feat: cross-platform release (macOS dmg + Linux AppImage)

- Regenerate icon.icns from V13 Tally PNGs via png2icons (pure-JS,
  runs on any CI host — no Apple toolchain required)
- Emit assets/icon.png (1024 px) for Linux AppImage; electron-builder
  expands it into freedesktop hicolor sizes at pack time
- electron-builder.json linux.icon: .icns → .png
- package.json: add dist:linux script (--publish never), bump 0.4.0
- .github/workflows/release.yml: rename job to neutral "Release" and
  add macos (dmg x64+arm64) + linux (AppImage) jobs, each uploading
  artifacts + attaching to the same GitHub Release

Author: sooua

.github/workflows/release.yml

@@ -1,6 +1,7 @@
-name: Release (Windows)
+name: Release
 
-# Push a tag like `v0.1.0` to build and publish a Windows release.
+# Push a tag like `v0.1.0` to build and publish a cross-platform release
+# (Windows NSIS + portable, macOS dmg x64/arm64, Linux AppImage).
 # Can also be run manually from the Actions tab for dry runs.
 on:
   push:
@@ -74,3 +75,92 @@ jobs:
           prerelease: false
           generate_release_notes: true
           fail_on_unmatched_files: true
+
+  macos:
+    runs-on: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Build renderer + main
+        run: npm run build
+
+      - name: Package macOS dmg (x64 + arm64)
+        env:
+          # Unsigned binaries — skip automatic cert discovery. Users will
+          # see a Gatekeeper warning; that's acceptable for an open-source
+          # hobby release.
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+        run: npm run dist:mac
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: tokenwatch-macos-${{ github.sha }}
+          path: |
+            release/TokenWatch-*.dmg
+            release/latest-mac.yml
+          if-no-files-found: error
+
+      - name: Attach to GitHub Release
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            release/TokenWatch-*.dmg
+            release/latest-mac.yml
+          draft: false
+          prerelease: false
+          # generate_release_notes only needs to run on one job — the
+          # windows job handles it; here we just append files.
+          fail_on_unmatched_files: true
+
+  linux:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Build renderer + main
+        run: npm run build
+
+      - name: Package Linux AppImage
+        run: npm run dist:linux
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: tokenwatch-linux-${{ github.sha }}
+          path: |
+            release/TokenWatch-*.AppImage
+            release/latest-linux.yml
+          if-no-files-found: error
+
+      - name: Attach to GitHub Release
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            release/TokenWatch-*.AppImage
+            release/latest-linux.yml
+          draft: false
+          prerelease: false
+          fail_on_unmatched_files: true

assets/icon.icns

@@ -72,7 +72,7 @@
   },
   "linux": {
     "target": "AppImage",
-    "icon": "assets/icon.icns",
+    "icon": "assets/icon.png",
     "category": "Development"
   }
 }

assets/icon.png

@@ -1,6 +1,6 @@
 {
   "name": "tokenwatch",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "TokenWatch — a warm, editorial tray app for real-time Claude Code usage tracking on Windows and macOS",
   "main": "dist/main.js",
   "scripts": {
@@ -12,6 +12,7 @@
     "dist": "npm run build && electron-builder",
     "dist:mac": "npm run build && electron-builder --mac --publish never",
     "dist:win": "npm run build && electron-builder --win --publish never",
+    "dist:linux": "npm run build && electron-builder --linux --publish never",
     "make-ico": "node scripts/make-ico.mjs",
     "make-icons": "node scripts/make-icons.mjs",
     "lint": "biome lint ./src",
@@ -50,6 +51,7 @@
     "husky": "^9.1.7",
     "patch-package": "^8.0.1",
     "png-to-ico": "^3.0.1",
+    "png2icons": "^2.0.1",
     "postcss-loader": "^8.2.0",
     "sharp": "^0.34.5",
     "style-loader": "^4.0.0",

electron-builder.json

@@ -1,6 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import png2icons from 'png2icons';
 import pngToIco from 'png-to-ico';
 import sharp from 'sharp';
 
@@ -12,6 +13,8 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const root = path.resolve(__dirname, '..');
 const iconset = path.join(root, 'assets', 'icon.iconset');
 const outIco = path.join(root, 'assets', 'icon.ico');
+const outIcns = path.join(root, 'assets', 'icon.icns');
+const outLinuxPng = path.join(root, 'assets', 'icon.png');
 const outTrayPng = path.join(root, 'assets', 'tray.png');
 const outTrayIco = path.join(root, 'assets', 'tray.ico');
 
@@ -135,6 +138,20 @@ async function main() {
   const trayPngBuf = await fs.readFile(path.join(iconset, 'icon_32x32.png'));
   await fs.writeFile(outTrayPng, trayPngBuf);
   console.log(`Wrote ${outTrayPng}`);
+
+  // macOS .icns — derived from the 1024×1024 master PNG. png2icons bakes
+  // in every size Finder / Dock needs. Pure JS, no native toolchain, so
+  // this runs the same on Windows / Linux CI as it would on macOS.
+  const masterPng = await fs.readFile(path.join(iconset, 'icon_1024x1024.png'));
+  const icnsBuf = png2icons.createICNS(masterPng, png2icons.BILINEAR, 0);
+  if (!icnsBuf) throw new Error('png2icons.createICNS returned null');
+  await fs.writeFile(outIcns, icnsBuf);
+  console.log(`Wrote ${outIcns} (${icnsBuf.length} bytes)`);
+
+  // Linux AppImage icon — electron-builder expands a single high-res PNG
+  // into the required freedesktop hicolor sizes at packaging time.
+  await fs.writeFile(outLinuxPng, masterPng);
+  console.log(`Wrote ${outLinuxPng} (${masterPng.length} bytes)`);
 }
 
 main().catch((err) => {