ci: port analyze/test gate to Forgejo Actions, retire .gitlab-ci.yml

git.comunes.org is Forgejo. Replicates the analyze + commons_core/app_seeds test
gate in .forgejo/workflows/ci.yml (per-push + PR). Dropped the GitLab-only Windows
job (no Forgejo Windows runner).

.forgejo/workflows/ci.yml

@@ -0,0 +1,51 @@
+# Per-push gate for git.comunes.org (Forgejo Actions): analyze + tests.
+# Mirrors the local verification gate in docs/design/testing.md. Ported from the
+# retired .gitlab-ci.yml. Flutter pinned to the developer toolchain (3.41.9).
+#
+# NOTE: `runs-on` must match a label your Forgejo runner registered with; adjust
+# if the Comunes runner uses something other than `docker`.
+
+name: ci
+
+on:
+  push:
+    branches: ['**']
+  pull_request:
+
+jobs:
+  analyze:
+    runs-on: docker
+    container:
+      image: ghcr.io/cirruslabs/flutter:3.41.9
+    steps:
+      - uses: actions/checkout@v4
+      - run: flutter pub get
+      - run: dart format --output=none --set-exit-if-changed .
+      - run: flutter analyze
+
+  test-commons-core:
+    runs-on: docker
+    container:
+      image: ghcr.io/cirruslabs/flutter:3.41.9
+    steps:
+      - uses: actions/checkout@v4
+      - run: flutter pub get
+      - name: dart test
+        working-directory: packages/commons_core
+        run: dart test
+
+  test-app-seeds:
+    runs-on: docker
+    container:
+      image: ghcr.io/cirruslabs/flutter:3.41.9
+    steps:
+      - uses: actions/checkout@v4
+      # SQLCipher so the "no plaintext at rest" security test actually runs.
+      - run: apt-get update -qq && apt-get install -y -qq libsqlcipher-dev
+      - run: flutter pub get
+      - name: Generate code + test
+        working-directory: apps/app_seeds
+        run: |
+          dart run slang
+          dart run build_runner build --delete-conflicting-outputs
+          flutter test --coverage

.gitlab-ci.yml

@@ -1,88 +0,0 @@
-# CI for Tane. Mirrors the local verification gate (analyze + test +
-# coverage) from docs/design/testing.md. Adapt to GitHub Actions if the
-# canonical remote changes; the commands are the same.
-#
-# Uses the official Flutter Docker image. Pin the version to match the
-# developer toolchain (Flutter 3.41.x / Dart 3.11.x).
-image: ghcr.io/cirruslabs/flutter:3.41.9
-
-stages:
-  - analyze
-  - test
-  - build
-
-variables:
-  PUB_CACHE: "$CI_PROJECT_DIR/.pub-cache"
-
-cache:
-  key: "$CI_COMMIT_REF_SLUG"
-  paths:
-    - .pub-cache/
-
-before_script:
-  # SQLCipher so the "no plaintext at rest" security test actually runs (it
-  # skips where the library is absent). The -dev package ships the unversioned
-  # libsqlcipher.so symlink, which package:sqlite3 loads reliably.
-  - apt-get update -qq && apt-get install -y -qq libsqlcipher-dev
-  - flutter --version
-  - flutter pub get
-
-analyze:
-  stage: analyze
-  script:
-    - dart format --output=none --set-exit-if-changed .
-    - flutter analyze
-
-test:commons_core:
-  stage: test
-  script:
-    - cd packages/commons_core
-    - dart test
-
-# Windows desktop build. Needs a Windows runner: on gitlab.com the SaaS
-# `saas-windows-medium-amd64` shared runners (Windows Server 2022 with Visual
-# Studio 2022 Build Tools — the C++ workload Flutter requires). Manual +
-# allow_failure until the canonical remote actually has Windows runners.
-build:windows:
-  stage: build
-  tags:
-    - saas-windows-medium-amd64
-  rules:
-    - when: manual
-      allow_failure: true
-  # The global Linux image is ignored on Windows shell runners; override the
-  # global before_script (apt-get) — this job runs in PowerShell.
-  before_script:
-    - git clone --depth 1 -b stable https://github.com/flutter/flutter.git "$env:CI_PROJECT_DIR\.flutter"
-    - $env:PATH = "$env:CI_PROJECT_DIR\.flutter\bin;$env:PATH"
-    - flutter --version
-    - flutter pub get
-  script:
-    - cd apps\app_seeds
-    - dart run slang
-    - dart run build_runner build --delete-conflicting-outputs
-    - flutter build windows --release
-  artifacts:
-    paths:
-      - apps/app_seeds/build/windows/x64/runner/Release/
-
-test:app_seeds:
-  stage: test
-  script:
-    - cd apps/app_seeds
-    # slang is generated via its CLI (disabled in build_runner); Drift via build_runner.
-    - dart run slang
-    - dart run build_runner build --delete-conflicting-outputs
-    - flutter test --coverage
-  coverage: '/lines\.*: \d+\.\d+\%/'
-  artifacts:
-    paths:
-      - apps/app_seeds/coverage/lcov.info
-    reports:
-      coverage_report:
-        coverage_format: cobertura
-        path: apps/app_seeds/coverage/cobertura.xml
-
-# Release automation (signed AAB + Play upload on tag) lives in Forgejo Actions,
-# since the canonical remote (git.comunes.org) is Forgejo, not GitLab:
-#   .forgejo/workflows/release.yml