chore(desktop): pin AppImage static runtime toolset

[addisonbeck]

🎟️ Tracking

• PM-42189
• Closes bitwarden/clients#22528

📔 Objective

The Linux AppImage has a runtime dependency on libfuse2 because electron-builder 26.x defaults to the legacy FUSE 2 AppImage runtime. Many distros no longer install libfuse2 by default, causing the AppImage to fail at launch for affected users unless they manually install libfuse2.

This opts into the static type-2 AppImage runtime, which is statically linked against musl libc and requires no libfuse2 on the host. The toolsets.appimage field was introduced in electron-builder v26.8.0 (PR #9558).

When we update to electron-builder v27, the static runtime may become the default, at which point this toolsets block can be removed.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This is a two-line build configuration change: it opts the Linux AppImage into electron-builder's static type-2 runtime via toolsets.appimage, and adds a CODEOWNERS rule for apps/desktop/electron-builder.json. The toolsets field requires electron-builder >= 26.8.0, and the repo pins 26.9.0 in package.json (app-builder-lib@26.9.0 in package-lock.json), so the field is supported. The new CODEOWNERS entry is not shadowed by any later rule in the file, so @bitwarden/team-platform-dev resolves as intended. No runtime application code, encryption, or vault data paths are touched.

Code Review Details

• ❓ : AppImage CI validation installs libfuse2, so a green build does not confirm the libfuse2 dependency is actually gone
  • apps/desktop/electron-builder.json:27

[claude]

❓ QUESTION: AppImage CI validation installs libfuse2, so a green build won't confirm this fix works.

Details

Both jobs that actually launch the produced AppImage install libfuse2 before running it:

• .github/workflows/build-desktop.yml:2286 (validate-linux-x64-appimage)
• .github/workflows/build-desktop.yml:2329 (validate-linux-wayland)

Since the host already has libfuse2, the AppImage launches whether or not the static runtime was picked up. That means CI passes identically before and after this change, and it would keep passing if the toolsets block were ever dropped, renamed, or silently ignored by a future electron-builder version.

Was dropping libfuse2 from those two apt-get install lines considered? That would turn validate-linux-x64-appimage into a real regression guard for PM-42189 rather than a launch smoke test.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.57%. Comparing base (10c94ad) to head (b5282b2).
⚠️ Report is 122 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #23019      +/-   ##
==========================================
+ Coverage   54.84%   55.57%   +0.73%     
==========================================
  Files        4340     4412      +72     
  Lines      138275   140969    +2694     
  Branches    21903    22392     +489     
==========================================
+ Hits        75834    78350    +2516     
+ Misses      56933    56918      -15     
- Partials     5508     5701     +193     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.