fix: skip AppImage on arm64 Linux -- linuxdeploy has no arm64 build

arm64 Linux (Chromebooks) ships .deb only. x86_64 builds both deb
and AppImage. CI matrix now passes bundles per arch.

Author: ebursztein

.github/workflows/release.yaml

@@ -317,8 +317,10 @@ jobs:
         include:
           - arch: arm64
             runner: ubuntu-24.04-arm
+            bundles: deb
           - arch: x86_64
             runner: ubuntu-24.04
+            bundles: deb,appimage
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v5
@@ -383,13 +385,13 @@ jobs:
           echo "=== assets/manifest.json ==="
           cat assets/manifest.json | head -5
 
-      - name: Build app (deb + AppImage)
+      - name: Build app
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: |
           cd crates/capsem-app
-          cargo tauri build
+          cargo tauri build --bundles ${{ matrix.bundles }}
 
       - name: Validate artifacts
         run: |

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.12] - 2026-03-29
+
+### Fixed
+- **Skip AppImage on arm64 Linux** -- linuxdeploy has no arm64 build. arm64 Linux (Chromebooks) now builds `.deb` only. x86_64 builds both deb + AppImage.
+
 ## [0.14.11] - 2026-03-29
 
 ### Fixed

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/capsem-proto", "crates/capsem-core", "crates/capsem-app", "crates/capsem-agent", "crates/capsem-logger"]
 
 [workspace.package]
-version = "0.14.11"
+version = "0.14.12"
 
 # Always optimize blake3 -- its SIMD assembly is 100x faster than
 # unoptimized Rust. Without this, debug-build hashing takes 24s for 2GB.

crates/capsem-app/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/tauri-apps/tauri/dev/crates/tauri-utils/schema.json",
   "productName": "Capsem",
-  "version": "0.14.11",
+  "version": "0.14.12",
   "identifier": "com.capsem.capsem",
   "build": {
     "beforeDevCommand": "pnpm dev",

justfile

@@ -164,9 +164,11 @@ cross-compile arch="": _check-assets _generate-settings
                cp target/release/capsem-pty-agent target/release/capsem-mcp-server target/release/capsem-net-proxy target/linux-agent/$TARGET_ARCH/ && \
                echo '--- Build frontend ---' && \
                cd frontend && CI=true pnpm install && pnpm build && cd .. && \
-               echo '--- Build Tauri app (deb + AppImage) ---' && \
+               echo '--- Build Tauri app ---' && \
                cargo install tauri-cli --locked && \
-               cd crates/capsem-app && cargo tauri build && cd ../.. && \
+               BUNDLES='deb,appimage' && \
+               [ '$TARGET_ARCH' = 'arm64' ] && BUNDLES='deb' ; \
+               cd crates/capsem-app && cargo tauri build --bundles \$BUNDLES && cd ../.. && \
                echo '--- Validate artifacts ---' && \
                dpkg-deb --info target/release/bundle/deb/*.deb && \
                file target/release/bundle/appimage/*.AppImage 2>/dev/null || true"

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "capsem"
-version = "0.14.11"
+version = "0.14.12"
 requires-python = ">=3.11"
 dependencies = [
     "pydantic>=2.0",

site/src/content/docs/releases/0-14.md

@@ -59,7 +59,7 @@ The settings system is now fully config-driven with Pydantic as the canonical sc
 
 ## Patch Releases
 
-### 0.14.11
+### 0.14.12
 
 - **CI Linux build complete** -- Tauri signing keys, full updater artifact collection, multi-arch matrix (arm64 + x86_64).
 - **`just cross-compile`** -- build Linux app (agent + deb + AppImage) in a container from macOS. Clean build, no stale volumes.

skills/release-process/SKILL.md

@@ -55,6 +55,9 @@ Triggered by `vX.Y.Z` tag push. Sequential jobs:
 - **`Cargo.lock` is gitignored.** CI resolves a fresh lockfile each build. This means dependency versions can drift between builds. Acceptable for now but a reproducibility risk.
 - **Verify assets before Tauri build.** The `Verify assets layout` step lists assets/arm64/ and assets/current/ to catch missing files early. Tauri's build.rs resolves `../../assets/current/vmlinuz` relative to `crates/capsem-app/`.
 - **`pyproject.toml` version must match.** Three files must be bumped in sync: `Cargo.toml` (workspace), `crates/capsem-app/tauri.conf.json`, `pyproject.toml`. `just cut-release` handles this automatically.
+- **No AppImage on arm64.** linuxdeploy has no arm64 build. arm64 Linux (Chromebooks) ships `.deb` only. Use `cargo tauri build --bundles deb` on arm64, full bundles on x86_64.
+- **Tauri signing keys on all platforms.** `TAURI_SIGNING_PRIVATE_KEY` and `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` must be passed to every `cargo tauri build` step (macOS and Linux). Missing keys cause "public key found but no private key" failure.
+- **Test CI with `just cross-compile` before tagging.** Builds the full Linux app in a container, matching CI. If it passes locally, CI should pass.
 
 ## Full-test gates