ci(release): universal mac build, linux deb deps, on-demand cache refresh

Three improvements that all kick in on the next release tag:

* electron mac target: arch=universal so one DMG runs on Apple
  Silicon AND Intel. ~2x file size, ~5 min slower job, kills the
  "M1-only build" footgun for the ~30% of Mac users still on Intel.

* Linux step apt-installs fakeroot + dpkg before electron-builder.
  Without fakeroot the .deb target silently no-ops, which is why
  v1.0.3 only shipped an AppImage despite the config asking for both.

* New revalidate-landing job: POSTs to the landing's
  /api/revalidate endpoint after a successful build so visitors
  don't wait out the 10-minute ISR window. Skips with a notice if
  LANDING_REVALIDATE_URL / LANDING_REVALIDATE_SECRET aren't set,
  so forks don't break.

Author: bitardev

.github/workflows/release.yml

@@ -65,6 +65,13 @@ jobs:
       - name: Install dependencies
         run: npm ci --no-audit --no-fund
 
+      - name: Install Linux packaging deps
+        # electron-builder shells out to `fakeroot` + `dpkg-deb` for the
+        # .deb target. fakeroot isn't on ubuntu-latest by default, so the
+        # deb step silently no-ops without it (AppImage still builds).
+        if: matrix.os == 'ubuntu-latest'
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends fakeroot dpkg
+
       - name: Build all workspaces
         run: npm run build
 
@@ -91,3 +98,29 @@ jobs:
             electron/dist-build/*.blockmap
           retention-days: 7
           if-no-files-found: warn
+
+  revalidate-landing:
+    # Tells the landing site (miqaaat.com / miqaat.develop-better-solutions.com)
+    # to drop its ISR cache and refetch the GitHub Releases API right
+    # now — without this, visitors wait up to 10 minutes after a release
+    # for the new download URLs to appear. Skipped if the secrets aren't
+    # set, so a fresh fork doesn't fail this step.
+    name: Refresh landing cache
+    runs-on: ubuntu-latest
+    needs: build
+    if: success()
+    steps:
+      - name: POST to landing /api/revalidate
+        env:
+          URL: ${{ secrets.LANDING_REVALIDATE_URL }}
+          SECRET: ${{ secrets.LANDING_REVALIDATE_SECRET }}
+        run: |
+          if [ -z "$URL" ] || [ -z "$SECRET" ]; then
+            echo "::notice::LANDING_REVALIDATE_URL or LANDING_REVALIDATE_SECRET not set — skipping cache refresh"
+            exit 0
+          fi
+          # Failure is non-fatal — the release is already published; the
+          # landing will catch up on its own within the ISR window.
+          curl -fsSL --max-time 15 -X POST "$URL?secret=$SECRET" \
+            && echo "Landing cache refreshed" \
+            || echo "::warning::Landing revalidation failed (non-fatal)"

electron/package.json

@@ -74,8 +74,8 @@
     },
     "mac": {
       "target": [
-        "dmg",
-        "zip"
+        { "target": "dmg", "arch": "universal" },
+        { "target": "zip", "arch": "universal" }
       ],
       "icon": "resources/icon.png",
       "identity": null,