Statically linking the binaries

.gitea/workflows/build.yml

@@ -0,0 +1,64 @@
+name: build
+
+# Build a versioned Linux CLI release tarball (see `make package`) on
+# every push/PR, plus on-demand via the Gitea "Run workflow" button.
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    # Runner defaults `run:` steps to `sh`, which doesn't understand
+    # `set -o pipefail` used below — force bash explicitly.
+    defaults:
+      run:
+        shell: bash
+    # Must match a label your act_runner is registered with.
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # `make package`'s version comes from `git describe --tags` (see
+          # the Makefile's `package` target) - needs full history/tags,
+          # not actions/checkout's default shallow single-commit clone.
+          fetch-depth: 0
+
+      - name: Preflight
+        run: |
+          set -euo pipefail
+          command -v cc >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: no C compiler (cc) in PATH" >&2; exit 1; }
+          command -v make >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: make not in PATH" >&2; exit 1; }
+
+      - name: Build and test
+        run: |
+          set -euo pipefail
+          make test
+          make package
+
+      - name: Upload build artifact
+        # v4 uses the newer @actions/artifact backend, which this Gitea
+        # instance's artifact storage doesn't support (GHESNotSupportedError) — v3 works.
+        uses: actions/upload-artifact@v3
+        with:
+          name: deck-in-a-dash
+          path: dist/deck-in-a-dash-*-linux-*.tar.gz
+
+      - name: Publish to dl.ladkau.de
+        # Uploads the tarball over SFTP instead of using
+        # actions/upload-artifact (whose zip wrapping can't be disabled).
+        # Only runs on push so PR builds don't publish.
+        if: gitea.event_name == 'push'
+        run: |
+          set -euo pipefail
+          FILE="$(ls dist/deck-in-a-dash-*-linux-*.tar.gz)"
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DL_SFTP_KEY }}" > ~/.ssh/dl_sftp_key
+          chmod 600 ~/.ssh/dl_sftp_key
+          sftp -i ~/.ssh/dl_sftp_key -P 2223 \
+            -o StrictHostKeyChecking=accept-new \
+            uploader@dl.ladkau.de <<EOF
+          -mkdir files/deck-in-a-dash
+          put $FILE files/deck-in-a-dash/$(basename "$FILE")
+          EOF

CLAUDE.md

@@ -94,6 +94,13 @@ end up in a distributable package. The package always gets the
 placeholder template instead, identical to what a first-time `make`
 seeds `dist/user.properties` with.
 
+**CI** (`.gitea/workflows/build.yml`): runs `make test && make package`
+on every push/PR (plus manual dispatch). The resulting tarball is both
+kept as a Gitea Actions run artifact and, on `push` only (not PRs),
+published over SFTP to `dl.ladkau.de` under `files/deck-in-a-dash/` -
+requires a `DL_SFTP_KEY` secret configured on this repo (or inherited
+from the org/instance level).
+
 ## Architecture
 
 ```

Makefile

@@ -1,5 +1,12 @@
 CC      ?= cc
 CFLAGS  ?= -std=c99 -Wall -Wextra -O2
+# Static by default so dist/deck-engine and dist/interpreter-cli (and the
+# `package` tarball built from them) don't depend on the build machine's
+# glibc version at runtime - a binary linked against a newer glibc than a
+# user's system has refuses to run at all ("GLIBC_2.3x not found"), which
+# is exactly the kind of thing a downloaded release package must not hit.
+# Override with `LDFLAGS= make` if static libc/libm aren't available.
+LDFLAGS ?= -static
 LDLIBS  := -lm
 
 BUILD_DIR     := build
@@ -86,11 +93,11 @@ all: $(ENGINE_BINARY) $(INTERP_BINARY) images i18n scripts
 
 $(ENGINE_BINARY): $(ENGINE_OBJS) $(ENGINE_MAIN_OBJ)
 	@mkdir -p $(DIST_DIR)
-	$(CC) $(CFLAGS) -o $@ $^ $(LDLIBS)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^ $(LDLIBS)
 
 $(INTERP_BINARY): $(INTERP_LIB_OBJS) $(INTERP_MAIN_OBJ) $(INTERP_TAROT_TEXT_OBJS)
 	@mkdir -p $(DIST_DIR)
-	$(CC) $(CFLAGS) -o $@ $^
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^
 
 # The HTML report expects card art at img/<file> next to deck-engine, so
 # every build refreshes a copy alongside it (cheap: 22 small JPEGs).
@@ -137,20 +144,20 @@ test: $(ENGINE_TEST_BINARY) $(SIGNIFICANCE_TEST_BIN) $(JSON_TEST_BIN) $(NARRATIV
 	./$(GUIDANCE_TEST_BIN)
 
 $(ENGINE_TEST_BINARY): $(ENGINE_OBJS) $(ENGINE_TEST_OBJ)
-	$(CC) $(CFLAGS) -o $@ $^ $(LDLIBS)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^ $(LDLIBS)
 
 $(SIGNIFICANCE_TEST_BIN): $(OBJ_DIR)/$(INTERP_SRC_DIR)/significance.o $(SIGNIFICANCE_TEST_OBJ)
-	$(CC) $(CFLAGS) -o $@ $^
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^
 
 $(JSON_TEST_BIN): $(OBJ_DIR)/$(INTERP_SRC_DIR)/json.o $(OBJ_DIR)/$(INTERP_SRC_DIR)/reading_io.o $(JSON_TEST_OBJ)
-	$(CC) $(CFLAGS) -o $@ $^
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^
 
 $(NARRATIVE_TEST_BIN): $(OBJ_DIR)/$(INTERP_SRC_DIR)/narrative.o $(INTERP_TAROT_TEXT_OBJS) $(NARRATIVE_TEST_OBJ)
-	$(CC) $(CFLAGS) -o $@ $^
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^
 
 $(GUIDANCE_TEST_BIN): $(OBJ_DIR)/$(INTERP_SRC_DIR)/guidance.o $(OBJ_DIR)/$(INTERP_SRC_DIR)/significance.o \
                       $(INTERP_TAROT_TEXT_OBJS) $(GUIDANCE_TEST_OBJ)
-	$(CC) $(CFLAGS) -o $@ $^
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^
 
 $(OBJ_DIR)/%.o: %.c
 	@mkdir -p $(dir $@)