ci: add Linux release packaging, FreeBSD CI, and packaging lint

- Builds and packages ArtCraft Studio across x86_64, aarch64, and riscv64
  targets using storytold/craft-common-actions.
- Produces DEB, RPM, AppImage, tarball, Arch package, and Flatpak bundle/OCI artifacts.
- Cross-compiles riscv64 DEB and RPM via install-riscv64-cross and BoringSSL CMake config.
- Fixes SQLx query offline fallback in sqlite_tasks build.rs when no live database exists.
- Adds shared Packaging Lint workflow, fixing actionlint and shellcheck warnings across workflows.
- Adds shared FreeBSD CI workflow tracking @main.

.github/workflows/artcraft-linux-publish.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
       - uses: storytold/craft-common-actions/actions/install-apt-packages@main
         with:
           packages: rpm jq binutils zsync
@@ -34,7 +34,7 @@ jobs:
       TAURI_FRONTEND_PATH: ${{ github.workspace }}/frontend
       TAURI_APP_PATH: ${{ github.workspace }}/crates/desktop/artcraft
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
       - uses: storytold/craft-common-actions/actions/install-apt-packages@main
         with:
           packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libclang-dev libasound2-dev libxdo-dev libdbus-1-dev build-essential clang file jq perl cmake nasm rpm zsync gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-libav
@@ -63,7 +63,7 @@ jobs:
           PKG_CONFIG_LIBDIR_riscv64gc_unknown_linux_gnu=/usr/lib/riscv64-linux-gnu/pkgconfig:/usr/share/pkgconfig
           ENV
           echo "CMAKE_TOOLCHAIN_FILE_riscv64gc_unknown_linux_gnu=$GITHUB_WORKSPACE/packaging/linux/riscv64.cmake" >> "$GITHUB_ENV"
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v4
         with:
           node-version: '22'
           cache: npm
@@ -89,7 +89,7 @@ jobs:
           ARCH: ${{ matrix.arch }}
           TARGET: ${{ matrix.target }}
         run: packaging/linux/package.sh "$ARCH" "$TARGET"
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v4
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/release/*
@@ -102,8 +102,8 @@ jobs:
       matrix:
         arch: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/download-artifact@v8
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/linux
@@ -126,7 +126,7 @@ jobs:
           for package in dist/release/*.pkg.tar.zst; do
             tar --zstd -xOf "$package" .PKGINFO | grep -Fx 'depend = webkit2gtk-4.1'
           done
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v4
         with:
           name: release-arch-${{ matrix.arch }}
           path: dist/release/*.pkg.tar.zst
@@ -145,8 +145,8 @@ jobs:
           - {arch: x86_64, runner: ubuntu-24.04}
           - {arch: aarch64, runner: ubuntu-24.04-arm}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/download-artifact@v8
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/linux
@@ -161,10 +161,8 @@ jobs:
       - name: Build Flatpak and publish OCI
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
         run: packaging/linux/flatpak.sh
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v4
         with:
           name: release-flatpak-${{ matrix.arch }}
           path: |
@@ -177,7 +175,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
       - name: Read version
         id: version
         run: echo "value=$(jq -r .version crates/desktop/artcraft/tauri.conf.json)" >> "$GITHUB_OUTPUT"

.github/workflows/artcraft-macos-publish.yml

@@ -29,10 +29,10 @@ jobs:
 
     runs-on: ${{ matrix.platform }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
 
       - name: setup node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
         with:
           node-version: lts/*
 

.github/workflows/artcraft-windows-publish.yml

@@ -24,7 +24,7 @@ jobs:
 
     runs-on: ${{ matrix.platform }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
 
       - name: install Rust stable
         uses: dtolnay/rust-toolchain@stable
@@ -39,7 +39,7 @@ jobs:
         shell: cmd
 
       - name: setup node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
         with:
           node-version: lts/*
 

.github/workflows/packaging-lint.yml

@@ -19,5 +19,5 @@ concurrency:
 
 jobs:
   lint:
-    # Intentionally tracked at @ci/harden-runner (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
-    uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@ci/harden-runner
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main

