chore(authenticator): add Flatpak desktop entry and AppStream metainfo

[the-narwhal]

What

Adds two files to applications/authenticator/ to support the Flatpak packaging of Proton Authenticator on Flathub:

• me.proton.Authenticator.desktop — XDG desktop entry (app launcher integration on Linux)
• me.proton.Authenticator.metainfo.xml — AppStream metadata (description, OARS content rating, branding colours, release history) used by the Flathub store listing and GNOME Software

Why here

The Flathub submission guidelines require that .desktop and .metainfo.xml files be maintained in the upstream source repository rather than in the Flathub manifest repo. The Flatpak build installs them with explicit install commands — no changes to the existing build system are needed.

What this doesn't do

• No changes to any existing file
• No effect on the npm/Yarn/Tauri build pipeline
• No new runtime dependencies

Related

• Flathub submission: Add me.proton.Authenticator flathub/flathub#8359
• Upstream notification issue: Proton Authenticator submitted to Flathub #482

[the-narwhal]

One more ask: upstream release of the frontend dist tarball

This PR handles the .desktop and metainfo.xml side of the Flathub submission cleanly. There's one remaining blocker that also needs upstream support: the pre-built frontend dist.

The problem

Proton Authenticator is a Tauri app. Flatpak builds run without network access, which means yarn/webpack can't run at build time. The Flatpak manifest therefore needs a pre-built copy of applications/authenticator/dist/ (the webpack output) supplied as a source archive. Flathub's rules require all source archives to be referenced by a stable, permanent URL — they cannot live in the Flathub submission repo itself.

Right now there is no stable upstream URL to reference. ProtonMail/WebClients has no GitHub Releases and no proton-authenticator@* tags (though the pattern exists for proton-vpn-settings, proton-wallet, proton-meet, etc.).

What would fix it

A lightweight GitHub Actions workflow, triggered when a proton-authenticator@* tag is pushed, that builds the frontend and uploads the dist as a release asset. This already follows the existing per-product tagging convention in the repo.

The build for the frontend dist is just:

yarn workspace proton-authenticator build:web

Output lands in applications/authenticator/dist/. The workflow would then package that directory and attach it to the release:

# .github/workflows/authenticator-dist-release.yml
name: Authenticator dist release

on:
  push:
    tags:
      - 'proton-authenticator@*'

jobs:
  build-dist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'yarn'

      - run: yarn install --frozen-lockfile

      - run: yarn workspace proton-authenticator build:web

      - name: Package dist
        run: |
          VERSION=${GITHUB_REF_NAME##*@}
          tar -czf authenticator-dist-${VERSION}.tar.gz \
            -C applications/authenticator dist/

      - uses: softprops/action-gh-release@v2
        with:
          files: authenticator-dist-*.tar.gz

Once that's in place, the Flathub manifest source entry becomes:

- type: archive
  url: https://github.com/ProtonMail/WebClients/releases/download/proton-authenticator%401.1.4/authenticator-dist-1.1.4.tar.gz
  sha256: <hash>
  strip-components: 0

No changes to the existing build system, CI pipelines, or release process for other products. It only fires on proton-authenticator@* tags.

Happy to open this as a separate PR if that's easier to route internally. Let me know if you'd prefer a different shape for the workflow (e.g. integrating into an existing CI file rather than a new one).

[D-Bao]

Hey, thank you for this PR! Instead of a GitHub Actions workflow, it would be more practical for us to set this up in our CI internally. We can make it build and publish the authenticator dist asset to GitHub releases automatically on new authenticator tag. I'll try to implement this and will get back to you when it's ready so you can test.

[the-narwhal]

Fantastic! Thank you!

[D-Bao]

Done! You can get the dist asset here https://github.com/ProtonMail/WebClients/releases/tag/proton-authenticator%401.1.5

[the-narwhal]

Awesome! I'll pick up progress on the flathub item again and see if I can get it squared away for submission approval

[the-narwhal]

Done! You can get the dist asset here https://github.com/ProtonMail/WebClients/releases/tag/proton-authenticator%401.1.5

I got it working locally using the dist asset and tags, thank you!

Flathub appears to be blocking the build from source submission stating that the .desktop and metadata.xml are required to be managed upstream. Is that something proton would be willing to incorporate into the main repo?

If so, I think it would be great to add for each proton desktop app too, since without it, I'll run into the same blocker for the other in progress app submissions (e.g. Meet).

@proletarius101 FYI above from the review feedback on the flathub Authenticator PR mentioned in this PR.