ci: gitea actions for the suites, the image and the APK

Four workflows, none of which existed:

* `tests.yml` — backend, desktop, `:core` and the web app's typecheck+build, in
  parallel. `:core` needs no Android SDK at all, because settings.gradle.kts
  leaves `:app` out when there is none; `:app`'s Robolectric suite therefore
  lives in the APK workflow, where the SDK is installed anyway. Nothing needs a
  running backend — the suites feed on committed fixtures, which is the whole
  reason they were written that way.
* `lint.yml` — ruff, which the repo had been configured for and never run.
* `docker.yml` — builds the image, *starts* it against SQLite and waits for
  /api/health before pushing, then publishes `:latest` and `:<short-sha>` to
  git.timka.su. A tag nobody can run is worse than no tag.
* `android-release.yml` — the release APK on every push to master, signed from
  secrets, with `apksigner verify --print-certs` reporting which key was really
  used and failing if it was the debug one.

Three things the repo needed before any of that could work:

`versionCode` was pinned at 1, so every APK looked like the same version to the
phone and would not install over its predecessor. It now comes from the run
number, with `versionName` from a property, both via one `setting()` helper that
reads a Gradle property or an environment variable.

The release build fell back to the *debug* signing key whenever the keystore was
missing — silently. That is a trap: the APK installs, looks fine, and can never
be upgraded by a properly signed build. `KADENCE_REQUIRE_SIGNING=1` makes that
case fail the build instead, and the release job sets it whenever a keystore
secret is present.

The compose files built an image with no name, so there was nothing to pull.
`image:` now names the registry tag while `up --build` still builds locally.

Also: `android/ci/install-sdk.sh` (idempotent, cacheable, and the one place that
knows `platforms;android-37.0` is spelled with the minor version), the runner as
a compose service with its config and a setup checklist, six make targets, and a
README section. No runner is registered yet — `make ci-runner` is step two of
that checklist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/android-release.yml

