Merge latest origin/main and resolve conflicts

.github/workflows/build-fex.yml

@@ -1,8 +1,5 @@
 name: Build FEX (x86-64 Steam client)
 
-# Checks tools/fex: the same build DroidDeck-Components' build-fex.yml runs from this repository to publish FEX
-# (its single `fex` release and fex.json, which the app follows). Nothing is published from here.
-
 on:
   push:
     paths:
@@ -31,7 +28,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Build in Arch Linux ARM
-        # Inputs reach the shell as environment variables, never pasted into the script.
         env:
           FEX_EXTRA_CXXFLAGS: ${{ inputs.cxxflags }}
           FEX_THUNKS: ${{ inputs.thunks == 'true' && '1' || '0' }}

.github/workflows/build.yml

@@ -63,6 +63,8 @@ jobs:
           echo "base-sha=$(git rev-parse origin/main)" >> "$GITHUB_OUTPUT"
           git config user.name "ci"
           git config user.email "ci@users.noreply.github.com"
+          # Partial clone: a merged blob that only exists in a fork's history can't be lazily fetched (GitHub: "not our ref"); merge-tree writes it locally first.
+          git merge-tree --write-tree HEAD origin/main >/dev/null || true
           git merge --no-ff --no-edit origin/main
       - name: Resolve trusted manifest base
         id: trusted
@@ -100,6 +102,7 @@ jobs:
           git fetch --no-tags origin "$BUILD_BASE_SHA"
           git config user.name "ci"
           git config user.email "ci@users.noreply.github.com"
+          git merge-tree --write-tree HEAD FETCH_HEAD >/dev/null || true
           git merge --no-ff --no-edit FETCH_HEAD
       - name: Verify pinned source tree
         env:
@@ -158,6 +161,7 @@ jobs:
           git fetch --no-tags origin "$BUILD_BASE_SHA"
           git config user.name "ci"
           git config user.email "ci@users.noreply.github.com"
+          git merge-tree --write-tree HEAD FETCH_HEAD >/dev/null || true
           git merge --no-ff --no-edit FETCH_HEAD
       - name: Verify pinned source tree
         env:
@@ -319,6 +323,7 @@ jobs:
             !/docs/releases/media/
           sparse-checkout-cone-mode: false
           persist-credentials: false
+          submodules: recursive
 
       - name: Check human authorship
         env:
@@ -379,6 +384,7 @@ jobs:
           git fetch --no-tags origin "$BUILD_BASE_SHA"
           BASE=$(git rev-parse --short FETCH_HEAD)
           HEAD=$(git rev-parse --short HEAD)
+          git merge-tree --write-tree HEAD FETCH_HEAD >/dev/null || true
           if git merge --no-ff --no-edit FETCH_HEAD >/tmp/merge.out 2>&1; then
             {
               echo "###  Mergeable"
@@ -531,6 +537,30 @@ jobs:
       - name: Build the add-on packs
         run: bash tools/packs/build.sh app/build/packs
 
+      - name: Pin the Syncthing source
+        id: syncthing-src
+        run: |
+          set -euo pipefail
+          git submodule update --init --recursive tools/syncthing/syncthing-android
+          echo "commit=$(git -C tools/syncthing/syncthing-android/syncthing/src/github.com/syncthing/syncthing rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+      - name: Cache Syncthing
+        id: syncthing
+        uses: actions/cache@v4
+        with:
+          path: app/src/main/jniLibs/arm64-v8a/libsyncthingnative.so
+          key: syncthing-${{ env.NDK_VERSION }}-${{ hashFiles('tools/syncthing/build.sh', 'tools/syncthing/syncthing-android/gradle/libs.versions.toml') }}-${{ steps.syncthing-src.outputs.commit }}
+      - uses: actions/setup-go@v5
+        if: steps.syncthing.outputs.cache-hit != 'true'
+        with:
+          go-version: stable
+          cache: false
+      - name: Build Syncthing
+        if: steps.syncthing.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          export NDK="$ANDROID_HOME/ndk/$NDK_VERSION"
+          tools/syncthing/build.sh app/src/main/jniLibs/arm64-v8a
+
       - name: Note when the proot pack pin is behind this build
         run: |
           set -euo pipefail
@@ -684,6 +714,7 @@ jobs:
           git fetch --no-tags origin "$BUILD_BASE_SHA"
           git config user.name "ci"
           git config user.email "ci@users.noreply.github.com"
+          git merge-tree --write-tree HEAD FETCH_HEAD >/dev/null || true
           git merge --no-ff --no-edit FETCH_HEAD
       - name: Verify backend and test source match
         env:
@@ -737,6 +768,7 @@ jobs:
           git fetch --no-tags origin "$BUILD_BASE_SHA"
           git config user.name "ci"
           git config user.email "ci@users.noreply.github.com"
+          git merge-tree --write-tree HEAD FETCH_HEAD >/dev/null || true
           git merge --no-ff --no-edit FETCH_HEAD
       - name: Verify backend and test source match
         env:

.github/workflows/publish-packs.yml

@@ -1,11 +1,5 @@
 name: Publish add-on packs
 
-# The add-on packs (tools/packs/build.sh) a Build APK run made, published to DroidDeck-Components under
-# content-addressed tags (pack-<name>-<first 16 hex of sha256>). The APK from that run pins each pack's
-# SHA-256 and downloads it from that tag. A tag is created once and never replaced.
-# Only main and release builds publish here; a PR test build attaches the packs main has not published
-# to its pr-N release on DroidDeck-CI (pr-release-publish.yml), which is deleted when the PR closes.
-
 on:
   workflow_call:
     inputs: