feat: ship the CLI inside every installer and manage it from settings

.github/workflows/ci-acp-sdk.yml

@@ -16,7 +16,7 @@ on:
       - "NuGet.config"
       - "global.json"
   pull_request:
-    branches: [develop]
+    branches: [develop, main]
     paths:
       - "src/SalmonEgg.Acp/**"
       - "src/SalmonEgg.Acp/README.md"

.github/workflows/ci-core.yml

@@ -13,7 +13,7 @@ on:
       - "LICENSE"
       - ".github/FUNDING.yml"
   pull_request:
-    branches: [develop]
+    branches: [develop, main]
     paths-ignore:
       # Documentation-only edits cannot change build or test outcomes, and running the heavy platform
       # matrix for them costs runner minutes while adding no signal. Listed explicitly rather than as
@@ -103,10 +103,11 @@ jobs:
           -SkipContractSuites
 
       # The release build can only assert this rule while producing a real MSI, which happens on tags
-      # only. Running the rule itself here keeps a weakened PATH check from reaching a release.
-      - name: Run CLI MSI PATH contract gate
+      # only. Running the rule itself here keeps a weakened PATH check from reaching a release. Both
+      # Windows installers register the command this way, so this one rule covers both.
+      - name: Run MSI PATH contract gate
         shell: pwsh
-        run: ./scripts/gates/run-cli-msi-path-contract-gate.ps1
+        run: ./scripts/gates/run-msi-path-contract-gate.ps1
 
       # The MSIX contract gate itself only runs against a real package in the platform workflow. Running
       # its self-test here keeps the rule from being weakened without anyone noticing: a check that never
@@ -115,7 +116,7 @@ jobs:
         shell: pwsh
         run: ./scripts/gates/run-msix-package-contract-gate.ps1 -SelfTest
 
-      # Same reasoning as the CLI MSI gate above, for the desktop package: the release step can only read
+      # Same reasoning as the PATH gate above, for the desktop package as a whole: the release step can only read
       # a real MSI on a tag with WiX present, so the rule ran unrehearsed until it broke the v1.3.0
       # release from inside OpenView. This drives the rule against fake databases on every push.
       - name: Run desktop MSI contract gate
@@ -126,6 +127,13 @@ jobs:
         shell: bash
         run: scripts/gates/run-release-artifact-contract-gate.sh --self-test
 
+      # The macOS installer's postinstall is the only thing that puts salmon-egg on PATH there, and it
+      # normally runs only inside `installer -pkg` on a Mac. This drives that exact script against fake
+      # roots, so a weakened or broken link step fails on the pushing commit instead of on a user's machine.
+      - name: Run macOS installer PATH contract gate
+        shell: bash
+        run: scripts/gates/run-macos-pkg-contract-gate.sh
+
       - name: Upload test results
         if: always()
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0

.github/workflows/code-quality.yml

@@ -13,7 +13,7 @@ on:
       - "LICENSE"
       - ".github/FUNDING.yml"
   pull_request:
-    branches: [develop]
+    branches: [develop, main]
     paths-ignore:
       # Documentation-only edits cannot change build or test outcomes, and running the heavy platform
       # matrix for them costs runner minutes while adding no signal. Listed explicitly rather than as

.github/workflows/codeql.yml

@@ -11,7 +11,7 @@ on:
       - "global.json"
       - ".github/workflows/codeql.yml"
   pull_request:
-    branches: [develop]
+    branches: [develop, main]
     paths:
       - "src/**"
       - "tests/**"

.github/workflows/gui-smoke-gates.yml

@@ -14,7 +14,7 @@ on:
       - "LICENSE"
       - ".github/FUNDING.yml"
   pull_request:
-    branches: [develop]
+    branches: [develop, main]
     paths-ignore:
       # Documentation-only edits cannot change build or test outcomes, and running the heavy platform
       # matrix for them costs runner minutes while adding no signal. Listed explicitly rather than as

.github/workflows/platform-build-gates.yml

@@ -13,7 +13,7 @@ on:
       - "LICENSE"
       - ".github/FUNDING.yml"
   pull_request:
-    branches: [develop]
+    branches: [develop, main]
     paths-ignore:
       # Documentation-only edits cannot change build or test outcomes, and running the heavy platform
       # matrix for them costs runner minutes while adding no signal. Listed explicitly rather than as
@@ -72,15 +72,41 @@ jobs:
         with:
           global-json-file: global.json
 
+      # Installing SalmonEgg installs the salmon-egg command, so the app package carries the CLI and
+      # symlinks it into /usr/bin. Published first because the app publish embeds it.
+      - name: Publish bundled CLI
+        id: bundled-cli
+        run: scripts/release/publish-cli-binary.sh --rid linux-x64 --configuration ${{ env.CONFIGURATION }}
+
+      - name: Smoke the bundled CLI executable
+        run: scripts/gates/run-cli-release-artifact-smoke.sh "${{ steps.bundled-cli.outputs.executable-path }}"
+
+      # Self-contained rather than framework-dependent: this is the shape the Debian package ships, and a
+      # framework-dependent publish would prove something about a layout nobody installs. The bundled CLI
+      # lands at cli/salmon-egg in the publish output, which is what the package symlinks to.
       - name: Publish Linux Desktop
         run: >-
           dotnet publish SalmonEgg/SalmonEgg/SalmonEgg.csproj
           --configuration ${{ env.CONFIGURATION }}
           --framework net10.0-desktop
           --runtime linux-x64
-          --self-contained false
+          --self-contained true
+          -p:SalmonEggBundledCliExecutable=${{ steps.bundled-cli.outputs.executable-path }}
           --output publish/linux-desktop
 
+      - name: Build Debian package
+        id: build-deb
+        run: >-
+          scripts/release/build-desktop-deb.sh
+          --publish-dir publish/linux-desktop
+          --architecture amd64
+
+      # The one packaging chain in this repository that can be verified end to end by a runner: install the
+      # package, prove the app and the command are both usable, then purge and prove they are gone. Every
+      # other installer's PATH registration can only be asserted against the package's own tables.
+      - name: Smoke the Debian package install and PATH registration
+        run: scripts/gates/run-desktop-linux-package-smoke.sh "${{ steps.build-deb.outputs.deb-path }}"
+
   macos-desktop:
     name: macOS Desktop
     # Pinned rather than macos-latest: GitHub rolls that alias to a new major image on its own schedule,
@@ -160,6 +186,22 @@ jobs:
             -f net10.0 `
             -v minimal
 
+      # Installing SalmonEgg installs the salmon-egg command, so the package carries the CLI binary and
+      # Package.appxmanifest registers it as an app execution alias. Published on this runner rather than
+      # taken from a cross-job artifact: the alias points at a path inside the package, and a stale
+      # binary passed between jobs would satisfy the packaging step while shipping a different command
+      # than this commit builds.
+      - name: Publish bundled CLI
+        id: bundled-cli
+        shell: bash
+        run: scripts/release/publish-cli-binary.sh --rid win-x64 --configuration ${{ env.CONFIGURATION }}
+
+      # A publish that produced a file is not evidence the file starts. This is the binary users will
+      # invoke, so exercise it before it is sealed into a package where nothing can run it again.
+      - name: Smoke the bundled CLI executable
+        shell: bash
+        run: scripts/gates/run-cli-release-artifact-smoke.sh "${{ steps.bundled-cli.outputs.executable-path }}"
+
       - name: Publish unsigned Windows MSIX
         shell: pwsh
         run: |
@@ -173,6 +215,7 @@ jobs:
             /p:IsolatedMsixBuild=true `
             /p:BuildProjectReferences=false `
             /p:DisableCustomWinSdkXamlReferences=true `
+            /p:SalmonEggBundledCliExecutable="${{ steps.bundled-cli.outputs.executable-path-native }}" `
             /p:AppxPackageSigningEnabled=false `
             /p:Restore=false `
             /v:minimal