CI: make builds work on China-based self-hosted Gitea runner

The self-hosted Windows runner can't reach github.com (GFW), so the previous
workflow failed cloning actions/checkout and would also fail downloading the
Flutter SDK and the sqlite3 native binary.

- Vendor the official, SHA-256-verified sqlite3 binaries under vendor/sqlite3/
  and select them via pubspec hooks.user_defines (source: test-sqlite3). Builds
  and tests now run fully offline — no GitHub download, no proxy, no
  LD_LIBRARY_PATH hack (removed .local-sqlite/).
- Consolidate CI into one Windows workflow: fetch actions from the gitea.com
  mirror, use the runner's pre-installed Flutter (no SDK download), and use the
  flutter-io.cn pub/Flutter mirrors. Server tests use the Tsinghua PyPI mirror.
- Document the offline build + China mirrors in README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -3,28 +3,35 @@ name: CI
 on:
   push:
     branches: [main]
+    tags: ["v*"]
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
-# Allow builds to find SQLite / Flutter artifacts behind a corporate proxy.
-# Configure repo/org secrets HTTP_PROXY / HTTPS_PROXY in Gitea if needed.
+# This pipeline targets a self-hosted Windows runner inside mainland China.
+# Notes on the design (so it works behind the GFW):
+#   * Actions are fetched from the gitea.com mirror, NOT github.com, which is
+#     unreachable here. (Alternatively set DEFAULT_ACTIONS_URL=https://gitea.com
+#     in the runner's config and drop the full URL prefix.)
+#   * Flutter is expected to be pre-installed on the runner (the same machine
+#     used for local development) — we do NOT download the SDK from Google.
+#   * pub / Flutter artifacts use the flutter-io.cn mirrors.
+#   * The sqlite3 native binary is vendored in the repo (vendor/sqlite3/), so no
+#     GitHub-releases download happens during the build.
 env:
-  FLUTTER_VERSION: "3.41.4"
+  PUB_HOSTED_URL: https://pub.flutter-io.cn
+  FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
 
 jobs:
-  analyze:
-    name: Analyze (Flutter)
-    runs-on: ubuntu-latest
+  flutter:
+    name: Flutter (analyze, test, Windows build)
+    runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: https://gitea.com/actions/checkout@v4
 
-      - name: Set up Flutter
-        uses: subosito/flutter-action@v2
-        with:
-          flutter-version: ${{ env.FLUTTER_VERSION }}
-          channel: stable
-          cache: true
+      - name: Flutter version (must be pre-installed on the runner)
+        run: flutter --version
 
       - name: Install dependencies
         run: flutter pub get
@@ -35,67 +42,42 @@ jobs:
       - name: Static analysis
         run: flutter analyze
 
-  test:
-    name: Test (Flutter, Linux)
-    runs-on: ubuntu-latest
-    needs: analyze
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Flutter
-        uses: subosito/flutter-action@v2
-        with:
-          flutter-version: ${{ env.FLUTTER_VERSION }}
-          channel: stable
-          cache: true
-
-      # The sqlite3 Dart package downloads a precompiled binary from GitHub
-      # releases when building native assets. On Linux CI we instead link the
-      # system libsqlite3 to avoid the download (faster + works offline).
-      # This override is applied only in CI; the committed pubspec.yaml stays
-      # clean so the Windows build downloads the bundled sqlite3.dll normally.
-      - name: Install system SQLite
-        run: sudo apt-get update && sudo apt-get install -y libsqlite3-dev
-
-      - name: Use system SQLite for native assets (CI only)
-        run: |
-          cat >> pubspec.yaml <<'EOF'
-
-          hooks:
-            user_defines:
-              sqlite3:
-                source: system
-          EOF
-
-      - name: Install dependencies
-        run: flutter pub get
-
       - name: Run tests
         run: flutter test --reporter expanded
 
+      - name: Enable Windows desktop
+        run: flutter config --enable-windows-desktop
+
+      - name: Build Windows release
+        run: flutter build windows --release
+
+      - name: Package artifact
+        run: Compress-Archive -Path "build/windows/x64/runner/Release/*" -DestinationPath "badnote-windows-x64.zip" -Force
+
+      - name: Upload artifact
+        uses: https://gitea.com/actions/upload-artifact@v3
+        with:
+          name: badnote-windows-x64
+          path: badnote-windows-x64.zip
+          if-no-files-found: error
+
   server:
-    name: Test (Server, optional)
-    runs-on: ubuntu-latest
-    # The server is an optional/experimental backend. Keep it from blocking
-    # the pipeline, but still surface failures.
+    name: Server tests (optional)
+    runs-on: windows-latest
+    # The Python backend is optional/experimental; never block the pipeline.
     continue-on-error: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: https://gitea.com/actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-          cache: pip
-
-      - name: Install dependencies
+      - name: Install dependencies (Tsinghua PyPI mirror)
         working-directory: server
         run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements.txt
+          python -m pip install --upgrade pip -i https://pypi.tuna.tsinghua.edu.cn/simple
+          pip install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple
 
       - name: Run tests
         working-directory: server
+        env:
+          BADNOTE_JWT_SECRET: ci-test-secret
         run: pytest -q

.gitea/workflows/windows-build.yml

@@ -1,57 +0,0 @@
-name: Windows Build
-
-on:
-  push:
-    branches: [main]
-    tags: ["v*"]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-env:
-  FLUTTER_VERSION: "3.41.4"
-
-jobs:
-  build-windows:
-    name: Build Windows (x64)
-    runs-on: windows-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Flutter
-        uses: subosito/flutter-action@v2
-        with:
-          flutter-version: ${{ env.FLUTTER_VERSION }}
-          channel: stable
-          cache: true
-
-      - name: Enable Windows desktop
-        run: flutter config --enable-windows-desktop
-
-      - name: Install dependencies
-        run: flutter pub get
-
-      - name: Analyze
-        run: flutter analyze
-
-      # The sqlite3 native asset downloads a precompiled DLL from GitHub
-      # releases. If the runner is behind a firewall, set HTTP_PROXY /
-      # HTTPS_PROXY as repository secrets and they will be honoured here.
-      - name: Build Windows release
-        env:
-          HTTP_PROXY: ${{ secrets.HTTP_PROXY }}
-          HTTPS_PROXY: ${{ secrets.HTTPS_PROXY }}
-        run: flutter build windows --release
-
-      - name: Package artifact
-        run: |
-          $dir = "build\windows\x64\runner\Release"
-          Compress-Archive -Path "$dir\*" -DestinationPath "badnote-windows-x64.zip" -Force
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: badnote-windows-x64
-          path: badnote-windows-x64.zip
-          if-no-files-found: error