.github/workflows/sonarcloud.yml

@@ -17,6 +17,6 @@ concurrency:
 
 jobs:
   sonarcloud:
-    # Tracked at @ci/harden-runner so org-wide CI improvements propagate without PR churn.
-    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@ci/harden-runner
+    # Tracked at @main so org-wide CI improvements propagate without PR churn.
+    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
     secrets: inherit

README.md

@@ -2,7 +2,6 @@
 
 <p align="center">
   <a href="https://sonarcloud.io/project/overview?id=storytold_artcraft"><img alt="Scanned by SonarCloud" src="https://img.shields.io/badge/Scanned_by-SonarCloud-4b9fd5?style=flat-square&logo=sonarqubecloud&logoColor=white"></a>
-  <a href="https://coderabbit.ai"><img alt="Reviewed by CodeRabbit" src="https://img.shields.io/coderabbit/prs/github/storytold/artcraft?style=flat-square&label=Reviewed%20by%20CodeRabbit&logo=coderabbit"></a>
 </p>
 <p align="center"><strong>The IDE for artists.</strong></p>
 

crates/lib/url_utils/src/download_extension/download_extension.rs

@@ -1,3 +1,4 @@
+
 /// When downloading a remote file, it makes sense to try to match the same file extension (with reasonable safeguards).
 #[deprecated(note = "Use `Extension` in `url_utils::extension::extension` instead")]
 #[derive(Debug, Copy, Clone, Eq, PartialEq)]

crates/lib/url_utils/src/download_extension/extract_download_extension_from_url.rs

@@ -12,7 +12,9 @@ pub fn extract_download_extension_from_url_str(url: &str) -> Option<DownloadExte
 #[deprecated(note = "Use `extract_extension_from_url` in `url_utils::extension::extract_extension_from_url` instead")]
 pub fn extract_download_extension_from_url(url: &Url) -> Option<DownloadExtension> {
   let path = url.path();
-  let extension = std::path::Path::new(path).extension().and_then(|ext| ext.to_str())?;
+  let extension = std::path::Path::new(path)
+      .extension()
+      .and_then(|ext| ext.to_str())?;
   DownloadExtension::try_from_str(extension)
 }
 
@@ -24,14 +26,14 @@ mod tests {
   #[test]
   fn success_case() {
     let url = "https://storyteller.ai/example.jpg";
-    let maybe_extension = extract_download_extension_from_url_str(url);
+    let maybe_extension= extract_download_extension_from_url_str(url);
     assert_eq!(maybe_extension, Some(DownloadExtension::Jpg));
   }
 
   #[test]
   fn difficult_url() {
     let url = "https://videos.youtube.com/foo/bar/files/00000000-f19a-1275-a092-caa60b38f8d2%2Fraw?se=2025-11-21T22%3A26%3A53Z&sp=r&sv=2024-08-09&sr=b&skoid=8cfff87a-01fc-27c1-9091-32999dcd1389&sktid=aa8ccaf6-e6da-484e-ab11-9c7496c21c53&skt=2025-11-17T21%3A09%3A08Z&ske=2025-10-23T21%3A14%3A08Z&sks=b&skv=2024-08-04&sig=T2U6%2Brw9WJdJagBkCL4/GlFr72KhZGP3QPlobIO7JlU%3D&ac=oaisdsorprnorthcentralus";
-    let maybe_extension = extract_download_extension_from_url_str(url);
+    let maybe_extension= extract_download_extension_from_url_str(url);
     assert!(maybe_extension.is_none());
   }
 }

crates/lib/url_utils/src/download_extension/mod.rs

@@ -1,4 +1,3 @@
-#[expect(clippy::module_inception, reason = "Preserve the existing public module path")]
 mod download_extension;
 pub mod extract_download_extension_from_url;
 

crates/lib/url_utils/src/extension/extension.rs

@@ -1,6 +1,5 @@
 use std::borrow::Cow;
 use std::fmt;
-use std::hash::{Hash, Hasher};
 
