CI: build workflows run only from the release branch

Release, FreeBSD and Windows ARM64 builds no longer run on main, PRs or a
schedule; every build job checks for refs/heads/release so a manual run
from another branch is skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/freebsd.yml

@@ -1,5 +1,7 @@
 # Builds and tests the workspace on FreeBSD, inside a FreeBSD VM on a Linux runner
 # (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter.
+# Builds run only from the `release` branch: release.yml calls this workflow, and a manual run
+# from any other branch is skipped.
 #
 # With `package: true` (release.yml calls it that way, or a manual run) it instead builds the
 # release binaries and uploads `gridcraft-<version>-freebsd-x86_64.tar.gz` as the
@@ -8,15 +10,6 @@
 name: FreeBSD
 
 on:
-  push:
-    branches: [main]
-  pull_request:
-    paths:
-      - Cargo.toml
-      - Cargo.lock
-      - "**/Cargo.toml"
-      - packaging/freebsd/**
-      - .github/workflows/freebsd.yml
   workflow_dispatch:
     inputs:
       package:
@@ -48,6 +41,7 @@ permissions:
 jobs:
   freebsd:
     name: FreeBSD 14 (${{ inputs.package && 'package' || 'build + test' }})
+    if: github.ref == 'refs/heads/release'
     runs-on: ubuntu-latest
     timeout-minutes: 300
     env:

.github/workflows/release.yml

@@ -35,6 +35,8 @@ env:
 jobs:
   version:
     name: version
+    # Only the release branch builds; a manual run from any other branch skips every job.
+    if: github.ref == 'refs/heads/release'
     runs-on: ubuntu-latest
     environment: release
     outputs:

.github/workflows/windows-arm64.yml

@@ -4,19 +4,10 @@
 # out for now: PrintCraft saw an intermittent access violation in egui UI tests there.)
 name: Windows ARM64
 
+# Builds run only from the `release` branch (a manual run from another branch is skipped).
 on:
   push:
-    branches: [main]
-  pull_request:
-    paths:
-      - Cargo.toml
-      - Cargo.lock
-      - "**/Cargo.toml"
-      - "**/build.rs"
-      - .github/workflows/windows-arm64.yml
-      - packaging/windows/**
-  schedule:
-    - cron: "41 4 * * 1" # weekly, so drift in the runner images shows up
+    branches: [release]
   workflow_dispatch:
 
 concurrency:
@@ -33,6 +24,7 @@ env:
 jobs:
   package:
     name: package (cross-compiled on x64)
+    if: github.ref == 'refs/heads/release'
     runs-on: windows-latest
     timeout-minutes: 90
     steps:

docs/releasing.md

@@ -148,7 +148,7 @@ Locally (on Linux): install [nfpm](https://nfpm.goreleaser.com/install/), then
 ### FreeBSD
 
 GitHub has no FreeBSD runners. `.github/workflows/freebsd.yml` boots a FreeBSD 14.3 VM
-(`vmactions/freebsd-vm`). On `main` pushes and PRs it builds and tests the workspace; called
+(`vmactions/freebsd-vm`). Run by hand from `release`, it builds and tests the workspace; called
 from `release.yml` with `package: true` it runs `packaging/freebsd/package.sh`, which builds the
 release binaries and writes `gridcraft-<v>-freebsd-x86_64.tar.gz` (`bin/` + `share/`, extract
 under `/usr/local`). The target dir lives outside the synced checkout so only `dist/release`
@@ -184,8 +184,9 @@ shows a `::warning::`. Never store these as org- or repo-level Actions secrets (
 
 `GITHUB_TOKEN` creates the release; only the final job gets `contents: write`.
 
-The exact commands (from craftrules `release/signing-setup.md`, steps 1–3). **Run by an org
-admin; not done by the setup agent.**
+The exact commands (from craftrules `release/signing-setup.md`, steps 1–3), run by an org
+admin. Done for storytold/gridcraft on 2026-10-07; the `release-managers` team also has write
+access to the repo, which its ruleset bypass needs.
 
 ```sh
 REPO=storytold/gridcraft
@@ -244,7 +245,11 @@ row in `ATTRIBUTION.md` (`cargo xtask assets`).
 - `.github/workflows/packaging-lint.yml` (seconds, on changes to `packaging/`, the workflows or
   the icons): actionlint, shellcheck, a PowerShell parse, xmllint, a WiX icon-id check,
   `desktop-file-validate`, `appstreamcli validate`, and a Flatpak manifest check.
-- `.github/workflows/windows-arm64.yml`: packages ARM64 on x64, then installs, runs and
-  uninstalls the MSI on a Windows 11 ARM64 runner.
-- `.github/workflows/freebsd.yml`: FreeBSD build + tests on `main`.
+- `.github/workflows/windows-arm64.yml` (on `release` pushes): packages ARM64 on x64, then
+  installs, runs and uninstalls the MSI on a Windows 11 ARM64 runner.
+- `.github/workflows/freebsd.yml`: FreeBSD build + tests (manual run from `release`).
+
+**Only the `release` branch builds.** No build workflow runs on `main` or pull requests; every
+build job checks `github.ref == 'refs/heads/release'`, so a manual run from another branch is
+skipped. Only `packaging-lint.yml` (no build, no secrets) runs on `main` and PRs.
 - Locally: `cargo xtask ci` (fmt, clippy, tests, assets, layers, wasm, parity check).