CI: workflows only call craft-common-actions at @main (#1557)

AGENTS.md (and CLAUDE.md where present) gets a CI workflows section: workflows only call
craft-common-actions at @main, with no other jobs; feature and fix PRs don't touch CI and
link or open a craft-common-actions issue (a PR only for a small fix that is safe for
every app and does not increase CI time); legacy jobs
aren't added to and move only as their own task, staying until a shared workflow runs them.

windows-arm64.yml moves from its SHA pin to @main. The pinned revision is on
craft-common-actions main and the workflow (and the actions it calls) is identical
there, so nothing changes in behaviour.

.github/workflows/windows-arm64.yml

@@ -24,8 +24,8 @@ permissions:
 
 jobs:
   windows-arm64:
-    # Immutable supporting workflow revision until the new install contract lands upstream.
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
-    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@8bb4e5ab95443171104ad88113fe1ef9b0e5ce3f
+    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@main
     with:
       app-name: deckcraft
       app-dir: DeckCraft

AGENTS.md

@@ -192,3 +192,8 @@ the `ROADMAP.md` progress log, and update each touched doc's status line and rev
   GitHub profiles). Never hand-edit `contributors.json`.
 - Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
   re-verifies who wrote each `people.toml` entry; `--check` only verifies).
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.

CLAUDE.md

@@ -19,3 +19,8 @@ before modules or other crate items; crate-level `//!` documentation may precede
 - Commit after each landed arc (`M<n>.<k>: what`) and push to `origin main`.
 - Keep `ROADMAP.md`, the progress docs in `docs/` (AGENTS.md §7) and `plan/STATUS.md` current.
 - Don't ask the user questions; record genuinely-theirs decisions in `plan/STATUS.md`.
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.

packaging/freebsd/package.sh

@@ -14,17 +14,47 @@ set -euo pipefail
 LINUX="$ROOT/packaging/linux"
 APP_ID=ai.storyteller.deckcraft
 
-if [[ "${1:-}" != "--skip-build" ]]; then
+TARGET_ARGS=()
-  (cd "$ROOT" && cargo build --release --locked -p deckcraft -p deckcraft-cli)
+BIN="$CARGO_TARGET_DIR/release"
+if [[ -n "${CARGO_BUILD_TARGET:-}" ]]; then
+  # host-tuple means the build host; resolve it so the target dir path is a real triple.
+  if [[ "$CARGO_BUILD_TARGET" == host-tuple ]]; then
+    CARGO_BUILD_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+  fi
+  # The target triple, not the build host's uname, names the arch of a cross build.
+  case "$CARGO_BUILD_TARGET" in
+    x86_64-unknown-freebsd) ARCH=x86_64 ;;
+    aarch64-unknown-freebsd) ARCH=aarch64 ;;
+    *) echo "error: unsupported CARGO_BUILD_TARGET '$CARGO_BUILD_TARGET' (expected x86_64-unknown-freebsd or aarch64-unknown-freebsd)" >&2; exit 1 ;;
+  esac
+  TARGET_ARGS=(--target "$CARGO_BUILD_TARGET")
+  BIN="$CARGO_TARGET_DIR/$CARGO_BUILD_TARGET/release"
+else
+  ARCH="$(uname -m)"
+  case "$ARCH" in
+    amd64) ARCH=x86_64 ;;
+    arm64) ARCH=aarch64 ;;
+    *) ;;
+  esac
 fi
 
-ARCH="$(uname -m)"
+if [[ "${1:-}" != "--skip-build" ]]; then
+  (cd "$ROOT" && cargo build --release --locked "${TARGET_ARGS[@]}" -p deckcraft -p deckcraft-cli)
+fi
+
+# Refuse placeholder, wrong-arch or non-FreeBSD binaries (also with --skip-build). Bytes: ELF magic,
+# 64-bit little-endian, OSABI SYSV or FreeBSD, e_machine.
 case "$ARCH" in
-  amd64) ARCH=x86_64 ;;
+  x86_64) MACHINE=" 3e 00" ;;
-  arm64) ARCH=aarch64 ;;
+  aarch64) MACHINE=" b7 00" ;;
-  *) ;;
+  *) echo "error: no ELF machine check for arch '$ARCH'" >&2; exit 1 ;;
 esac
-BIN="$CARGO_TARGET_DIR/release"
+for f in "$BIN/deckcraft" "$BIN/deckcraft-cli"; do
+  [[ "$(od -An -tx1 -N6 "$f" 2>/dev/null)" == " 7f 45 4c 46 02 01" ]] || { echo "error: $f is not a 64-bit little-endian ELF" >&2; exit 1; }
+  [[ "$(od -An -tx1 -j7 -N1 "$f")" =~ ^\ (00|09)$ ]] || { echo "error: $f is not a FreeBSD ELF (OSABI)" >&2; exit 1; }
+  [[ "$(od -An -tx1 -j18 -N2 "$f")" == "$MACHINE" ]] || { echo "error: $f is not an ELF for $ARCH" >&2; exit 1; }
+done
+
 NAME="deckcraft-$VERSION-freebsd-$ARCH"
 WORK="$CARGO_TARGET_DIR/freebsd-package"
 STAGE="$WORK/$NAME"
@@ -41,6 +71,6 @@ cp -R "$ROOT/assets/app-icon/hicolor" "$STAGE/share/icons/"
 copy_docs "$STAGE/share/doc/deckcraft"
 
 tar -C "$WORK" -czf "$DIST/$NAME.tar.gz" "$NAME"
-"$STAGE/bin/deckcraft-cli" --version
+if [[ -z "${CARGO_BUILD_TARGET:-}" || "$CARGO_BUILD_TARGET" == "$(rustc -vV | sed -n 's/^host: //p')" ]]; then "$STAGE/bin/deckcraft-cli" --version; fi # a cross-built binary cannot run on the build host
 echo "wrote $DIST/$NAME.tar.gz"
 ls -lh "$DIST/$NAME.tar.gz"

packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml

@@ -31,9 +31,9 @@ finish-args:
   # document portal, so picked files work anywhere without broad filesystem access. Documents is
   # granted so decks passed by path (the command line, Open Recent) work in the usual place.
   - --filesystem=xdg-documents
-  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
+  # Network: update checks reach GitHub. The optional --control server still listens on 127.0.0.1
-  # the sandbox; `flatpak override --user --share=network ai.storyteller.deckcraft` exposes it to
+  # only. Home/host filesystem access is deliberately not granted.
-  # host agents) and home/host filesystem access.
+  - --share=network
 modules:
   - name: deckcraft
     buildsystem: simple

packaging/linux/flatpak/ai.storyteller.deckcraft.yml

@@ -32,9 +32,9 @@ finish-args:
   # document portal, so picked files work anywhere without broad filesystem access. Documents is
   # granted so decks passed by path (the command line, Open Recent) work in the usual place.
   - --filesystem=xdg-documents
-  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
+  # Network: update checks reach GitHub. The optional --control server still listens on 127.0.0.1
-  # the sandbox; `flatpak override --user --share=network ai.storyteller.deckcraft` exposes it to
+  # only. Home/host filesystem access is deliberately not granted.
-  # host agents) and home/host filesystem access.
+  - --share=network
 build-options:
   append-path: /usr/lib/sdk/rust-stable/bin
 modules: