[codex] Treat Debian package validation as diagnostic

[Jesssullivan]

Summary

• gate Linux release upload on Fedora 42, Rocky 10, and Ubuntu 24.04 exact-artifact validation before running Debian
• keep Debian 12 package validation as a diagnostic baseline/no-WebKit signal until a Debian-specific artifact or backports policy exists
• update Linux packaging/install docs to stop treating the broad-feature Ubuntu-family DEB as Debian baseline proof

Validation

• ruby YAML parse for .github/workflows/release-linux.yml and .github/workflows/test-distro.yml

Tracker links

• TIN-614: signed artifact proof stays in progress until a rerun uploads fresh assets
• TIN-745: Debian 12 baseline/no-WebKit DEB artifact decision
• TIN-184: first Fedora/Rocky KVM proof recorded and closed
• ci(distro): establish Rocky 10 fresh-install proof and retire the Rocky 9 proxy #187: remains open until successful release upload publishes the Rocky RPM and proxy language is retired

Notes

Release run 25087301829 already proved the exact signed Fedora 42 RPM and Rocky 10 terminal-first RPM in KVM. Its remaining failure was the Debian 12 broad-feature DEB mismatch; Ubuntu was skipped only because Debian previously ran first and failed hard.

[greptile-apps]

Greptile Summary

This PR demotes the Debian 12 package-install gate from a blocking release step to a diagnostic baseline, reorders validation so Ubuntu 24.04 runs first (and is still blocking), and updates the documentation to stop presenting the broad-feature Ubuntu-family DEB as Debian baseline proof. The workflow logic is consistent: release-linux.yml uses an unconditional continue-on-error: true, while test-distro.yml uses the dynamic ${{ inputs.distro != 'debian12' }} expression so explicit Debian-targeted runs remain blocking — both expressions evaluate correctly for all expected input values.

Confidence Score: 5/5

This PR is safe to merge — workflow logic is correct, gating is preserved for the three mandatory distros, and documentation is consistent with the new posture.

No bugs or logic errors found. The continue-on-error expressions evaluate correctly for all expected input values, the release job dependency chain still blocks on Ubuntu/Fedora/Rocky, and the documentation changes accurately reflect the new Debian diagnostic status.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/release-linux.yml	Reorders Ubuntu 24.04 before Debian 12 and adds continue-on-error: true to the Debian step; the release job's needs: validate-distro-install dependency correctly propagates the gate, so a Debian-only failure no longer blocks asset upload.
.github/workflows/test-distro.yml	Reorders Ubuntu before Debian and uses continue-on-error: ${{ inputs.distro != 'debian12' }} so that direct Debian 12 runs still fail visibly, while it is non-blocking under the all/default path — logic evaluates correctly for all three input values.
docs/distro-testing-readiness-plan.md	Snapshot date, status table, and ordered next-actions updated to match the new Debian diagnostic posture and Rocky 10 exact-artifact proof from run 25087301829.
docs/linux-packaging-cd-plan.md	Removes the incorrect statement that the broad-feature DEB is Debian 12 baseline proof and clarifies that it is diagnostic until a no-WebKit artifact or backports policy exists.
docs/release/linux-install.md	Renames DEB install section to 'Ubuntu DEB', removes Debian 12 from that path, and adds a clear note that Debian installs are diagnostic until a distinct baseline artifact exists.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[validate-distro-install job] --> B[Fedora 42 — blocking]
    B --> C[Rocky 10 — blocking]
    C --> D[Ubuntu 24.04 — blocking]
    D --> E[Debian 12 — continue-on-error: true]
    E --> F[Upload distro validation logs — always]
    D -->|fail| G[Job fails → release job blocked]
    E -->|fail| H[Diagnostic failure recorded\nJob still succeeds]
    H --> I[release job — needs validate-distro-install]
    F --> I
    I --> J[Upload signed assets to GitHub Release]

Loading

_{Reviews (1): Last reviewed commit: "Treat Debian package validation as diagn..." | Re-trigger Greptile}