codex.dmg

      - name: Setup app payload for packaging
        run: NATIVE_ARCH="${{ matrix.arch }}" SKIP_APP_INSTALL=1 bash scripts/setup.sh ./Codex.dmg

      - name: Install Linux Codex CLI payload
        run: npm install --force --no-save "${{ matrix.cli_package }}"

      - name: Resolve Linux Codex CLI binary path
        id: linux_cli
        run: |
          set -euo pipefail
          find_cli_bin_for_arch() {
            find node_modules/@openai -type f -name codex \
              | grep -E "/@openai/codex-linux-${{ matrix.arch }}(-[^/]+)?/vendor/" \
              | head -n 1 || true
          }
          CLI_BIN="$(find_cli_bin_for_arch)"

          if [[ -z "${CLI_BIN}" ]]; then
            echo "Could not locate Linux codex binary under node_modules/@openai." >&2
            exit 1
          fi
          echo "path=${CLI_BIN}" >> "${GITHUB_OUTPUT}"
          file "${CLI_BIN}"

      - name: Replace bundled CLI with Linux binary
        run: |
          set -euo pipefail
          cp -f "${{ steps.linux_cli.outputs.path }}" app_resources/bin/codex
          chmod +x app_resources/bin/codex

      - name: Verify CLI payload extracted
        run: |
          test -x app_resources/bin/codex
          ls -l app_resources/bin/codex
          file app_resources/bin/codex
          file app_resources/bin/codex | grep -E "ELF"

      - name: Build DEB and AppImage
        run: |
          npx electron-builder \
            --config electron-builder.yml \
            --publish never \
            --linux deb AppImage \
            --${{ matrix.arch }}

      - name: Normalize artifact names
        env:
          TAG_NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
        run: |
          set -euo pipefail
          VERSION="${TAG_NAME#v}"
          if [[ "${{ matrix.arch }}" == "x64" ]]; then
            CANON_ARCH="amd64"
          elif [[ "${{ matrix.arch }}" == "arm64" ]]; then
            CANON_ARCH="arm64"
          else
            echo "Unsupported matrix arch: ${{ matrix.arch }}" >&2
            exit 1
          fi

          DEB_FILE="$(ls -1 dist/*.deb | head -n1)"
          APPIMAGE_FILE="$(ls -1 dist/*.AppImage | head -n1)"

          mv -f "${DEB_FILE}" "dist/codex-desktop-${VERSION}-linux-${CANON_ARCH}.deb"
          mv -f "${APPIMAGE_FILE}" "dist/codex-desktop-${VERSION}-linux-${CANON_ARCH}.AppImage"

      - name: Verify packaged CLI binary
        env:
          APP_OUT_DIR: ${{ matrix.arch == 'arm64' && 'dist/linux-arm64-unpacked' || 'dist/linux-unpacked' }}
        run: |
          test -x "${APP_OUT_DIR}/codex-desktop"
          test -x "${APP_OUT_DIR}/codex-desktop.bin"
          head -n 1 "${APP_OUT_DIR}/codex-desktop" | grep -F "#!/usr/bin/env bash"
          test -x "${APP_OUT_DIR}/resources/codex"
          ls -l "${APP_OUT_DIR}/resources/codex"
          file "${APP_OUT_DIR}/resources/codex"
          file "${APP_OUT_DIR}/resources/codex" | grep -E "ELF"
          test -x "${APP_OUT_DIR}/resources/bin/codex"
          ls -l "${APP_OUT_DIR}/resources/bin/codex"
          file "${APP_OUT_DIR}/resources/bin/codex"
          file "${APP_OUT_DIR}/resources/bin/codex" | grep -E "ELF"

      - name: Generate flat APT Packages index for GitHub Releases
        if: matrix.arch == 'x64'
        run: |
          set -euo pipefail
          # Generate a flat Packages file where Filename: is just the .deb basename.
          # This sits alongside the .deb in the GitHub Release assets directory,
          # so APT resolves it correctly when using:
          #   deb [trusted=yes] https://github.com/<owner>/<repo>/releases/latest/download/ ./
          mkdir -p dist/apt-flat
          cp dist/*.deb dist/apt-flat/
          FLAT_REPO=1 bash scripts/build-apt-repo.sh dist/apt-flat
          # Copy the generated index files back to dist/ for upload as release assets
          cp dist/apt-flat/Packages dist/Packages
          cp dist/apt-flat/Packages.gz dist/Packages.gz
          cp dist/apt-flat/Release dist/Release
          cp dist/apt-flat/Translation-en.gz dist/Translation-en.gz

      - name: Create or update GitHub release
        uses: softprops/action-gh-release@v2
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
          files: |
            dist/*.deb
            dist/*.AppImage
            dist/Packages
            dist/Packages.gz
            dist/Release
            dist/Translation-en.gz