@@ -0,0 +1,116 @@
+# The release APK, on every push to master.
+#
+# This is the one job that needs the Android SDK, so it is also where the `:app`
+# unit tests run — `:core`'s suite is in `tests.yml`, where no SDK is needed
+# because `settings.gradle.kts` leaves `:app` out when there is none.
+#
+# The Glyph Matrix AAR is deliberately *not* fetched: its licence forbids
+# redistribution, and `app/build.gradle.kts` compiles the `noglyph` source set
+# without it. A CI APK therefore has an inert rear display, which is also exactly
+# right for any phone that is not a Nothing.
+name: android
+
+on:
+  push:
+    branches: [master]
+    tags: ["v*"]
+
+env:
+  ANDROID_HOME: /opt/android-sdk
+  JAVA_HOME: /usr/lib/jvm/java-21-openjdk-amd64
+  DEBIAN_FRONTEND: noninteractive
+
+jobs:
+  apk:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install JDK 21 and the tools the SDK installer needs
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            openjdk-21-jdk-headless curl unzip >/dev/null
+
+      # Keyed on the pinned SDK versions, so this is a download once and a
+      # restore every time after.
+      - uses: actions/cache@v4
+        continue-on-error: true
+        with:
+          path: /opt/android-sdk
+          key: android-sdk-${{ hashFiles('android/gradle/libs.versions.toml') }}
+
+      - uses: actions/cache@v4
+        continue-on-error: true
+        with:
+          path: ~/.gradle/caches
+          key: gradle-app-${{ hashFiles('android/gradle/libs.versions.toml', 'android/gradle/wrapper/gradle-wrapper.properties') }}
+
+      - name: Install the Android SDK
+        run: ./android/ci/install-sdk.sh
+
+      - name: Unit tests (:app, on the JVM via Robolectric)
+        working-directory: android
+        run: ./gradlew --no-daemon :app:testDebugUnitTest
+
+      - name: Unpack the signing key
+        id: key
+        env:
+          KEYSTORE_BASE64: ${{ secrets.KADENCE_KEYSTORE_BASE64 }}
+        run: |
+          if [ -z "${KEYSTORE_BASE64:-}" ]; then
+            echo "No KADENCE_KEYSTORE_BASE64 secret — nothing to sign with." >&2
+            echo "signed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          mkdir -p "$RUNNER_TEMP"
+          printf '%s' "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/kadence.keystore"
+          echo "signed=true" >> "$GITHUB_OUTPUT"
+
+      - name: Build the release APK
+        working-directory: android
+        env:
+          # The run number, so successive APKs install over each other. It was
+          # pinned at 1, which made every build look like the same version.
+          KADENCE_VERSION_CODE: ${{ gitea.run_number }}
+          KADENCE_KEYSTORE: ${{ runner.temp }}/kadence.keystore
+          KADENCE_KEYSTORE_PASSWORD: ${{ secrets.KADENCE_KEYSTORE_PASSWORD }}
+          KADENCE_KEY_ALIAS: ${{ secrets.KADENCE_KEY_ALIAS }}
+          KADENCE_KEY_PASSWORD: ${{ secrets.KADENCE_KEY_PASSWORD }}
+          # With a keystore, a missing or misnamed secret must fail the build
+          # rather than silently produce a debug-signed "release".
+          KADENCE_REQUIRE_SIGNING: ${{ steps.key.outputs.signed == 'true' && '1' || '0' }}
+        run: ./gradlew --no-daemon :app:assembleRelease
+
+      - name: Say which key actually signed it
+        run: |
+          APKSIGNER="$(find "$ANDROID_HOME/build-tools" -name apksigner | sort | tail -1)"
+          APK=android/app/build/outputs/apk/release/app-release.apk
+          "$APKSIGNER" verify --print-certs "$APK"
+          if [ "${{ steps.key.outputs.signed }}" = "true" ]; then
+            # The debug key is unmistakable, and shipping it would be a trap: the
+            # APK installs, then cannot be upgraded by a properly signed one.
+            if "$APKSIGNER" verify --print-certs "$APK" | grep -q "CN=Android Debug"; then
+              echo "::error::signed with the debug key despite a keystore being provided"
+              exit 1
+            fi
+          fi
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: kadence-release-apk
+          path: android/app/build/outputs/apk/release/app-release.apk
+          if-no-files-found: error
+
+      - name: Attach it to the release, when this is a tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          VERSION="${GITHUB_REF#refs/tags/}"
+          API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+          ID="$(curl -fsS -H "Authorization: token $TOKEN" "$API/releases/tags/$VERSION" \
+                | sed -n 's/.*"id":[ ]*\([0-9]*\).*/\1/p' | head -1)"
+          curl -fsS -X POST -H "Authorization: token $TOKEN" \
+            -F "attachment=@android/app/build/outputs/apk/release/app-release.apk" \
+            "$API/releases/$ID/assets?name=kadence-$VERSION.apk"

.gitea/workflows/docker.yml

@@ -0,0 +1,70 @@
+# Build the backend + web image and push it to this Gitea's own registry.
+#
+# The image is the same one `docker compose` builds locally — one Dockerfile,
+# two stages, Vite's output baked in and served from the same origin as the API.
+# Tagged twice: `latest` for the deploy script to pull, and the short commit for
+# every build to be nameable after the fact.
+#
+# Needs a runner that can reach a docker daemon. The compose service in
+# `docker-compose.ci.yml` mounts the host's socket into the job container, which
+# is the usual arrangement for a single-machine Gitea.
+name: docker
+
+on:
+  push:
+    branches: [master]
+    tags: ["v*"]
+
+env:
+  REGISTRY: git.timka.su
+  IMAGE: git.timka.su/timka123/kadence
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check the daemon is reachable
+        run: docker version
+
+      - name: Log in to the Gitea registry
+        run: |
+          echo "${{ secrets.REGISTRY_TOKEN }}" \
+            | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Build
+        run: |
+          SHORT="$(git rev-parse --short HEAD)"
+          echo "SHORT=$SHORT" >> "$GITHUB_ENV"
+          docker build -t "$IMAGE:$SHORT" -t "$IMAGE:latest" .
+
+      - name: Smoke-test the image before it is published
+        run: |
+          # A tag nobody can run is worse than no tag. SQLite keeps this to one
+          # container: no database service, no network, no .env.
+          docker run -d --name kadence-smoke \
+            -e DATABASE_URL="sqlite:///./kadence.db" \
+            -e SCHEDULER_ENABLED=0 -e TELEGRAM_BOT_ENABLED=0 \
+            -p 18000:8000 "$IMAGE:$SHORT"
+          for _ in $(seq 1 30); do
+            if curl -fsS http://127.0.0.1:18000/api/health >/dev/null 2>&1; then
+              echo "healthy"; break
+            fi
+            sleep 2
+          done
+          curl -fsS http://127.0.0.1:18000/api/health
+          docker logs kadence-smoke | tail -20
+          docker rm -f kadence-smoke
+
+      - name: Push
+        run: |
+          docker push "$IMAGE:$SHORT"
+          docker push "$IMAGE:latest"
+
+      - name: Push the tag, when there is one
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          VERSION="${GITHUB_REF#refs/tags/}"
+          docker tag "$IMAGE:$SHORT" "$IMAGE:$VERSION"
+          docker push "$IMAGE:$VERSION"

