Build Linux release artifacts in Gitea

.gitea/workflows/linux-release-build.yml

@@ -0,0 +1,85 @@
+name: Linux release build
+
+on:
+  push:
+    branches:
+      - develop
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: linux-release-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  linux-release:
+    name: Linux x64 artifact
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_NOLOGO: "true"
+      NUGET_XMLDOC_MODE: skip
+      PYTHONUTF8: "1"
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          architecture: x64
+
+      - name: Set up .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          global-json-file: global.json
+
+      - name: Restore immutable Linux inputs
+        uses: actions/cache@v4
+        with:
+          path: |
+            build/downloads/Godot_*_mono_linux_x86_64.zip
+            build/downloads/ffmpeg-*-linux64-lgpl-shared-*.tar.xz
+            build/toolchains/godot-*/xdg-data/godot/export_templates/*/linux_release.x86_64
+          key: linux-release-inputs-${{ hashFiles('tools/godot-linux-x64.json', 'native/age_movie_ffmpeg/dependency-linux-x64.json') }}
+
+      - name: Report toolchain
+        run: |
+          python --version
+          dotnet --version
+          cc --version
+          readelf --version
+
+      - name: Build and smoke-test Linux package
+        run: ./tools/build-linux-x64.sh
+
+      - name: Upload verified Linux package
+        uses: christopherhx/gitea-upload-artifact@v4
+        with:
+          name: OpenMaidEngine-Himegari-linux-x64-${{ gitea.sha }}
+          path: |
+            build/package/OpenMaidEngine-Himegari-linux-x64.tar.gz
+            build/package/staging/OpenMaidEngine-Himegari-linux-x64/BUILD-INFO.json
+            build/package/staging/OpenMaidEngine-Himegari-linux-x64/SHA256SUMS
+            build/package/package-smoke.log
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Upload failure logs
+        if: failure()
+        uses: christopherhx/gitea-upload-artifact@v4
+        with:
+          name: linux-release-failure-${{ gitea.run_id }}-${{ gitea.run_attempt }}
+          path: |
+            build/package/package-smoke.log
+            build/validation/**
+          if-no-files-found: ignore
+          retention-days: 7

docs/PROJECT-STRUCTURE.md

@@ -35,6 +35,8 @@ S:\Game Hacking\Eushully\Himegari\           ← workspace root (three siblings)
     ├── .editorconfig / .gitattributes        UTF-8, indentation, text/EOL, and binary-file policy;
     │                                         tracked source and generated references use canonical LF
     ├── .gitea/workflows/core-validation.yml  read-only Ubuntu source-only core gate for the private Gitea remote
+    ├── .gitea/workflows/linux-release-build.yml
+    │                                       pinned Linux export/package/smoke artifact job; no release publication
     ├── run-godot.ps1 / run-godot.cmd         tracked development launcher + Windows wrapper;
     │                                          resolves Godot/game-root from parameters, environment,
     │                                          PATH, and the conventional sibling install

docs/platform-portability.md

@@ -52,6 +52,15 @@ native loading without weakening the separate installed-game/font/render/audio a
 20.04 WSL proof passed using isolated Python 3.11/.NET 8.0.408 toolchains; the eventual Gitea job can provide those
 through its existing setup actions.
 
+The hosted artifact wrapper is now `.gitea/workflows/linux-release-build.yml`. It invokes that exact local
+command on `develop`, manual dispatch, and `v*` tags while the independent source-only core workflow remains the
+fast integration gate. The cache key is derived from both immutable dependency manifests and has no broad restore
+prefix; cached archives/templates are still size/hash checked by their owning bootstrap before use. A successful
+job retains the archive, external build/checksum manifests, and smoke log for 30 days. It has only read access to
+repository contents and does not use private data, secrets, registry credentials, or release-write permission.
+The first hosted execution remains the acceptance gate for runner image dependencies and cache/artifact action
+behavior; release publication is intentionally deferred until that artifact run succeeds.
+
 ## Dependency inventory
 
 | Area | Current dependency | Runtime impact | Portability status / future action |

docs/remake-architecture-and-roadmap.md

@@ -999,6 +999,16 @@ do not mix mechanical moves with semantic changes.
    calls this command on `develop`, manual dispatch, and release tags, caches immutable downloads/toolchains, and
    uploads the archive; release publication remains a later, tag-only promotion step after hosted artifact proof.
 
+   **Gitea Linux artifact workflow (2026-08-03):** the second CI/CD slice adds a separate read-only
+   `.gitea/workflows/linux-release-build.yml` job for `develop`, manual dispatch, and `v*` tags. It provisions
+   the pinned Python/.NET toolchain, restores only manifest-keyed Godot/FFmpeg archives plus the verified Linux
+   template, calls the same locally accepted build command, and uploads the archive with its external build info,
+   checksum ledger, and smoke log. Cache entries have no broad fallback and remain subject to the bootstrap's
+   size/SHA checks. The workflow has no game corpus, secrets, registry login, or release-write authority; tags
+   still produce ordinary retained workflow artifacts. The immediate gate is the first hosted build on this
+   server. If it passes, the next bounded slice can promote an already-verified tag artifact to a Gitea release
+   without rebuilding it; if it fails, fix only the observed runner/action dependency before adding publication.
+
 **Not cleanup targets:** generated `build/` output, the two intentional solution files, historical
 `docs/superpowers/` plans/specifications, and fidelity-specific complexity that is directly covered by the
 native ABI. Reorganization is successful when ownership and reproduction become clearer, not when the raw

docs/tools-reference.md

@@ -47,6 +47,16 @@ and the first actual Linux/Gitea core run succeeded on 2026-08-03 before the lat
 its tree-equivalent rewritten commit is `524ea74`. The hosted gate also succeeded on the sanitized lineage at
 `d673652` on 2026-08-03.
 
+The artifact wrapper is `.gitea/workflows/linux-release-build.yml`. It runs independently from the fast core
+gate on `develop` pushes, manual dispatch, and `v*` tag pushes. The job uses the same Python 3.11 and
+`global.json` .NET setup actions, then calls `./tools/build-linux-x64.sh` unchanged. `actions/cache@v4` retains
+only the two hash-verified dependency archives and the independently hash-verified Linux release template; its
+key is the combined Godot/FFmpeg manifest hash and deliberately has no prefix fallback. Successful runs upload
+the `.tar.gz`, unpacked `BUILD-INFO.json`/`SHA256SUMS`, and packaged-runtime smoke log for 30 days. Failed runs
+retain any smoke/validation evidence for seven days. The workflow has read-only repository permission, no
+secrets or private game corpus, and no release/package publication authority; a tag currently changes only the
+build trigger, not the artifact's destination.
+
 ## Optional local binary tools
 
 `bin/` is an ignored machine-local tool directory, not a source or artifact distribution directory. A local