Pithos desktop: Linux builds on Hephaestus's runner

Builds the AppImage, .deb and tar.gz on tag or by hand, runs the tests and
a headless first-run check (per-user paths, the pinned s3d, the pty), and
keeps the files with their checksums for 14 days.

.forgejo/workflows/desktop-linux.yml

@@ -0,0 +1,62 @@
+# Linux builds of the Pithos desktop app on Hephaestus's own runner
+# (hephaestus-linux, jobs in node:22-bookworm inside docker-in-docker).
+# Forgejo reads .forgejo/workflows and so leaves .github/workflows (the
+# macOS build for a GitHub-hosted Mac) alone.
+name: desktop-linux
+
+on:
+  workflow_dispatch:
+  push:
+    tags: ['v*']
+
+jobs:
+  build:
+    runs-on: linux-x64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install
+        run: npm ci --no-audit --no-fund
+
+      - name: Tests
+        run: npm test
+
+      - name: Build
+        run: npx electron-builder --linux AppImage deb tar.gz --x64 --publish never
+
+      # A desktop session is not available here, so check what a first run
+      # needs without a window: per-user paths for a user who cannot write
+      # /etc/s3d, the pinned s3d (checksum checked), and the bundled pty.
+      - name: Smoke test
+        run: |
+          useradd -m smoke 2>/dev/null || true
+          cat > smoke.mjs <<'JS'
+          import { resolveConfigPath, defaultDataDir, linuxUserMode } from './core/paths.js';
+          import { ensureConfig } from './core/config.js';
+          import { installS3d } from './core/binary.js';
+          import { execFileSync } from 'node:child_process';
+          const c = ensureConfig(resolveConfigPath());
+          console.log('user mode', linuxUserMode(), c.file, defaultDataDir());
+          if (!linuxUserMode() || !c.file.startsWith(process.env.HOME)) throw new Error('expected per-user paths');
+          const bin = await installS3d(process.env.HOME + '/bin');
+          console.log(execFileSync(bin, ['version'], { encoding: 'utf8' }).split('\n')[0]);
+          const pty = (await import('@lydell/node-pty')).default;
+          const t = pty.spawn('/bin/sh', ['-c', 'echo pty-ok'], {});
+          await new Promise((r) => { let o = ''; t.onData((d) => { o += d; }); t.onExit(() => { console.log('pty:', o.trim()); if (!o.includes('pty-ok')) process.exit(1); r(); }); });
+          JS
+          chmod -R a+rX .
+          su smoke -c "HOME=/home/smoke node smoke.mjs"
+          dpkg-deb -I dist/desktop/*.deb | grep -E 'Package|Version|Maintainer'
+
+      - name: Checksums
+        run: cd dist/desktop && sha256sum *.AppImage *.deb *.tar.gz | tee SHA256SUMS-linux.txt
+
+      - uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+        with:
+          name: pithos-linux-x64
+          path: |
+            dist/desktop/*.AppImage
+            dist/desktop/*.deb
+            dist/desktop/*.tar.gz
+            dist/desktop/SHA256SUMS-linux.txt
+          retention-days: 14