.gitea/workflows/lint.yml

@@ -0,0 +1,26 @@
+# ruff, which the repo has been configured for and never ran.
+name: lint
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  ruff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install ruff
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends python3-venv >/dev/null
+          python3 -m venv /tmp/venv
+          /tmp/venv/bin/pip install -q ruff
+
+      # The rule set lives in backend/pyproject.toml; the desktop app has no ruff
+      # section of its own and is checked with the same one. `ruff format` is not
+      # run on purpose — see the note in that config.
+      - name: ruff check
+        run: /tmp/venv/bin/ruff check --config backend/pyproject.toml backend desktop

.gitea/workflows/test.yml

@@ -0,0 +1,99 @@
+# The suites, on every push and pull request.
+#
+# All four are offline by design: the backend only ever runs on one machine, so
+# nothing here may need it up. Fixtures and fakes, never a live server.
+#
+# `ubuntu-latest` is whatever the runner's label map points at — see
+# `docker-compose.ci.yml`, which pins it to catthehacker/ubuntu:act-24.04 for the
+# two things every job needs: a node (Gitea's javascript actions run inside the
+# job container) and Python 3.12, which the backend requires.
+name: tests
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+env:
+  DEBIAN_FRONTEND: noninteractive
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Python tooling
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends python3-venv >/dev/null
+          python3 -m venv /tmp/venv
+          /tmp/venv/bin/pip install -q -e "./backend[dev]"
+
+      - name: pytest
+        working-directory: backend
+        run: PYTHONPATH="$PWD" /tmp/venv/bin/python -m pytest -q
+
+  desktop:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # No PyQt6 and no display: nothing under desktop/tests imports Qt. The
+      # three modules it covers — the blocker manager, the DNS stub, the mini
+      # timer's geometry — are plain standard library, which is why they are
+      # testable at all. `pythonpath = ["."]` is already in the pytest config.
+      - name: Install pytest
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends python3-venv >/dev/null
+          python3 -m venv /tmp/venv
+          /tmp/venv/bin/pip install -q pytest
+
+      - name: pytest
+        working-directory: desktop
+        run: /tmp/venv/bin/python -m pytest -q
+
+  web:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/cache@v4
+        continue-on-error: true
+        with:
+          path: frontend/node_modules
+          key: npm-${{ hashFiles('frontend/package-lock.json') }}
+
+      - name: Install, typecheck, build
+        working-directory: frontend
+        run: |
+          npm ci --no-audit --no-fund
+          npm run typecheck
+          npm run build
+
+  android-core:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # `:core` is plain Kotlin on the JVM and `settings.gradle.kts` only
+      # includes `:app` when an SDK is present, so this job needs a JDK and
+      # nothing else. The `:app` unit tests run in the release workflow, where
+      # the SDK has to be installed anyway.
+      - name: Install JDK 21
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends openjdk-21-jdk-headless >/dev/null
+
+      - uses: actions/cache@v4
+        continue-on-error: true
+        with:
+          path: ~/.gradle/caches
+          key: gradle-core-${{ hashFiles('android/gradle/libs.versions.toml', 'android/gradle/wrapper/gradle-wrapper.properties') }}
+
+      - name: gradlew :core:test
+        working-directory: android
+        env:
+          JAVA_HOME: /usr/lib/jvm/java-21-openjdk-amd64
+        run: ./gradlew --no-daemon :core:test