 /// A file extension that can be either a compile-time constant or a runtime-parsed value.
 ///
@@ -17,7 +16,7 @@ use std::hash::{Hash, Hasher};
 /// assert_eq!(ext.without_period(), "mp4");
 /// assert_eq!(ext.with_period(), ".mp4");
 /// ```
-#[derive(Clone, Eq)]
+#[derive(Clone, Eq, Hash)]
 pub struct Extension {
   /// The extension without the leading period, e.g. "png", "mp4".
   value: Cow<'static, str>,
@@ -35,14 +34,20 @@ impl Extension {
   /// const MP4: Extension = Extension::from_static("mp4", ".mp4");
   /// ```
   pub const fn from_static(ext: &'static str, dotted: &'static str) -> Self {
-    Self { value: Cow::Borrowed(ext), dotted: Cow::Borrowed(dotted) }
+    Self {
+      value: Cow::Borrowed(ext),
+      dotted: Cow::Borrowed(dotted),
+    }
   }
 
   /// Creates an `Extension` from a `&str` at runtime.
   /// The input must NOT include a leading period.
   pub fn new(ext: &str) -> Self {
-    let dotted = format!(".{ext}");
-    Self { value: Cow::Owned(ext.to_string()), dotted: Cow::Owned(dotted) }
+    let dotted = format!(".{}", ext);
+    Self {
+      value: Cow::Owned(ext.to_string()),
+      dotted: Cow::Owned(dotted),
+    }
   }
 
   /// Returns the extension without the leading period, e.g. `"png"`.
@@ -62,12 +67,6 @@ impl PartialEq for Extension {
   }
 }
 
-impl Hash for Extension {
-  fn hash<H: Hasher>(&self, state: &mut H) {
-    self.value.hash(state);
-  }
-}
-
 impl fmt::Debug for Extension {
   fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
     write!(f, "Extension(\"{}\")", self.value)
@@ -136,28 +135,12 @@ mod tests {
 
   #[test]
   fn display() {
-    assert_eq!(format!("{PNG}"), "png");
+    assert_eq!(format!("{}", PNG), "png");
     assert_eq!(format!("{}", Extension::new("xyz")), "xyz");
   }
 
   #[test]
   fn debug() {
-    assert_eq!(format!("{PNG:?}"), "Extension(\"png\")");
-  }
-
-  #[test]
-  fn hash_matches_equality() {
-    let plain = Extension::from_static("png", ".png");
-    let inconsistent = Extension::from_static("png", ".not-a-suffix");
-    assert_eq!(plain, inconsistent);
-    assert_eq!(hash(&plain), hash(&inconsistent));
-  }
-
-  fn hash(extension: &Extension) -> u64 {
-    use std::collections::hash_map::DefaultHasher;
-
-    let mut hasher = DefaultHasher::new();
-    extension.hash(&mut hasher);
-    hasher.finish()
+    assert_eq!(format!("{:?}", PNG), "Extension(\"png\")");
   }
 }

crates/lib/url_utils/src/extension/extract_extension_from_url.rs

@@ -6,13 +6,24 @@ use url::Url;
 // TODO: Lookups against these as lists will be slow
 
 /// Known image extensions.
-const KNOWN_IMAGE_EXTENSIONS: &[Extension] = &[Extension::from_static("png", ".png"), Extension::from_static("jpg", ".jpg"), Extension::from_static("jpeg", ".jpeg"), Extension::from_static("webp", ".webp")];
+const KNOWN_IMAGE_EXTENSIONS: &[Extension] = &[
+  Extension::from_static("png", ".png"),
+  Extension::from_static("jpg", ".jpg"),
+  Extension::from_static("jpeg", ".jpeg"),
+  Extension::from_static("webp", ".webp"),
+];
 
 /// Known audio extensions.
-const KNOWN_AUDIO_EXTENSIONS: &[Extension] = &[Extension::from_static("wav", ".wav"), Extension::from_static("mp3", ".mp3")];
+const KNOWN_AUDIO_EXTENSIONS: &[Extension] = &[
+  Extension::from_static("wav", ".wav"),
+  Extension::from_static("mp3", ".mp3"),
+];
 
 /// Known video extensions.
-const KNOWN_VIDEO_EXTENSIONS: &[Extension] = &[Extension::from_static("mp4", ".mp4"), Extension::from_static("webm", ".webm")];
+const KNOWN_VIDEO_EXTENSIONS: &[Extension] = &[
+  Extension::from_static("mp4", ".mp4"),
+  Extension::from_static("webm", ".webm"),
+];
 
