ci: pin sqlite3 + pre-fetch onnxruntime offline

Run 11 reached the build and revealed two issues:
- Runner re-resolved sqlite3 to 3.3.3 (cn mirror), mismatching the
  vendored 3.3.2 binary hash. Pin it via dependency_overrides.
- flutter_onnxruntime's github download of ONNX Runtime failed.
  Pre-fetch it via a China-accessible proxy into the plugin's
  expected build path so it skips the download and bundles the dll.

.gitea/workflows/ci.yml

@@ -114,10 +114,39 @@ jobs:
       - name: Enable Windows desktop
         run: flutter config --enable-windows-desktop
 
-      # CMake's file(DOWNLOAD) honours these proxy vars when fetching ONNX
-      # Runtime. Defaults to the local clash/v2ray proxy; override with repo
-      # secrets HTTP_PROXY / HTTPS_PROXY if yours differs. Install ONNX Runtime
-      # system-wide to skip the download entirely.
+      # The flutter_onnxruntime plugin downloads the ONNX Runtime native lib
+      # from github.com during the build, which is blocked here. Pre-place the
+      # extracted SDK where the plugin expects it (via a China-accessible GitHub
+      # proxy) so it skips the download and still bundles onnxruntime.dll.
+      - name: Pre-fetch ONNX Runtime
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $ProgressPreference = 'SilentlyContinue'
+          $ver = 'onnxruntime-win-x64-1.22.0'
+          $dst = 'build\windows\x64\plugins\flutter_onnxruntime\onnxruntime'
+          $marker = Join-Path $dst "$ver\include\onnxruntime_cxx_api.h"
+          if (Test-Path $marker) { Write-Host "ONNX Runtime already present"; exit 0 }
+          New-Item -ItemType Directory -Force -Path $dst | Out-Null
+          $zip = Join-Path $env:TEMP 'ort.zip'
+          $gh = "github.com/microsoft/onnxruntime/releases/download/v1.22.0/$ver.zip"
+          $urls = @("https://gh-proxy.com/https://$gh", "https://ghfast.top/https://$gh", "https://$gh")
+          $curl = "$env:SystemRoot\System32\curl.exe"
+          $ok = $false
+          foreach ($u in $urls) {
+            Write-Host "Fetching ONNX Runtime: $u"
+            & $curl -L --fail --retry 2 --retry-delay 5 -o $zip $u
+            if ($LASTEXITCODE -eq 0 -and (Test-Path $zip)) { $ok = $true; break }
+            Write-Host "  failed (exit $LASTEXITCODE)"
+          }
+          if (-not $ok) { Write-Error "Failed to fetch ONNX Runtime from all mirrors"; exit 1 }
+          Expand-Archive -Path $zip -DestinationPath $dst -Force
+          Remove-Item $zip -Force
+          if (-not (Test-Path $marker)) { Write-Error "ONNX Runtime not in expected layout"; exit 1 }
+          Write-Host "ONNX Runtime ready at $dst\$ver"
+
+      # Proxy vars are kept as a fallback in case the pre-fetch above is bypassed
+      # (CMake's file(DOWNLOAD) honours them).
       - name: Build Windows release
         env:
           HTTP_PROXY: http://127.0.0.1:7890

pubspec.lock

@@ -958,7 +958,7 @@ packages:
     source: hosted
     version: "2.4.0"
   sqlite3:
-    dependency: transitive
+    dependency: "direct overridden"
     description:
       name: sqlite3
       sha256: "9488c7d2cdb1091c91cacf7e207cff81b28bff8e366f042bad3afe7d34afe189"

pubspec.yaml

@@ -51,6 +51,13 @@ dependencies:
   # Embedded ONNX runtime (local OCR recognition backend)
   flutter_onnxruntime: ^1.8.0
 
+# Pin sqlite3 to the exact version whose native binaries are vendored under
+# vendor/sqlite3/ (see hooks block below). Without this, pub re-resolves to the
+# latest sqlite3 on the cn mirror (e.g. 3.3.3), whose expected binary hash no
+# longer matches the vendored files and the native-asset build fails.
+dependency_overrides:
+  sqlite3: 3.3.2
+
 dev_dependencies:
   flutter_test:
     sdk: flutter