      - name: Build gh-pages site
        if: matrix.arch == 'x64'
        env:
          TAG_NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
        run: |
          set -euo pipefail
          REPO_URL="https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}"
          RELEASES_REPO_URL="https://github.com/${{ github.repository }}/releases/latest/download"
          mkdir -p apt-public

          bash scripts/generate-apt-install-script.sh "${{ github.repository_owner }}" "${{ github.event.repository.name }}" apt-public

          cat > apt-public/index.html <<EOF
          <!doctype html>
          <html lang="en">
          <head>
            <meta charset="utf-8" />
            <meta name="viewport" content="width=device-width, initial-scale=1" />
            <title>Install Codex Desktop on Linux | APT Repository</title>
            <meta name="description" content="Install OpenAI Codex Desktop on Ubuntu and Debian via APT repository. Native .deb packages with Wayland support, auto-updates, and one-line install." />
            <meta name="keywords" content="Codex Desktop, Linux, Ubuntu, Debian, APT, install, OpenAI, AI coding agent, deb, AppImage, Wayland" />
            <link rel="canonical" href="${REPO_URL}/" />
            <meta property="og:title" content="Install Codex Desktop on Linux" />
            <meta property="og:description" content="Unofficial native .deb and AppImage packages for OpenAI Codex Desktop on Ubuntu, Debian, and any Linux distro." />
            <meta property="og:url" content="${REPO_URL}/" />
            <meta property="og:type" content="website" />
            <meta property="og:site_name" content="Codex Desktop for Linux" />
            <meta name="twitter:card" content="summary" />
            <meta name="twitter:title" content="Install Codex Desktop on Linux" />
            <meta name="twitter:description" content="Unofficial native packages for OpenAI Codex Desktop on Ubuntu, Debian, and any Linux distro." />
            <style>body{font-family:-apple-system,sans-serif;max-width:800px;margin:2rem auto;padding:0 1rem;line-height:1.6;color:#333}h1{border-bottom:2px solid #10a37f;padding-bottom:.5rem}a{color:#10a37f}pre{background:#f6f8fa;padding:1rem;border-radius:6px;overflow-x:auto}code{font-family:monospace;font-size:.9em}</style>
          </head>
          <body>
            <h1>Codex Desktop for Linux</h1>
            <p>Unofficial native Linux packaging for <a href="https://openai.com/codex/">OpenAI Codex Desktop</a>. Install on Ubuntu, Debian, or any Linux distribution.</p>
            <p><strong>Quick install:</strong></p>
            <pre><code>curl -fsSL ${REPO_URL}/install.sh | sudo bash</code></pre>
            <p><strong>Or add the APT repository:</strong></p>
            <pre><code>echo "deb [trusted=yes] ${RELEASES_REPO_URL}/ ./" | sudo tee /etc/apt/sources.list.d/codex-desktop.list
          sudo apt update
          sudo apt install codex-desktop</code></pre>
            <p style="margin-top:1rem"><strong>Note:</strong> This is an unofficial project. See the <a href="https://github.com/cuongducle/codex-linux">GitHub repository</a> for source code, AppImage downloads, and documentation.</p>
          </body>
          </html>
          EOF

          # Generate robots.txt
          cat > apt-public/robots.txt <<ROBOTSEOF
          User-agent: *
          Allow: /
          Sitemap: https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/sitemap.xml
          ROBOTSEOF

          # Generate sitemap.xml
          cat > apt-public/sitemap.xml <<SITEMAPEOF
          <?xml version="1.0" encoding="UTF-8"?>
          <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
            <url>
              <loc>https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/</loc>
              <lastmod>$(date -u +%Y-%m-%d)</lastmod>
              <changefreq>weekly</changefreq>
              <priority>1.0</priority>
            </url>
            <url>
              <loc>https://github.com/${{ github.repository }}/${{ github.event.repository.name }}</loc>
              <lastmod>$(date -u +%Y-%m-%d)</lastmod>
              <changefreq>weekly</changefreq>
              <priority>0.9</priority>
            </url>
            <url>
              <loc>https://github.com/${{ github.repository }}/${{ github.event.repository.name }}/releases/latest</loc>
              <lastmod>$(date -u +%Y-%m-%d)</lastmod>
              <changefreq>weekly</changefreq>
              <priority>0.8</priority>
            </url>
          </urlset>
          SITEMAPEOF

          # Generate IndexNow key file (https://www.indexnow.org/)
          cat > apt-public/codex-linux-seo-2026.txt <<KEYEOF
          codex-linux-seo-2026
          KEYEOF

      - name: Publish site to gh-pages
        if: matrix.arch == 'x64'
        uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_branch: gh-pages
          publish_dir: ./apt-public