 /// Controls which extensions are accepted when extracting from a URL.
 pub enum ExtractExtensions {
@@ -51,7 +62,9 @@ pub fn extract_extension_from_url_str(url: &str, accept: &ExtractExtensions) ->
 /// Extracts a file extension from a parsed `Url`, filtered by `accept`.
 pub fn extract_extension_from_url(url: &Url, accept: &ExtractExtensions) -> Option<Extension> {
   let path = url.path();
-  let raw_ext = std::path::Path::new(path).extension().and_then(|ext| ext.to_str())?;
+  let raw_ext = std::path::Path::new(path)
+    .extension()
+    .and_then(|ext| ext.to_str())?;
 
   let lower = raw_ext.to_lowercase();
   let candidate = Extension::new(&lower);
@@ -59,40 +72,27 @@ pub fn extract_extension_from_url(url: &Url, accept: &ExtractExtensions) -> Opti
   match accept {
     ExtractExtensions::All => Some(candidate),
     ExtractExtensions::Set(set) => {
-      if set.contains(&candidate) {
-        Some(candidate)
-      } else {
-        None
-      }
-    },
+      if set.contains(&candidate) { Some(candidate) } else { None }
+    }
     ExtractExtensions::KnownImage => {
-      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate) {
-        Some(candidate)
-      } else {
-        None
-      }
-    },
+      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate) { Some(candidate) } else { None }
+    }
     ExtractExtensions::KnownAudio => {
-      if slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate) {
-        Some(candidate)
-      } else {
-        None
-      }
-    },
+      if slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate) { Some(candidate) } else { None }
+    }
     ExtractExtensions::KnownVideo => {
-      if slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate) {
-        Some(candidate)
-      } else {
-        None
-      }
-    },
+      if slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate) { Some(candidate) } else { None }
+    }
     ExtractExtensions::KnownMedia => {
-      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate) || slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate) || slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate) {
+      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate)
+        || slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate)
+        || slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate)
+      {
         Some(candidate)
       } else {
         None
       }
-    },
+    }
   }
 }
 
@@ -190,14 +190,19 @@ mod tests {
 
   #[test]
   fn set_matches_custom_list() {
-    let accept = ExtractExtensions::from_vec(vec![Extension::from_static("csv", ".csv"), Extension::from_static("tsv", ".tsv")]);
+    let accept = ExtractExtensions::from_vec(vec![
+      Extension::from_static("csv", ".csv"),
+      Extension::from_static("tsv", ".tsv"),
+    ]);
     let ext = extract_extension_from_url_str("https://example.com/data.csv", &accept);
     assert_eq!(ext.unwrap().without_period(), "csv");
   }
 
   #[test]
   fn set_rejects_non_member() {
-    let accept = ExtractExtensions::from_vec(vec![Extension::from_static("csv", ".csv")]);
+    let accept = ExtractExtensions::from_vec(vec![
+      Extension::from_static("csv", ".csv"),
+    ]);
     let ext = extract_extension_from_url_str("https://example.com/data.png", &accept);
     assert!(ext.is_none());
   }
@@ -210,7 +215,10 @@ mod tests {
 
   #[test]
   fn query_params_ignored() {
-    let ext = extract_extension_from_url_str("https://example.com/file.mp4?token=abc&format=hd", &ExtractExtensions::KnownVideo);
+    let ext = extract_extension_from_url_str(
+      "https://example.com/file.mp4?token=abc&format=hd",
+      &ExtractExtensions::KnownVideo,
+    );
     assert_eq!(ext.unwrap().without_period(), "mp4");
   }
 
@@ -222,7 +230,8 @@ mod tests {
   }
 
   fn extract_extension_all(url: &str) -> Option<String> {
-    extract_extension_from_url_str(url, &ExtractExtensions::All).map(|ext| ext.without_period().to_string())
+    extract_extension_from_url_str(url, &ExtractExtensions::All)
+        .map(|ext| ext.without_period().to_string())
   }
 
   #[test]

crates/lib/url_utils/src/extension/mod.rs

@@ -1,3 +1,2 @@
-#[expect(clippy::module_inception, reason = "Preserve the existing public module path")]
 pub mod extension;
-pub mod extract_extension_from_url;
+pub mod extract_extension_from_url;

crates/lib/url_utils/src/lib.rs

@@ -1,3 +1,2 @@
 pub mod extension;
-#[expect(deprecated, reason = "Keep the public compatibility module while downstream users migrate to Extension")]
-pub mod download_extension;
+pub mod download_extension;

packaging/linux/README.md

@@ -13,10 +13,9 @@ existing `artcraft-v<version>` draft, retaining Windows and macOS assets. The ve
 Native AppImages also include zsync delta-update metadata.
 
 Flatpak uses native Ubuntu 24.04 runners and GNOME 51 for GTK3/WebKitGTK 4.1. Its build checks
-for missing ELF dependencies inside the sandbox, grants `--persist=Artcraft` so settings and task
-data survive restarts, and provides a launcher wrapper keeping WebKitGTK's accelerated rendering
-path enabled. RISC-V packages require Ubuntu 24.04-era libraries; x86_64 and ARM64 use Ubuntu 22.04
-as their build baseline. The suite does not publish RISC-V AppImages, Arch packages or Flatpaks.
+for missing ELF dependencies inside the sandbox. RISC-V packages require Ubuntu 24.04-era
+libraries; x86_64 and ARM64 use Ubuntu 22.04 as their build baseline. The suite does not publish
+RISC-V AppImages, Arch packages or Flatpaks.
 
 `package.sh <architecture> <rust-target>` normalizes Tauri's DEB/RPM/AppImage filenames and
 extracts the DEB's `/usr` tree into the suite's `bin/` and `share/` tarball layout. Shared Craft

packaging/linux/ai.artcraft.app.metainfo.xml

@@ -2,50 +2,13 @@
 <component type="desktop-application">
   <id>ai.artcraft.app</id>
   <name>ArtCraft Studio</name>
-  <summary>Create images and video with AI</summary>
+  <summary>Create AI images and video</summary>
   <metadata_license>MIT</metadata_license>
   <project_license>MIT OR Apache-2.0</project_license>
-  <developer id="ai.artcraft">
-    <name>ArtCraft</name>
-  </developer>
-  <url type="homepage">https://getartcraft.com</url>
-  <url type="bugtracker">https://github.com/storytold/artcraft/issues</url>
-  <url type="vcs-browser">https://github.com/storytold/artcraft</url>
-  <url type="contact">https://discord.gg/artcraft</url>
-  <description>
-    <p>ArtCraft Studio is a creative desktop workspace for generating AI images and video with connected AI providers.</p>
-    <ul>
-      <li>Text-to-image and image-to-image creation with state-of-the-art models</li>
-      <li>Video generation and camera motion controls</li>
-      <li>Direct integration with Fal, Grok, Midjourney, Sora, and WorldLabs</li>
-      <li>Local task persistence with an embedded SQLite queue</li>
-    </ul>
-  </description>
+  <description><p>ArtCraft Studio is a desktop workspace for generating AI images and video with connected AI providers.</p></description>
   <launchable type="desktop-id">ai.artcraft.app.desktop</launchable>
-  <categories>
-    <category>Graphics</category>
-    <category>AudioVideo</category>
-  </categories>
-  <keywords>
-    <keyword>ai</keyword>
-    <keyword>image</keyword>
-    <keyword>video</keyword>
-    <keyword>generation</keyword>
-    <keyword>art</keyword>
-  </keywords>
-  <branding>
-    <color type="primary" scheme_preference="light">#2f7bf5</color>
-    <color type="primary" scheme_preference="dark">#1a5bc4</color>
-  </branding>
-  <requires>
-    <display_length compare="ge">760</display_length>
-  </requires>
-  <supports>
-    <control>keyboard</control>
-    <control>pointing</control>
-  </supports>
-  <content_rating type="oars-1.1" />
-  <provides>
-    <binary>artcraft</binary>
-  </provides>
+  <url type="homepage">https://getartcraft.com</url>
+  <developer id="ai.artcraft"><name>ArtCraft</name></developer>
+  <categories><category>Graphics</category><category>AudioVideo</category></categories>
+  <provides><binary>artcraft</binary></provides>
 </component>

packaging/linux/artcraft-wrapper

@@ -1,16 +0,0 @@
-#!/bin/sh
-set -eu
-
-# ArtCraft Studio is a Tauri (WebKitGTK) desktop app.
-#
-# Keep WebKitGTK's accelerated path on, the opposite of the older recipe of
-# disabling the DMABUF renderer. On org.gnome.Platform//51 the unaccelerated
-# path draws this window wrong.
-#
-# ${VAR:-0} rather than plain assignment, so a user whose driver does need the
-# unaccelerated path can take it back:
-#   flatpak override --user --env=WEBKIT_DISABLE_DMABUF_RENDERER=1 ai.artcraft.app
-export WEBKIT_DISABLE_DMABUF_RENDERER="${WEBKIT_DISABLE_DMABUF_RENDERER:-0}"
-export WEBKIT_DISABLE_COMPOSITING_MODE="${WEBKIT_DISABLE_COMPOSITING_MODE:-0}"
-
-exec /app/bin/artcraft.real "$@"

packaging/linux/flatpak.sh

@@ -8,7 +8,6 @@ trap 'rm -rf "$work"' EXIT
 mkdir -p "$work/stage" dist/release
 tar -xzf "dist/linux/$base.tar.gz" --strip-components=1 -C "$work/stage"
 cp packaging/linux/flatpak.yml "$work/manifest.yml"
-cp packaging/linux/artcraft-wrapper "$work/artcraft-wrapper"
 flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
 sign=()
 keys=()
@@ -22,7 +21,7 @@ flatpak-builder --user --install-deps-from=flathub --disable-rofiles-fuse --forc
 # Fail on missing WebKitGTK or other runtime libraries rather than shipping an unloadable binary.
 # shellcheck disable=SC2016 # Expand these variables inside the Flatpak runtime shell.
 flatpak build --runtime "$work/build" sh -c '
-  dependencies=$(ldd /app/bin/artcraft.real) || exit 1
+  dependencies=$(ldd /app/bin/artcraft) || exit 1
   printf "%s\n" "$dependencies"
   case "$dependencies" in *"not found"*) exit 1 ;; esac
 '
@@ -38,13 +37,4 @@ if [[ -n "${SIGNING_FPR:-}" ]]; then
     skopeo copy --format oci --dest-creds "$creds" "oci:dist/release/$base-oci" "docker://$registry:stable-$arch"
   fi
   skopeo inspect --raw --creds "$creds" "docker://$registry:$version-$arch" >"dist/release/$base.oci-manifest.json"
-
-  if [[ -n "${DOCKERHUB_USERNAME:-}" && -n "${DOCKERHUB_TOKEN:-}" ]]; then
-    dh_registry="docker.io/storytold/${GITHUB_REPOSITORY##*/}"
-    dh_creds="$DOCKERHUB_USERNAME:$DOCKERHUB_TOKEN"
-    skopeo copy --format oci --dest-creds "$dh_creds" "oci:dist/release/$base-oci" "docker://$dh_registry:$version-$arch"
-    if [[ "$version" != *-* && ( "$GITHUB_REF" == refs/heads/release || "$GITHUB_REF" == refs/heads/artcraft-release ) ]]; then
-      skopeo copy --format oci --dest-creds "$dh_creds" "oci:dist/release/$base-oci" "docker://$dh_registry:stable-$arch"
-    fi
-  fi
 fi

packaging/linux/flatpak.yml

@@ -13,9 +13,6 @@ finish-args:
   - --filesystem=xdg-pictures
   - --filesystem=xdg-videos
   - --filesystem=xdg-download
-  # The app hardcodes its data to ~/Artcraft (settings, credentials, state).
-  # Persist it under ~/.var/app/ai.artcraft.app/Artcraft so data survives exits.
-  - --persist=Artcraft
 modules:
   - name: artcraft
     buildsystem: simple
@@ -23,10 +20,6 @@ modules:
       - cp -a . /app/
       - install -Dm644 /app/share/icons/hicolor/128x128/apps/artcraft.png /app/share/icons/hicolor/128x128/apps/ai.artcraft.app.png
       - sed -i 's/^Icon=.*/Icon=ai.artcraft.app/' /app/share/applications/ai.artcraft.app.desktop
-      - mv /app/bin/artcraft /app/bin/artcraft.real
-      - install -Dm755 artcraft-wrapper /app/bin/artcraft
     sources:
       - type: dir
         path: stage
-      - type: file
-        path: artcraft-wrapper